Gathering detailed insights and metrics for pdfjs-dist
Gathering detailed insights and metrics for pdfjs-dist
Installations
npm install pdfjs-distDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS, UMD
Min. Node Version
>=20.16.0 || >=22.3.0
Node Version
22.14.0
NPM Version
10.9.2
Score
98.1
Supply Chain
76.8
Quality
91.6
Maintenance
100
Vulnerability
93.3
License
Releases
73
Languages
5
JavaScript
Fluent
CSS
HTML
TypeScript
JavaScript (70.42%)
Fluent (26.7%)
CSS (1.96%)
HTML (0.91%)
TypeScript (0.02%)
Developer
Download Statistics
Total Downloads
469,470,754
Last Day
730,121
Last Week
3,659,592
Last Month
14,961,622
Last Year
154,127,047
GitHub Statistics
Apache-2.0 License
50,734 Stars
20,840 Commits
10,301 Forks
1,120 Watchers
1 Branches
397 Contributors
Updated on May 15, 2025
Bundle Size
341.42 kB
Minified
99.60 kB
Minified + Gzipped
Maintainers
3
Package Meta Information
Latest Version
5.2.133
Package Id
pdfjs-dist@5.2.133
Unpacked Size
33.48 MB
Size
8.98 MB
File Count
373
NPM Version
10.9.2
Node Version
22.14.0
Published on
Apr 27, 2025
Total Downloads
Cumulative downloads
Total Downloads
469,470,754
Last Day
6.6%
730,121
Compared to previous day
Last Week
17.6%
3,659,592
Compared to previous week
Last Month
-2.3%
14,961,622
Compared to previous month
Last Year
34.4%
154,127,047
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Optional Dependencies
1
PDF.js
PDF.js is a Portable Document Format (PDF) library that is built with HTML5. Our goal is to create a general-purpose, web standards-based platform for parsing and rendering PDFs.
This is a pre-built version of the PDF.js source code. It is automatically generated by the build scripts.
For usage with older browsers/environments, without native support for the
latest JavaScript features, please see the legacy/ folder.
Please see this wiki page for information about supported browsers/environments.
See https://github.com/mozilla/pdf.js for learning and contributing.
High
8.8/10
Summary
Malicious PDF can inject JavaScript into PDF Viewer
Affected Versions
< 1.10.100
Patched Versions
1.10.100
High
8.8/10
Summary
Malicious PDF can inject JavaScript into PDF Viewer
Affected Versions
>= 2.0.0, < 2.0.550
Patched Versions
2.0.550
High
8.8/10
Summary
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
Affected Versions
<= 4.1.392
Patched Versions
4.2.67
Reason
30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: .github/SECURITY.md:1
- Info: Found linked content: .github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: .github/SECURITY.md:1
- Info: Found text in security policy: .github/SECURITY.md:1
Reason
GitHub workflow tokens follow principle of least privilege
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/fluent_linter.yml:19
- Info: topLevel 'contents' permission set to 'read': .github/workflows/font_tests.yml:23
- Info: topLevel 'contents' permission set to 'read': .github/workflows/lint.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/publish_release.yml:6
- Info: topLevel 'contents' permission set to 'read': .github/workflows/publish_website.yml:7
- Info: topLevel 'contents' permission set to 'read': .github/workflows/types_tests.yml:4
- Info: no jobLevel write permissions found
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish_release.yml:10
Reason
project is fuzzed
Details
- Info: OSSFuzz integration found
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
0 existing vulnerabilities detected
Reason
binaries present in source code
Details
- Warn: binary detected: external/openjpeg/openjpeg.wasm:1
- Warn: binary detected: external/qcms/qcms_bg.wasm:1
Reason
dependency not pinned by hash detected -- score normalized to 2
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/fluent_linter.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/fluent_linter.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/fluent_linter.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/fluent_linter.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/font_tests.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/font_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/font_tests.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/font_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/font_tests.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/font_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/lint.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/lint.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_release.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_release.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/types_tests.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/types_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/types_tests.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/types_tests.yml/master?enable=pin
- Warn: pipCommand not pinned by hash: .github/workflows/fluent_linter.yml:38
- Warn: pipCommand not pinned by hash: .github/workflows/font_tests.yml:59
- Info: 0 out of 21 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 pipCommand dependencies pinned
- Info: 6 out of 6 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v5.2.133 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/215029213
- Warn: release artifact v5.1.91 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/209207821
- Warn: release artifact v5.0.375 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/206035046
- Warn: release artifact v4.10.38 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/192847779
- Warn: release artifact v4.9.155 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/189278242
- Warn: release artifact v5.2.133 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/215029213
- Warn: release artifact v5.1.91 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/209207821
- Warn: release artifact v5.0.375 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/206035046
- Warn: release artifact v4.10.38 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/192847779
- Warn: release artifact v4.9.155 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/189278242
Score
8.2
/10
Last Scanned on 2025-05-05
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More