Gathering detailed insights and metrics for pdfjs-dist
Gathering detailed insights and metrics for pdfjs-dist
Installations
npm install pdfjs-distDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS, UMD
Min. Node Version
>=20.16.0 || >=22.3.0
Node Version
22.14.0
NPM Version
10.9.2
Score
98.1
Supply Chain
76.8
Quality
87.5
Maintenance
100
Vulnerability
87.3
License
Releases
73
Languages
5
JavaScript
Fluent
CSS
HTML
TypeScript
JavaScript (70.4%)
Fluent (26.7%)
CSS (1.97%)
HTML (0.91%)
TypeScript (0.02%)
Developer
Download Statistics
Total Downloads
477,118,946
Last Day
142,901
Last Week
3,516,240
Last Month
15,083,338
Last Year
154,503,034
GitHub Statistics
Apache-2.0 License
50,894 Stars
20,903 Commits
10,315 Forks
1,123 Watchers
1 Branches
398 Contributors
Updated on May 31, 2025
Bundle Size
341.42 kB
Minified
99.60 kB
Minified + Gzipped
Maintainers
3
Package Meta Information
Latest Version
5.2.133
Package Id
pdfjs-dist@5.2.133
Unpacked Size
33.48 MB
Size
8.98 MB
File Count
373
NPM Version
10.9.2
Node Version
22.14.0
Published on
Apr 27, 2025
Total Downloads
Cumulative downloads
Total Downloads
477,118,946
Optional Dependencies
1
PDF.js
PDF.js is a Portable Document Format (PDF) library that is built with HTML5. Our goal is to create a general-purpose, web standards-based platform for parsing and rendering PDFs.
This is a pre-built version of the PDF.js source code. It is automatically generated by the build scripts.
For usage with older browsers/environments, without native support for the
latest JavaScript features, please see the legacy/ folder.
Please see this wiki page for information about supported browsers/environments.
See https://github.com/mozilla/pdf.js for learning and contributing.
High
8.8/10
Summary
Malicious PDF can inject JavaScript into PDF Viewer
Affected Versions
< 1.10.100
Patched Versions
1.10.100
High
8.8/10
Summary
Malicious PDF can inject JavaScript into PDF Viewer
Affected Versions
>= 2.0.0, < 2.0.550
Patched Versions
2.0.550
High
8.8/10
Summary
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
Affected Versions
<= 4.1.392
Patched Versions
4.2.67
Reason
30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Reason
security policy file detected
Details
- Info: security policy file detected: .github/SECURITY.md:1
- Info: Found linked content: .github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: .github/SECURITY.md:1
- Info: Found text in security policy: .github/SECURITY.md:1
Reason
no dangerous workflow patterns detected
Reason
GitHub workflow tokens follow principle of least privilege
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/fluent_linter.yml:19
- Info: topLevel 'contents' permission set to 'read': .github/workflows/font_tests.yml:23
- Info: topLevel 'contents' permission set to 'read': .github/workflows/lint.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/publish_release.yml:6
- Info: topLevel 'contents' permission set to 'read': .github/workflows/publish_website.yml:7
- Info: topLevel 'contents' permission set to 'read': .github/workflows/types_tests.yml:4
- Info: no jobLevel write permissions found
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish_release.yml:10
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
project is fuzzed
Details
- Info: OSSFuzz integration found
Reason
0 existing vulnerabilities detected
Reason
Found 13/14 approved changesets -- score normalized to 9
Reason
binaries present in source code
Details
- Warn: binary detected: external/openjpeg/openjpeg.wasm:1
- Warn: binary detected: external/qcms/qcms_bg.wasm:1
Reason
dependency not pinned by hash detected -- score normalized to 2
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/fluent_linter.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/fluent_linter.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/fluent_linter.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/fluent_linter.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/font_tests.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/font_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/font_tests.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/font_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/font_tests.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/font_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/lint.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/lint.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_release.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_release.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/types_tests.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/types_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/types_tests.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/types_tests.yml/master?enable=pin
- Warn: pipCommand not pinned by hash: .github/workflows/fluent_linter.yml:38
- Warn: pipCommand not pinned by hash: .github/workflows/font_tests.yml:59
- Info: 0 out of 21 GitHub-owned GitHubAction dependencies pinned
- Info: 6 out of 6 npmCommand dependencies pinned
- Info: 0 out of 2 pipCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v5.2.133 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/215029213
- Warn: release artifact v5.1.91 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/209207821
- Warn: release artifact v5.0.375 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/206035046
- Warn: release artifact v4.10.38 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/192847779
- Warn: release artifact v4.9.155 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/189278242
- Warn: release artifact v5.2.133 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/215029213
- Warn: release artifact v5.1.91 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/209207821
- Warn: release artifact v5.0.375 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/206035046
- Warn: release artifact v4.10.38 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/192847779
- Warn: release artifact v4.9.155 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/189278242
Score
8.1
/10
Last Scanned on 2025-05-26
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More