npmpackage.info

Gathering detailed insights and metrics for hwp-csp-plugin

hwp-csp-plugin - 2.2.1 | npmpackage.info

hwp-csp-plugin

Content Security Policy plugin for html-webpack-plugin

2.2.1

MIT

TypeScript

15.82 kB

6.3

Installations

npm install hwp-csp-plugin

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Node Version

18.20.5

NPM Version

10.8.2 Score

63.6

Supply Chain

75.9

Quality

Maintenance

100

Vulnerability

99.6

License

Pull Requests

Open

0

Total

1,251

Closed

359

Merged

892

Issues

Open

1

Total

1

Closed

0

Releases

2.2.1

Updated on Dec 15, 2024

2.2.0

Updated on Aug 24, 2024

2.1.3

Updated on Oct 29, 2023

2.1.2

Updated on Jul 15, 2022

2.1.1

Updated on Jul 15, 2022

2.1.0

Updated on Apr 11, 2022

View All 9 releases

Languages

TypeScript

HTML

JavaScript

TypeScript (91.28%)

HTML (7.06%)

JavaScript (1.66%)

Developer

sjinks

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

MIT License

2 Stars

1,108 Commits

1 Forks

3 Watchers

1 Branches

3 Contributors

Updated on Jul 11, 2025

Maintainers

View All 3 Contributors

Package Meta Information

Latest Version

2.2.1

Package Id

hwp-csp-plugin@2.2.1

Unpacked Size

15.82 kB

Size

5.52 kB

File Count

NPM Version

10.8.2

Node Version

18.20.5

Published on

Dec 15, 2024

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

hwp-csp-plugin

Plugin to add Content-Security-Policy to HTML files generated by html-webpack-plugin

It was heavily inspired by csp-html-webpack-plugin, but it operates a bit differently.

Installation

1npm i -D hwp-csp-plugin

Usage

1import { HwpCspPlugin } from 'hwp-csp-plugin';
2
3// Webpack configuration object
4export default {
5
6    plugins: [
7        new HtmlWebpackPlugin({ /* ... */ }),
8        new HwpCspPlugin(/* options */),
9    ],
10};

To configure the plugin, pass an object with the following keys to its constructor (all keys are optional):

enabled (boolean, defaults to true): whether to enable the plugin;
policy (Record<string, string | string[]>): Content Security Policy; keys are <directives>, values are <values>. Values can be a string ("'self' https:") or arrays (["'self'", 'https:'])
hashFunc (one of sha256, sha384 (default), sha512): hash function to generate hashes of inline scripts / styles;
hashEnabled: can be either boolean or an object with the following properties:
- script (boolean, defaults to true): whether to generate hashes of inline scripts;
- style (boolean, defaults to true): whether to generate hashes of inline styles;
addIntegrity (boolean, defaults to false): whether to add integrity attribute to inline scripts and styles (controlled by hashEnabled option).

Differences to csp-html-webpack-plugin

HwpCspPlugin intentionally does not support nonces. Nonces, by definition, must be used only once and be unique for every request.
HwpCspPlugin does not support html-webpack-plugin < 4.x
HwpCspPlugin does not enforce a default content security policy.
HwpCspPlugin uses a subjectively simpler approach to configuration and lets you shoot yourself in the foot.
HwpCspPlugin is written in TypeScript (not that it is a killer feature, but it hopefully simplifies maintenance)

Things to Do

Currently the plugin removes existing <meta http-equiv="Content-Security-Policy"/> metatags. However, it could be possible to have multiple CSPs. This needs to be investigated, and if so, then this behavior should be configurable;
Add callbacks allowing the user to modify the CSP before it is written to the file;
Consider unsafe-hashes and script-src-attr / style-src-attr.

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Maintained

Determines if the project is "actively maintained".

10

License

Determines if the project has defined a license.

10

SAST

Determines if the project uses static code analysis.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

9

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

8

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

Security-Policy

Determines if the project has published a security policy.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

Score

6.3

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

hwp-csp-plugin

Installations

Developer Guide

No

CommonJS

18.20.5

10.8.2

Score

Pull Requests

0

1,251

359

892

Issues

1

1

0

Releases

Languages

Developer

sjinks

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

NaN

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Peer Dependencies

Dev Dependencies

hwp-csp-plugin

Installation

Usage

Differences to csp-html-webpack-plugin

Things to Do

10

10

10

10

10

10

9

8

0

0

0

0

0

6.3

/10