Gathering detailed insights and metrics for shelljs
🐚 Portable Unix shell commands for Node.js
Installations
npm install shelljsDeveloper Guide
BETA
Typescript
No
Module System
CommonJS, ESM
Min. Node Version
>=18
Node Version
18.19.1
NPM Version
9.2.0
Score
93
Supply Chain
99.2
Quality
90.3
Maintenance
100
Vulnerability
99.6
License
Releases
19
Contributors
88
Unable to fetch Contributors
Languages
2
JavaScript
CoffeeScript
JavaScript (99.99%)
CoffeeScript (0.01%)
validate.email 🚀
Verify real, reachable, and deliverable emails with instant MX records, SMTP checks, and disposable email detection.
Developer
Download Statistics
Total Downloads
2,559,496,859
Last Day
1,447,457
Last Week
8,076,683
Last Month
33,392,957
Last Year
396,973,834
GitHub Statistics
BSD-3-Clause License
14,316 Stars
862 Commits
735 Forks
173 Watchers
9 Branches
88 Contributors
Updated on Mar 18, 2025
Bundle Size
143.72 kB
Minified
44.33 kB
Minified + Gzipped
Maintainers
3
Package Meta Information
Latest Version
0.9.2
Package Id
shelljs@0.9.2
Unpacked Size
144.88 kB
Size
43.99 kB
File Count
42
NPM Version
9.2.0
Node Version
18.19.1
Published on
Mar 17, 2025
Total Downloads
Cumulative downloads
Total Downloads
2,559,496,859
Last Day
1%
1,447,457
Compared to previous day
Last Week
2%
8,076,683
Compared to previous week
Last Month
5.5%
33,392,957
Compared to previous month
Last Year
-2.2%
396,973,834
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
ShellJS - Unix shell commands for Node.js
ShellJS is a portable (Windows/Linux/macOS) implementation of Unix shell commands on top of the Node.js API. You can use it to eliminate your shell script's dependency on Unix while still keeping its familiar and powerful commands. You can also install it globally so you can run it from outside Node projects - say goodbye to those gnarly Bash scripts!
ShellJS is proudly tested on every LTS node release since v18!
The project is unit-tested and battle-tested in projects like:
- Firebug - Firefox's infamous debugger
- JSHint & ESLint - popular JavaScript linters
- Zepto - jQuery-compatible JavaScript library for modern browsers
- Yeoman - Web application stack and development tool
- Deployd.com - Open source PaaS for quick API backend generation
- And many more.
If you have feedback, suggestions, or need help, feel free to post in our issue tracker.
Think ShellJS is cool? Check out some related projects in our Wiki page!
Upgrading from an older version? Check out our breaking changes page to see what changes to watch out for while upgrading.
Command line use
If you just want cross platform UNIX commands, checkout our new project
shelljs/shx, a utility to expose shelljs to
the command line.
For example:
$ shx mkdir -p foo
$ shx touch foo/bar.txt
$ shx rm -rf foo
Plugin API
ShellJS now supports third-party plugins! You can learn more about using plugins and writing your own ShellJS commands in the wiki.
A quick note about the docs
For documentation on all the latest features, check out our README. To read docs that are consistent with the latest release, check out the npm page.
Installing
Via npm:
1$ npm install [-g] shelljs
Examples
1var shell = require('shelljs'); 2 3if (!shell.which('git')) { 4 shell.echo('Sorry, this script requires git'); 5 shell.exit(1); 6} 7 8// Copy files to release dir 9shell.rm('-rf', 'out/Release'); 10shell.cp('-R', 'stuff/', 'out/Release'); 11 12// Replace macros in each .js file 13shell.cd('lib'); 14shell.ls('*.js').forEach(function (file) { 15 shell.sed('-i', 'BUILD_VERSION', 'v0.1.2', file); 16 shell.sed('-i', /^.*REMOVE_THIS_LINE.*$/, '', file); 17 shell.sed('-i', /.*REPLACE_LINE_WITH_MACRO.*\n/, shell.cat('macro.js'), file); 18}); 19shell.cd('..'); 20 21// Run external tool synchronously 22if (shell.exec('git commit -am "Auto-commit"').code !== 0) { 23 shell.echo('Error: Git commit failed'); 24 shell.exit(1); 25}
Exclude options
If you need to pass a parameter that looks like an option, you can do so like:
1shell.grep('--', '-v', 'path/to/file'); // Search for "-v", no grep options 2 3shell.cp('-R', '-dir', 'outdir'); // If already using an option, you're done
Global vs. Local
We no longer recommend using a global-import for ShellJS (i.e.
require('shelljs/global')). While still supported for convenience, this
pollutes the global namespace, and should therefore only be used with caution.
