npmpackage.info

Gathering detailed insights and metrics for read-package-json

read-package-json

The thing npm uses to read package.json files with semantics and defaults and validation and stuff

7.0.1

223

ISC

JavaScript

44.11 kB

1,482,251,055 5.8

Installations

npm install read-package-json

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

^16.14.0 || >=18.0.0

Node Version

22.1.0

NPM Version

10.7.0 Score

96.2

Supply Chain

98.6

Quality

81.7

Maintenance

100

Vulnerability

99.6

License

Pull Requests

Open

0

Total

190

Closed

114

Merged

76

Issues

Open

0

Total

33

Closed

33

Releases

v7.0.1

Updated on May 04, 2024

v7.0.0

Updated on Aug 15, 2023

v6.0.4

Updated on Jun 01, 2023

v6.0.3

Updated on May 03, 2023

v6.0.2

Updated on Apr 27, 2023

v6.0.1

Updated on Mar 21, 2023

View All 10 releases

Languages

JavaScript

JavaScript (100%)

Developer

npm

Download Statistics

Total Downloads

1,482,251,055

Last Day

310,651

Last Week

5,826,080

Last Month

25,367,092

Last Year

310,582,608

GitHub Statistics

ISC License

223 Stars

311 Commits

80 Forks

26 Watchers

2 Branches

94 Contributors

Updated on Jun 02, 2025

Bundle Size

145.16 kB

Minified

44.11 kB

Minified + Gzipped

Bundlephobia

Maintainers

View All 94 Contributors

Package Meta Information

Latest Version

7.0.1

Package Id

read-package-json@7.0.1

Unpacked Size

20.12 kB

Size

7.03 kB

File Count

NPM Version

10.7.0

Node Version

22.1.0

Published on

May 04, 2024

Total Downloads

Cumulative downloads

Total Downloads

1,482,251,055

Dependencies

glob json-parse-even-better-errors normalize-package-data npm-normalize-package-bin

Dev Dependencies

@npmcli/eslint-config @npmcli/template-oss tap

read-package-json

This is the thing that npm uses to read package.json files. It validates some stuff, and loads some default things.

It keeps a cache of the files you've read, so that you don't end up reading the same package.json file multiple times.

Note that if you just want to see what's literally in the package.json file, you can usually do var data = require('some-module/package.json').

This module is basically only needed by npm, but it's handy to see what npm will see when it looks at your package.

Usage

1var readJson = require('read-package-json')
2
3// readJson(filename, [logFunction=noop], [strict=false], cb)
4readJson('/path/to/package.json', console.error, false, function (er, data) {
5  if (er) {
6    console.error("There was an error reading the file")
7    return
8  }
9
10  console.error('the package data is', data)
11});

readJson(file, [logFn = noop], [strict = false], cb)

file {String} The path to the package.json file
logFn {Function} Function to handle logging. Defaults to a noop.
strict {Boolean} True to enforce SemVer 2.0 version strings, and other strict requirements.
cb {Function} Gets called with (er, data), as is The Node Way.

Reads the JSON file and does the things.

`package.json` Fields

See man 5 package.json or npm help json.

readJson.log

By default this is a reference to the npmlog module. But if that module can't be found, then it'll be set to just a dummy thing that does nothing.

Replace with your own {log,warn,error} object for fun loggy time.

readJson.extras(file, data, cb)

Run all the extra stuff relative to the file, with the parsed data.

Modifies the data as it does stuff. Calls the cb when it's done.

readJson.extraSet = [fn, fn, ...]

Array of functions that are called by extras. Each one receives the arguments fn(file, data, cb) and is expected to call cb(er, data) when done or when an error occurs.

Order is indeterminate, so each function should be completely independent.

Mix and match!

Other Relevant Files Besides `package.json`

Some other files have an effect on the resulting data object, in the following ways:

`README?(.*)`

If there is a README or README.* file present, then npm will attach a readme field to the data with the contents of this file.

Owing to the fact that roughly 100% of existing node modules have Markdown README files, it will generally be assumed to be Markdown, regardless of the extension. Please plan accordingly.

`server.js`

If there is a server.js file, and there is not already a scripts.start field, then scripts.start will be set to node server.js.

