Gathering detailed insights and metrics for react-native-url-polyfill
Gathering detailed insights and metrics for react-native-url-polyfill
🔗A lightweight and trustworthy URL polyfill for React Native.
Installations
npm install react-native-url-polyfillDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Node Version
18.16.1
NPM Version
9.5.1
Score
61.4
Supply Chain
51.6
Quality
66
Maintenance
50
Vulnerability
94.1
License
Releases
7
Languages
12
Java
JavaScript
Ruby
Objective-C
Objective-C++
C++
Kotlin
TypeScript
Makefile
Starlark
Swift
Shell
Java (34.38%)
JavaScript (26.53%)
Ruby (10.71%)
Objective-C (7.44%)
Objective-C++ (6.99%)
C++ (6.56%)
Kotlin (2.35%)
TypeScript (1.54%)
Makefile (1.43%)
Starlark (1.13%)
Swift (0.89%)
Shell (0.05%)
Developer
charpeni
Download Statistics
Total Downloads
76,953,544
Last Day
35,070
Last Week
830,015
Last Month
3,627,160
Last Year
36,258,479
GitHub Statistics
MIT License
371 Stars
329 Commits
24 Forks
2 Watchers
3 Branches
7 Contributors
Updated on Jun 24, 2025
Bundle Size
43.53 kB
Minified
10.70 kB
Minified + Gzipped
Maintainers
1
Package Meta Information
Latest Version
2.0.0
Package Id
react-native-url-polyfill@2.0.0
Unpacked Size
26.86 kB
Size
8.60 kB
File Count
22
NPM Version
9.5.1
Node Version
18.16.1
Published on
Jul 13, 2023
Total Downloads
Cumulative downloads
Total Downloads
76,953,544
Last Day
11%
35,070
Compared to previous day
Last Week
-8%
830,015
Compared to previous week
Last Month
0.5%
3,627,160
Compared to previous month
Last Year
43.9%
36,258,479
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
React Native URL Polyfill
A lightweight and trustworthy URL polyfill for React Native
react-native-url-polyfill is an implementation of the WHATWG URL Standard optimized for React Native.
- Lightweight. Uses a forked version of
whatwg-url(whatwg-url-without-unicode) where unicode support has been stripped out — Going down from 372 KB to 40.9 KB. - Trustworthy. Follows closely the URL Standard spec, and relys on unit tests and Detox e2e tests within React Native.
- Blob support. Supports React Native's Blob without additional steps.
- Hermes support. Supports Hermes, a JavaScript engine optimized for running React Native.
- Expo support. Supports Expo and tested against.
- Web support. Most of the time, this polyfill isn't useful on web and therefore using
react-native-url-polyfill/autowill be no-op on web.
Why do we need this?
React Native does include a polyfill for URL, but this polyfill is homemade — in order to keep it light-weight — and was initially created to handle specific use cases.
Meanwhile, React Native has grown around that polyfill, then some unexpected errors have arisen.
Known issues (non-exhaustive) with React Native's URL are:
- URL cannot handle "localhost" domain for base url react-native#26019.
- URL implementation should add a trailing slash to the base react-native#25717.
- URL incorrectly adds trailing slash react-native#24428.
- Creating an instance of URL like:
new URL('http://facebook.com')throws an exception react-native#16434.
That's why you may need this external dependency. So, if you use URL within your app, you probably want to take a look at the installation steps below!
Unfortunately, adding react-native-url-polyfill to React Native source code would mean adding 📦 73.67 KB (as of RN 0.72) to the JavaScript bundle, that's why it's not included by default.
Installation
First, you need to install the polyfill, which can be done with Yarn or npm.
Yarn
1yarn add react-native-url-polyfill
npm
1npm install --save react-native-url-polyfill
Then, the polyfill can be used in multiple ways. Pick your preferred option.
ℹ️ To verify if the polyfill has been correctly applied, you can check if the global variable
REACT_NATIVE_URL_POLYFILLcontains the current package and version like:react-native-url-polyfill@CURRENT_VERSION.
Option 1 (Simple)
Locate your JavaScript entry-point file, commonly called index.js at the root of your React Native project.
Then, import react-native-url-polyfill/auto at the top of your entry-point file, the polyfill will be automatically applied.
1import 'react-native-url-polyfill/auto';
Option 2 (Flexible)
If you want to apply the polyfill when you're ready, you can import setupURLPolyfill and call it yourself.
⚠️ Metro doesn't support optional imports.
If you do not apply the polyfill, it will still be added to your JavaScript bundle. Even if it's wrapped in a condition, Metro won't strip it in production.
1import { setupURLPolyfill } from 'react-native-url-polyfill'; 2 3setupURLPolyfill();
Option 3 (Convenient / ponyfill)
If you prefer not to apply this polyfill over React Native's default URL, you can still import those classes manually when you want them.