Instead, we recommend a local import (standard for npm packages):
1var shell = require('shelljs'); 2shell.echo('hello world');
Alternatively, we also support importing as a module with:
1import shell from 'shelljs'; 2shell.echo('hello world');
Command reference
All commands run synchronously, unless otherwise stated.
All commands accept standard bash globbing characters (*, ?, etc.),
compatible with fast-glob.
For less-commonly used commands and features, please check out our wiki page.
cat([options,] file [, file ...])
cat([options,] file_array)
Available options:
-n: number all output lines
Examples:
1var str = cat('file*.txt'); 2var str = cat('file1', 'file2'); 3var str = cat(['file1', 'file2']); // same as above
Returns a ShellString containing the given file, or a concatenated string containing the files if more than one file is given (a new line character is introduced between each file).
cd([dir])
Changes to directory dir for the duration of the script. Changes to home
directory if no argument is supplied. Returns a
ShellString to indicate success or failure.
chmod([options,] octal_mode || octal_string, file)
chmod([options,] symbolic_mode, file)
Available options:
-v: output a diagnostic for every file processed-c: like verbose, but report only when a change is made-R: change files and directories recursively
Examples:
1chmod(755, '/Users/brandon'); 2chmod('755', '/Users/brandon'); // same as above 3chmod('u+x', '/Users/brandon'); 4chmod('-R', 'a-w', '/Users/brandon');
Alters the permissions of a file or directory by either specifying the absolute permissions in octal form or expressing the changes in symbols. This command tries to mimic the POSIX behavior as much as possible. Notable exceptions:
- In symbolic modes,
a-rand-rare identical. No consideration is given to theumask. - There is no "quiet" option, since default behavior is to run silent.
- Windows OS uses a very different permission model than POSIX.
chmod()does its best on Windows, but there are limits to how file permissions can be set. Note that WSL (Windows subsystem for Linux) does follow POSIX, so cross-platform compatibility should not be a concern there.
Returns a ShellString indicating success or failure.
cmd(arg1[, arg2, ...] [, options])
Available options:
cwd: directoryPath: change the current working directory only for this cmd() invocation.maxBuffer: num: Raise or decrease the default buffer size for stdout/stderr.timeout: Change the default timeout.
Examples:
1var version = cmd('node', '--version').stdout; 2cmd('git', 'commit', '-am', `Add suport for node ${version}`); 3console.log(cmd('echo', '1st arg', '2nd arg', '3rd arg').stdout) 4console.log(cmd('echo', 'this handles ;, |, &, etc. as literal characters').stdout)
Executes the given command synchronously. This is intended as an easier
alternative for exec(), with better
security around globbing, comamnd injection, and variable expansion. This is
guaranteed to only run one external command, and won't give special
treatment for any shell characters (ex. this treats | as a literal
character, not as a shell pipeline).
This returns a ShellString.
By default, this performs globbing on all platforms, but you can disable
this with set('-f').
This does not support asynchronous mode. If you need asynchronous
command execution, check out execa or
the node builtin child_process.execFile() instead.
cp([options,] source [, source ...], dest)
cp([options,] source_array, dest)
Available options:
-f: force (default behavior)-n: no-clobber-u: only copy ifsourceis newer thandest-r,-R: recursive-L: follow symlinks-P: don't follow symlinks-p: preserve file mode, ownership, and timestamps
Examples:
1cp('file1', 'dir1'); 2cp('-R', 'path/to/dir/', '~/newCopy/'); 3cp('-Rf', '/tmp/*', '/usr/local/*', '/home/tmp'); 4cp('-Rf', ['/tmp/*', '/usr/local/*'], '/home/tmp'); // same as above
Copies files. Returns a ShellString indicating success or failure.
pushd([options,] [dir | '-N' | '+N'])
Available options:
-n: Suppresses the normal change of directory when adding directories to the stack, so that only the stack is manipulated.-q: Suppresses output to the console.
