Gathering detailed insights and metrics for packument
Installations
npm install packumentDeveloper Guide
BETA
Typescript
No
Module System
N/A
Min. Node Version
>=10
Node Version
16.9.1
NPM Version
7.21.1
Score
82.5
Supply Chain
91.2
Quality
74.6
Maintenance
100
Vulnerability
99.6
License
Releases
Unable to fetch releases
Contributors
1
Unable to fetch Contributors
Languages
1
JavaScript
JavaScript (100%)
Developer
vweevers
Download Statistics
Total Downloads
3,182,696
Last Day
1,871
Last Week
8,244
Last Month
38,211
Last Year
667,919
GitHub Statistics
2 Stars
12 Commits
1 Watching
3 Branches
1 Contributors
Bundle Size
6.72 kB
Minified
2.76 kB
Minified + Gzipped
Maintainers
1
Package Meta Information
Latest Version
2.0.0
Package Id
packument@2.0.0
Unpacked Size
5.77 kB
Size
2.63 kB
File Count
4
NPM Version
7.21.1
Node Version
16.9.1
Total Downloads
Cumulative downloads
Total Downloads
3,182,696
Last day
-3.9%
1,871
Compared to previous day
Last week
-21.5%
8,244
Compared to previous week
Last month
-11%
38,211
Compared to previous month
Last year
25.5%
667,919
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
3
Versions
packument
Fetch package metadata from the npm registry. Supports scopes and private registries. If you only need the metadata of a specific version, use packument-package.
example
1const packument = require('packument') 2 3packument('levelup', (err, result) => { 4 if (err) throw err 5 console.log(result.versions['2.0.2'].dependencies) 6})
packument(name[, opts], callback)
Callback receives an error if any, a packument and response headers. Options:
headers: custom headers (you can override any)keepAlive: shortcut forheaders: { connection: 'keep-alive' }full: if true, fetch full metadata rather than an abbreviated document.
packument = packument.factory(opts)
Preconfigure the function. For example, to always fetch full metadata:
1const packument = require('packument').factory({ full: true }) 2 3packument('levelup', (err, result) => { 4 if (err) throw err 5 console.log(result._rev) 6})
Combine it with an in-memory cache:
1const memoize = require('thunky-with-args') 2const packument = memoize(require('packument').factory({ full: true })) 3 4packument('levelup', (err, result) => { 5 // It will make only one request 6}) 7 8packument('levelup', (err, result) => { 9 // Subsequent calls for the same package are cached 10})
Reuse that cache in other modules:
1const memoize = require('thunky-with-args') 2const packument = memoize(require('packument')) 3const getPackage = require('packument-package').factory(packument) 4 5getPackage('levelup', '~2.0.0', function (err, pkg) { 6 if (err) throw err 7 console.log(pkg.version) 8})
install
With npm do:
npm install packument
license
MIT © Vincent Weevers
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/test.yml:1
- Info: no jobLevel write permissions found
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
Found 0/10 approved changesets -- score normalized to 0
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/vweevers/packument/test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/vweevers/packument/test.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/test.yml:19
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 2 are checked with a SAST tool
Score
3.8
/10
Last Scanned on 2025-01-27
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More