1import { URL, URLSearchParams } from 'react-native-url-polyfill'; 2 3const url = new URL('https://github.com'); 4const searchParams = new URLSearchParams('q=GitHub');
License
react-native-url-polyfill is MIT licensed.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
binaries present in source code
Details
- Warn: binary detected: platforms/expo/48/android/gradle/wrapper/gradle-wrapper.jar:1
- Warn: binary detected: platforms/react-native/0.60/android/gradle/wrapper/gradle-wrapper.jar:1
- Warn: binary detected: platforms/react-native/0.68/android/gradle/wrapper/gradle-wrapper.jar:1
- Warn: binary detected: platforms/react-native/0.72/android/gradle/wrapper/gradle-wrapper.jar:1
- Warn: binary detected: platforms/react-native/0.78/android/gradle/wrapper/gradle-wrapper.jar:1
Reason
Found 3/30 approved changesets -- score normalized to 1
Reason
0 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 1
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/labeler.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/labeler.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/charpeni/react-native-url-polyfill/labeler.yml/main?enable=pin
- Info: 0 out of 1 GitHub-owned GitHubAction dependencies pinned
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 26 are checked with a SAST tool
Reason
107 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-whgm-jr23-g3j9
- Warn: Project is vulnerable to: GHSA-8hc4-vh64-cxmj
- Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-x9w5-v3q2-3rhw
- Warn: Project is vulnerable to: GHSA-w8qv-6jwh-64r5
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-434g-2637-qmqr
- Warn: Project is vulnerable to: GHSA-49q7-c7j4-3p7m
- Warn: Project is vulnerable to: GHSA-977x-g7h5-7qgw
- Warn: Project is vulnerable to: GHSA-f7q4-pwc6-w24p
- Warn: Project is vulnerable to: GHSA-fc9h-whq2-v747
- Warn: Project is vulnerable to: GHSA-vjh7-7g9h-fjfh
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-3q56-9cc2-46j4
- Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27
- Warn: Project is vulnerable to: GHSA-33f9-j839-rf8h
- Warn: Project is vulnerable to: GHSA-c36v-fmgq-m8hx
- Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-76p3-8jx3-jpfq
- Warn: Project is vulnerable to: GHSA-3rfm-jhwj-7488
- Warn: Project is vulnerable to: GHSA-hhq3-ff78-jv3g
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-5rrq-pxf6-6jx5
- Warn: Project is vulnerable to: GHSA-8fr3-hfg3-gpgp
- Warn: Project is vulnerable to: GHSA-gf8q-jrpm-jvxq
- Warn: Project is vulnerable to: GHSA-2r2c-g63r-vccr
- Warn: Project is vulnerable to: GHSA-cfm4-qjh2-4765
- Warn: Project is vulnerable to: GHSA-x4jg-mjrx-434g
- Warn: Project is vulnerable to: GHSA-rp65-9cf3-cjxr
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-h7cp-r72f-jxh6
- Warn: Project is vulnerable to: GHSA-v62p-rq8g-8h59
- Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
- Warn: Project is vulnerable to: GHSA-rxrc-rgv4-jpvx
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-g4rg-993r-mgx7
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx
- Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v
- Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6
- Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v
- Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-fwr7-v2mv-hh25
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-v8v8-6859-qxm4
- Warn: Project is vulnerable to: GHSA-4xcv-9jjx-gfj3
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-8hfj-j24r-96c4
- Warn: Project is vulnerable to: GHSA-wc69-rhjr-hc9g
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-w7rc-rwvf-8q5r
- Warn: Project is vulnerable to: GHSA-5fw9-fq32-wv5p
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-4cpg-3vgw-4877
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-7f53-fmmv-mfjv
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-gff7-g5r8-mg8m
- Warn: Project is vulnerable to: GHSA-jgrx-mgxx-jf9v
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-662x-fhqg-9p8v
- Warn: Project is vulnerable to: GHSA-394c-5j6w-4xmx
- Warn: Project is vulnerable to: GHSA-78cj-fxph-m83p
- Warn: Project is vulnerable to: GHSA-fhg7-m89q-25r3
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693
- Warn: Project is vulnerable to: GHSA-h6q6-9hqw-rwfv
- Warn: Project is vulnerable to: GHSA-5fg8-2547-mr8q
- Warn: Project is vulnerable to: GHSA-crh6-fp67-6883
- Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh
- Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp
- Warn: Project is vulnerable to: GHSA-cr5q-6q9f-rq6q
- Warn: Project is vulnerable to: GHSA-j6gc-792m-qgm2
- Warn: Project is vulnerable to: GHSA-pj73-v5mw-pm9j
- Warn: Project is vulnerable to: GHSA-2rxp-v6pw-ch6m
- Warn: Project is vulnerable to: GHSA-4xqq-m2hx-25v8
- Warn: Project is vulnerable to: GHSA-5866-49gr-22v4
- Warn: Project is vulnerable to: GHSA-r55c-59qm-vjw6
- Warn: Project is vulnerable to: GHSA-vg3r-rm7w-2xgh
- Warn: Project is vulnerable to: GHSA-vmwr-mc7x-5vc3
- Warn: Project is vulnerable to: GHSA-c2jc-4fpr-4vhg
- Warn: Project is vulnerable to: GHSA-m5qc-5hw7-8vg7
- Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
Score
2.4
/10
Last Scanned on 2025-06-30
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More