Arguments:
dir: Sets the current working directory to the top of the stack, then executes the equivalent ofcd dir.+N: Brings the Nth directory (counting from the left of the list printed by dirs, starting with zero) to the top of the list by rotating the stack.-N: Brings the Nth directory (counting from the right of the list printed by dirs, starting with zero) to the top of the list by rotating the stack.
Examples:
1// process.cwd() === '/usr' 2pushd('/etc'); // Returns /etc /usr 3pushd('+1'); // Returns /usr /etc
Save the current directory on the top of the directory stack and then cd to dir. With no arguments, pushd exchanges the top two directories. Returns an array of paths in the stack.
popd([options,] ['-N' | '+N'])
Available options:
-n: Suppress the normal directory change when removing directories from the stack, so that only the stack is manipulated.-q: Suppresses output to the console.
Arguments:
+N: Removes the Nth directory (counting from the left of the list printed by dirs), starting with zero.-N: Removes the Nth directory (counting from the right of the list printed by dirs), starting with zero.
Examples:
1echo(process.cwd()); // '/usr' 2pushd('/etc'); // '/etc /usr' 3echo(process.cwd()); // '/etc' 4popd(); // '/usr' 5echo(process.cwd()); // '/usr'
When no arguments are given, popd removes the top directory from the stack and performs a cd to the new top directory. The elements are numbered from 0, starting at the first directory listed with dirs (i.e., popd is equivalent to popd +0). Returns an array of paths in the stack.
dirs([options | '+N' | '-N'])
Available options:
-c: Clears the directory stack by deleting all of the elements.-q: Suppresses output to the console.
Arguments:
+N: Displays the Nth directory (counting from the left of the list printed by dirs when invoked without options), starting with zero.-N: Displays the Nth directory (counting from the right of the list printed by dirs when invoked without options), starting with zero.
Display the list of currently remembered directories. Returns an array of paths in the stack, or a single path if +N or -N was specified.
See also: pushd, popd
echo([options,] string [, string ...])
Available options:
-e: interpret backslash escapes (default)-n: remove trailing newline from output
Examples:
1echo('hello world'); 2var str = echo('hello world'); 3echo('-n', 'no newline at end');
Prints string to stdout, and returns a ShellString.
exec(command [, options] [, callback])
Available options:
async: Asynchronous execution. If a callback is provided, it will be set totrue, regardless of the passed value (default:false).fatal: Exit upon error (default:false).silent: Do not echo program output to console (default:false).encoding: Character encoding to use. Affects the values returned to stdout and stderr, and what is written to stdout and stderr when not in silent mode (default:'utf8').- and any option available to Node.js's
child_process.exec()
Examples:
1var version = exec('node --version', {silent:true}).stdout; 2 3var child = exec('some_long_running_process', {async:true}); 4child.stdout.on('data', function(data) { 5 /* ... do something with data ... */ 6}); 7 8exec('some_long_running_process', function(code, stdout, stderr) { 9 console.log('Exit code:', code); 10 console.log('Program output:', stdout); 11 console.log('Program stderr:', stderr); 12});
Executes the given command synchronously, unless otherwise specified.
When in synchronous mode, this returns a ShellString.
Otherwise, this returns the child process object, and the callback
receives the arguments (code, stdout, stderr).
Not seeing the behavior you want? exec() runs everything through sh
by default (or cmd.exe on Windows), which differs from bash. If you
need bash-specific behavior, try out the {shell: 'path/to/bash'} option.
Security note: as shell.exec() executes an arbitrary string in the
system shell, it is critical to properly sanitize user input to avoid
command injection. For more context, consult the Security
Guidelines.
find(path [, path ...])
find(path_array)
Examples:
1find('src', 'lib'); 2find(['src', 'lib']); // same as above 3find('.').filter(function(file) { return file.match(/\.js$/); });
Returns a ShellString (with array-like properties) of all files (however deep) in the given paths.
