Gathering detailed insights and metrics for pdfjs-dist
Gathering detailed insights and metrics for pdfjs-dist
Installations
npm install pdfjs-distDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS, UMD
Min. Node Version
>=20.16.0 || >=22.3.0
Node Version
22.16.0
NPM Version
10.9.2
Score
98.1
Supply Chain
76.8
Quality
92.4
Maintenance
100
Vulnerability
87.3
License
Releases
75
Languages
5
JavaScript
Fluent
CSS
HTML
TypeScript
JavaScript (70.52%)
Fluent (26.59%)
CSS (1.96%)
HTML (0.9%)
TypeScript (0.02%)
Developer
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
Apache-2.0 License
51,247 Stars
20,993 Commits
10,374 Forks
1,122 Watchers
1 Branches
401 Contributors
Updated on Jul 13, 2025
Maintainers
3
Package Meta Information
Latest Version
5.3.93
Package Id
pdfjs-dist@5.3.93
Unpacked Size
33.69 MB
Size
9.03 MB
File Count
375
NPM Version
10.9.2
Node Version
22.16.0
Published on
Jul 06, 2025
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Optional Dependencies
1
PDF.js
PDF.js is a Portable Document Format (PDF) library that is built with HTML5. Our goal is to create a general-purpose, web standards-based platform for parsing and rendering PDFs.
This is a pre-built version of the PDF.js source code. It is automatically generated by the build scripts.
For usage with older browsers/environments, without native support for the
latest JavaScript features, please see the legacy/ folder.
Please see this wiki page for information about supported browsers/environments.
See https://github.com/mozilla/pdf.js for learning and contributing.
High
8.8/10
Summary
Malicious PDF can inject JavaScript into PDF Viewer
Affected Versions
< 1.10.100
Patched Versions
1.10.100
High
8.8/10
Summary
Malicious PDF can inject JavaScript into PDF Viewer
Affected Versions
>= 2.0.0, < 2.0.550
Patched Versions
2.0.550
High
8.8/10
Summary
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
Affected Versions
<= 4.1.392
Patched Versions
4.2.67
Reason
security policy file detected
Details
- Info: security policy file detected: .github/SECURITY.md:1
- Info: Found linked content: .github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: .github/SECURITY.md:1
- Info: Found text in security policy: .github/SECURITY.md:1
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
GitHub workflow tokens follow principle of least privilege
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/fluent_linter.yml:19
- Info: topLevel 'contents' permission set to 'read': .github/workflows/font_tests.yml:23
- Info: topLevel 'contents' permission set to 'read': .github/workflows/lint.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/publish_release.yml:6
- Info: topLevel 'contents' permission set to 'read': .github/workflows/publish_website.yml:7
- Info: topLevel 'contents' permission set to 'read': .github/workflows/types_tests.yml:4
- Info: no jobLevel write permissions found
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish_release.yml:10
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
project is fuzzed
Details
- Info: OSSFuzz integration found
Reason
0 existing vulnerabilities detected
Reason
Found 14/16 approved changesets -- score normalized to 8
Reason
binaries present in source code
Details
- Warn: binary detected: external/openjpeg/openjpeg.wasm:1
- Warn: binary detected: external/qcms/qcms_bg.wasm:1
Reason
dependency not pinned by hash detected -- score normalized to 2
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/fluent_linter.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/fluent_linter.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/fluent_linter.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/fluent_linter.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/font_tests.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/font_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/font_tests.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/font_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/font_tests.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/font_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/lint.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/lint.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_release.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_release.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_website.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/publish_website.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/types_tests.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/types_tests.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/types_tests.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/mozilla/pdf.js/types_tests.yml/master?enable=pin
- Warn: pipCommand not pinned by hash: .github/workflows/fluent_linter.yml:38
- Warn: pipCommand not pinned by hash: .github/workflows/font_tests.yml:59
- Info: 0 out of 21 GitHub-owned GitHubAction dependencies pinned
- Info: 6 out of 6 npmCommand dependencies pinned
- Info: 0 out of 2 pipCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v5.3.93 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/230303542
- Warn: release artifact v5.3.31 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/222291863
- Warn: release artifact v5.2.133 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/215029213
- Warn: release artifact v5.1.91 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/209207821
- Warn: release artifact v5.0.375 not signed: https://api.github.com/repos/mozilla/pdf.js/releases/206035046
- Warn: release artifact v5.3.93 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/230303542
- Warn: release artifact v5.3.31 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/222291863
- Warn: release artifact v5.2.133 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/215029213
- Warn: release artifact v5.1.91 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/209207821
- Warn: release artifact v5.0.375 does not have provenance: https://api.github.com/repos/mozilla/pdf.js/releases/206035046
Score
8
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More