`AUTHORS`

If there is not already a contributors field, then the contributors field will be set to the contents of the AUTHORS file, split by lines, and parsed.

`bindings.gyp`

If a bindings.gyp file exists, and there is not already a scripts.install field, then the scripts.install field will be set to node-gyp rebuild.

`index.js`

If the json file does not exist, but there is a index.js file present instead, and that file has a package comment, then it will try to parse the package comment, and use that as the data instead.

A package comment looks like this:

1/**package
2 * { "name": "my-bare-module"
3 * , "version": "1.2.3"
4 * , "description": "etc...." }
5 **/
6
7// or...
8
9/**package
10{ "name": "my-bare-module"
11, "version": "1.2.3"
12, "description": "etc...." }
13**/

The important thing is that it starts with /**package, and ends with **/. If the package.json file exists, then the index.js is not parsed.

`{directories.man}/*.[0-9]`

If there is not already a man field defined as an array of files or a single file, and there is a directories.man field defined, then that directory will be searched for manpages.

Any valid manpages found in that directory will be assigned to the man array, and installed in the appropriate man directory at package install time, when installed globally on a Unix system.

`{directories.bin}/*`

If there is not already a bin field defined as a string filename or a hash of <name> : <filename> pairs, then the directories.bin directory will be searched and all the files within it will be linked as executables at install time.

When installing locally, npm links bins into node_modules/.bin, which is in the PATH environ when npm runs scripts. When installing globally, they are linked into {prefix}/bin, which is presumably in the PATH environment variable.

`types` field

If you do not have a types field, then it will check if a corresponding *.d.ts file exists for your package entry file and add it to the package.json.

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Security-Policy

Determines if the project has published a security policy.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

10

License

Determines if the project has defined a license.

8

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

7

SAST

Determines if the project uses static code analysis.

0

Maintained

Determines if the project is "actively maintained".

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/audit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/audit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-release.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:115: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-release.yml:147: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:98: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/post-dependabot.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/post-dependabot.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/post-dependabot.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/pull-request.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/pull-request.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-integration.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release-integration.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-integration.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release-integration.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:274: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:283: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:303: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:119: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:136: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:199: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:236: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/read-package-json/release.yml/main?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/audit.yml:38
Warn: npmCommand not pinned by hash: .github/workflows/ci-release.yml:58
Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:42
Warn: npmCommand not pinned by hash: .github/workflows/post-dependabot.yml:39
Warn: npmCommand not pinned by hash: .github/workflows/pull-request.yml:42
Warn: npmCommand not pinned by hash: .github/workflows/release-integration.yml:52
Warn: npmCommand not pinned by hash: .github/workflows/release.yml:50
Warn: npmCommand not pinned by hash: .github/workflows/release.yml:130
Info: 0 out of 26 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 12 third-party GitHubAction dependencies pinned
Info: 0 out of 8 npmCommand dependencies pinned

0

Fuzzing

Determines if the project uses fuzzing.

Score

5.8

/10

Last Scanned on 2025-06-23

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to read-package-json

Other packages similar to read-package-json

read-package-json

Installations

Developer Guide

No

CommonJS

^16.14.0 || >=18.0.0

22.1.0

10.7.0

Score

Pull Requests

0

190

114

76

Issues

0

33

33

Releases

Languages

Developer

npm

Download Statistics

GitHub Statistics

Bundle Size

145.16 kB

44.11 kB

Maintainers

Package Meta Information

Total Downloads

1,482,251,055

Dependencies

Dev Dependencies

read-package-json

Usage

readJson(file, [logFn = noop], [strict = false], cb)

package.json Fields

readJson.log

readJson.extras(file, data, cb)

readJson.extraSet = [fn, fn, ...]

Other Relevant Files Besides package.json

README?(.*)

server.js

AUTHORS

bindings.gyp

index.js

{directories.man}/*.[0-9]

{directories.bin}/*

types field

10

10

10

10

10

8

7

0

0

0

0

0

5.8

/10

Weekly Downloads

Monthly Downloads

Yearly Downloads

`package.json` Fields

Other Relevant Files Besides `package.json`

`README?(.*)`

`server.js`

`AUTHORS`

`bindings.gyp`

`index.js`

`{directories.man}/*.[0-9]`

`{directories.bin}/*`

`types` field