The main difference from ls('-R', path) is that the resulting file names
include the base directories (e.g., lib/resources/file1 instead of just file1).
grep([options,] regex_filter, file [, file ...])
grep([options,] regex_filter, file_array)
Available options:
-v: Invertregex_filter(only print non-matching lines).-l: Print only filenames of matching files.-i: Ignore case.-n: Print line numbers.
Examples:
1grep('-v', 'GLOBAL_VARIABLE', '*.js'); 2grep('GLOBAL_VARIABLE', '*.js');
Reads input string from given files and returns a
ShellString containing all lines of the @ file that match
the given regex_filter.
head([{'-n': <num>},] file [, file ...])
head([{'-n': <num>},] file_array)
Available options:
-n <num>: Show the first<num>lines of the files
Examples:
1var str = head({'-n': 1}, 'file*.txt'); 2var str = head('file1', 'file2'); 3var str = head(['file1', 'file2']); // same as above
Read the start of a file. Returns a ShellString.
ln([options,] source, dest)
Available options:
-s: symlink-f: force
Examples:
1ln('file', 'newlink'); 2ln('-sf', 'file', 'existing');
Links source to dest. Use -f to force the link, should dest already
exist. Returns a ShellString indicating success or
failure.
ls([options,] [path, ...])
ls([options,] path_array)
Available options:
-R: recursive-A: all files (include files beginning with., except for.and..)-L: follow symlinks-d: list directories themselves, not their contents-l: provides more details for each file. Specifically, each file is represented by a structured object with separate fields for file metadata (seefs.Stats). The return value also overrides.toString()to resemblels -l's output format for human readability, but programmatic usage should depend on the stable object format rather than the.toString()representation.
Examples:
1ls('projs/*.js'); 2ls('projs/**/*.js'); // Find all js files recursively in projs 3ls('-R', '/users/me', '/tmp'); 4ls('-R', ['/users/me', '/tmp']); // same as above 5ls('-l', 'file.txt'); // { name: 'file.txt', mode: 33188, nlink: 1, ...}
Returns a ShellString (with array-like properties) of all
the files in the given path, or files in the current directory if no
path is provided.
mkdir([options,] dir [, dir ...])
mkdir([options,] dir_array)
Available options:
-p: full path (and create intermediate directories, if necessary)
Examples:
1mkdir('-p', '/tmp/a/b/c/d', '/tmp/e/f/g'); 2mkdir('-p', ['/tmp/a/b/c/d', '/tmp/e/f/g']); // same as above
Creates directories. Returns a ShellString indicating success or failure.
mv([options ,] source [, source ...], dest')
mv([options ,] source_array, dest')
Available options:
-f: force (default behavior)-n: no-clobber
Examples:
1mv('-n', 'file', 'dir/'); 2mv('file1', 'file2', 'dir/'); 3mv(['file1', 'file2'], 'dir/'); // same as above
Moves source file(s) to dest. Returns a ShellString
indicating success or failure.
pwd()
Returns the current directory as a ShellString.
rm([options,] file [, file ...])
rm([options,] file_array)
Available options:
-f: force-r, -R: recursive
Examples:
1rm('-rf', '/tmp/*'); 2rm('some_file.txt', 'another_file.txt'); 3rm(['some_file.txt', 'another_file.txt']); // same as above
Removes files. Returns a ShellString indicating success or failure.
sed([options,] search_regex, replacement, file [, file ...])
sed([options,] search_regex, replacement, file_array)
Available options:
-i: Replace contents offilein-place. Note that no backups will be created!
Examples:
1sed('-i', 'PROGRAM_VERSION', 'v0.1.3', 'source.js');
Reads an input string from files, line by line, and performs a JavaScript replace() on
each of the lines from the input string using the given search_regex and replacement string or
function. Returns the new ShellString after replacement.
Note:
Like unix sed, ShellJS sed supports capture groups. Capture groups are specified
using the $n syntax:
1sed(/(\w+)\s(\w+)/, '$2, $1', 'file.txt');
Also, like unix sed, ShellJS sed runs replacements on each line from the input file
(split by '\n') separately, so search_regexes that span more than one line (or include '\n')
will not match anything and nothing will be replaced.
set(options)
Available options:
+/-e: exit upon error (config.fatal)+/-v: verbose: show all commands (config.verbose)+/-f: disable filename expansion (globbing)
Examples:
1set('-e'); // exit upon first error 2set('+e'); // this undoes a "set('-e')"
Sets global configuration variables.
sort([options,] file [, file ...])
sort([options,] file_array)
Available options:
-r: Reverse the results-n: Compare according to numerical value
Examples:
1sort('foo.txt', 'bar.txt'); 2sort('-r', 'foo.txt');
Return the contents of the files, sorted line-by-line as a
ShellString. Sorting multiple files mixes their content
(just as unix sort does).
tail([{'-n': <num>},] file [, file ...])
tail([{'-n': <num>},] file_array)
Available options:
-n <num>: Show the last<num>lines offiles
Examples:
1var str = tail({'-n': 1}, 'file*.txt'); 2var str = tail('file1', 'file2'); 3var str = tail(['file1', 'file2']); // same as above
Read the end of a file. Returns a ShellString.
tempdir()
Examples:
1var tmp = tempdir(); // "/tmp" for most *nix platforms
Searches and returns string containing a writeable, platform-dependent temporary directory. Follows Python's tempfile algorithm.
test(expression)
Available expression primaries:
'-b', 'path': true if path is a block device'-c', 'path': true if path is a character device'-d', 'path': true if path is a directory'-e', 'path': true if path exists'-f', 'path': true if path is a regular file'-L', 'path': true if path is a symbolic link'-p', 'path': true if path is a pipe (FIFO)'-S', 'path': true if path is a socket
Examples:
1if (test('-d', path)) { /* do something with dir */ }; 2if (!test('-f', path)) continue; // skip if it's not a regular file
Evaluates expression using the available primaries and returns
corresponding boolean value.
ShellString.prototype.to(file)
Examples:
1cat('input.txt').to('output.txt');
Analogous to the redirection operator > in Unix, but works with
ShellStrings (such as those returned by cat, grep, etc.). Like Unix
redirections, to() will overwrite any existing file! Returns the same
ShellString this operated on, to support chaining.
ShellString.prototype.toEnd(file)
Examples:
1cat('input.txt').toEnd('output.txt');
Analogous to the redirect-and-append operator >> in Unix, but works with
ShellStrings (such as those returned by cat, grep, etc.). Returns the
same ShellString this operated on, to support chaining.
touch([options,] file [, file ...])
touch([options,] file_array)
Available options:
-a: Change only the access time-c: Do not create any files-m: Change only the modification time{'-d': someDate},{date: someDate}: Use aDateinstance (ex.someDate) instead of current time{'-r': file},{reference: file}: Usefile's times instead of current time
Examples:
1touch('source.js'); 2touch('-c', 'path/to/file.js'); 3touch({ '-r': 'referenceFile.txt' }, 'path/to/file.js'); 4touch({ '-d': new Date('December 17, 1995 03:24:00'), '-m': true }, 'path/to/file.js'); 5touch({ date: new Date('December 17, 1995 03:24:00') }, 'path/to/file.js');
Update the access and modification times of each file to the current time.
A file argument that does not exist is created empty, unless -c is supplied.
This is a partial implementation of
touch(1). Returns a
ShellString indicating success or failure.
uniq([options,] [input, [output]])
Available options:
-i: Ignore case while comparing-c: Prefix lines by the number of occurrences-d: Only print duplicate lines, one for each group of identical lines
Examples:
1uniq('foo.txt'); 2uniq('-i', 'foo.txt'); 3uniq('-cd', 'foo.txt', 'bar.txt');
Filter adjacent matching lines from input. Returns a
ShellString.
which(command)
Examples:
1var nodeExec = which('node');
Searches for command in the system's PATH. On Windows, this uses the
PATHEXT variable to append the extension if it's not already executable.
Returns a ShellString containing the absolute path to
command.
exit(code)
Exits the current process with the given exit code.
error()
Tests if error occurred in the last command. Returns a truthy value if an error returned, or a falsy value otherwise.
Note: do not rely on the
return value to be an error message. If you need the last error message, use
the .stderr attribute from the last command's return value instead.
errorCode()
Returns the error code from the last command.
ShellString(str)
Examples:
1var foo = new ShellString('hello world');
This is a dedicated type returned by most ShellJS methods, which wraps a
string (or array) value. This has all the string (or array) methods, but
also exposes extra methods: .to(),
.toEnd(), and all the pipe-able methods
(ex. .cat(), .grep(), etc.). This can be easily converted into a string
by calling .toString().
This type also exposes the corresponding command's stdout, stderr, and
return status code via the .stdout (string), .stderr (string), and
.code (number) properties respectively.
env['VAR_NAME']
Object containing environment variables (both getter and setter). Shortcut
to process.env.
Pipes
Examples:
1grep('foo', 'file1.txt', 'file2.txt').sed(/o/g, 'a').to('output.txt'); 2echo("files with o's in the name:\n" + ls().grep('o')); 3cat('test.js').exec('node'); // pipe to exec() call
Commands can send their output to another command in a pipe-like fashion.
sed, grep, cat, exec, to, and toEnd can appear on the right-hand
side of a pipe. Pipes can be chained.
Configuration
config.silent
Example:
1var sh = require('shelljs'); 2var silentState = sh.config.silent; // save old silent state 3sh.config.silent = true; 4/* ... */ 5sh.config.silent = silentState; // restore old silent state
Suppresses all command output if true, except for echo() calls.
Default is false.
config.fatal
Example:
1require('shelljs/global'); 2config.fatal = true; // or set('-e'); 3cp('this_file_does_not_exist', '/dev/null'); // throws Error here 4/* more commands... */
If true, the script will throw a Javascript error when any shell.js
command encounters an error. Default is false. This is analogous to
Bash's set -e.
config.verbose
Example:
1config.verbose = true; // or set('-v'); 2cd('dir/'); 3rm('-rf', 'foo.txt', 'bar.txt'); 4exec('echo hello');
Will print each command as follows:
cd dir/
rm -rf foo.txt bar.txt
exec echo hello
config.globOptions (deprecated)
Deprecated: we recommend that you do not edit config.globOptions.
Support for this configuration option may be changed or removed in a future
ShellJS release.
Breaking change: ShellJS v0.8.x uses node-glob. Starting with ShellJS
v0.9.x, config.globOptions is compatible with fast-glob.
Example:
1config.globOptions = {nodir: true};
config.globOptions changes how ShellJS expands glob (wildcard)
expressions. See
fast-glob
for available options. Be aware that modifying config.globOptions may
break ShellJS functionality.
config.reset()
Example:
1var shell = require('shelljs'); 2// Make changes to shell.config, and do stuff... 3/* ... */ 4shell.config.reset(); // reset to original state 5// Do more stuff, but with original settings 6/* ... */
Reset shell.config to the defaults:
1{ 2 fatal: false, 3 globOptions: {}, 4 maxdepth: 255, 5 noglob: false, 6 silent: false, 7 verbose: false, 8}
Team
 |
|---|
| Nate Fischer |
Stable Version
Stable Version
0.9.2
High
1
High
7.1/10
Summary
Improper Privilege Management in shelljs
Affected Versions
< 0.8.5
Patched Versions
0.8.5
Moderate
1
Moderate
0/10
Summary
Improper Privilege Management in shelljs
Affected Versions
< 0.8.5
Patched Versions
0.8.5
Reason
23 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: .github/SECURITY.md:1
- Info: Found linked content: .github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: .github/SECURITY.md:1
- Info: Found text in security policy: .github/SECURITY.md:1
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: BSD 3-Clause "New" or "Revised" License: LICENSE:0
Reason
5 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v
- Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp
Reason
Found 6/30 approved changesets -- score normalized to 2
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/main.yml:1
- Info: no jobLevel write permissions found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/shelljs/shelljs/main.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/shelljs/shelljs/main.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/shelljs/shelljs/main.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/main.yml:26
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 27 are checked with a SAST tool
Score
5.2
/10
Last Scanned on 2025-03-10
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More