Gathering detailed insights and metrics for undici-types
Gathering detailed insights and metrics for undici-types
An HTTP/1.1 client, written from scratch for Node.js
Installations
npm install undici-typesDeveloper Guide
BETA
Typescript
Yes
Module System
N/A
Node Version
20.18.1
NPM Version
11.0.0
Score
100
Supply Chain
71.9
Quality
95
Maintenance
100
Vulnerability
100
License
Releases
187
Contributors
303
Languages
3
JavaScript
TypeScript
Shell
JavaScript (96.74%)
TypeScript (3.26%)
Shell (0.01%)
Developer
Download Statistics
Total Downloads
2,315,638,739
Last Day
10,448,087
Last Week
48,647,184
Last Month
212,674,086
Last Year
2,010,908,262
GitHub Statistics
6,552 Stars
3,299 Commits
584 Forks
54 Watching
69 Branches
303 Contributors
Maintainers
2
Package Meta Information
Latest Version
7.3.0
Package Id
undici-types@7.3.0
Unpacked Size
90.79 kB
Size
22.70 kB
File Count
41
NPM Version
11.0.0
Node Version
20.18.1
Publised On
22 Jan 2025
Total Downloads
Cumulative downloads
Total Downloads
2,315,638,739
Last day
-2.5%
10,448,087
Compared to previous day
Last week
-13%
48,647,184
Compared to previous week
Last month
5.8%
212,674,086
Compared to previous month
Last year
559.9%
2,010,908,262
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
No dependencies detected.
Versions
undici-types
This package is a dual-publish of the undici library types. The undici package still contains types. This package is for users who only need undici types (such as for @types/node). It is published alongside every release of undici, so you can always use the same version.
No vulnerabilities found.
Reason
27 out of 27 merged PRs checked by a CI test -- score normalized to 10
Reason
project has 76 contributing companies or organizations
Details
- Info: platformatic contributor org/company found, harperdb contributor org/company found, ossf contributor org/company found, LyraSearch contributor org/company found, ada-url contributor org/company found, upringjs contributor org/company found, openid contributor org/company found, relevantfruit contributor org/company found, serolife contributor org/company found, GonzagaAccess contributor org/company found, oauthstuff contributor org/company found, oauth-wg contributor org/company found, wasm-signatures contributor org/company found, tu wien contributor org/company found, adonisjs contributor org/company found, web-platform-tests contributor org/company found, trendyol contributor org/company found, nodesource contributor org/company found, simdutf contributor org/company found, cheminfo-js contributor org/company found, ES-Community contributor org/company found, CasparCG contributor org/company found, nxtedition contributor org/company found, cloudflare-whatwg contributor org/company found, cowtech contributor org/company found, EpicGames contributor org/company found, sagemath contributor org/company found, image-js contributor org/company found, mochajs contributor org/company found, TrainingPlay contributor org/company found, fvgdev contributor org/company found, w3c contributor org/company found, mbi health contributor org/company found, danger contributor org/company found, zakodium-oss contributor org/company found, jshttp contributor org/company found, mqttjs contributor org/company found, piscinajs contributor org/company found, zakodium contributor org/company found, expressjs contributor org/company found, puella care contributor org/company found, passionfruit-earth contributor org/company found, nodejs-private contributor org/company found, pillarjs contributor org/company found, Level contributor org/company found, freeCodeCamp contributor org/company found, awslabs contributor org/company found, WebKit contributor org/company found, cybozu contributor org/company found, pkgjs contributor org/company found, Somerset-SIDeR-Programme contributor org/company found, cloudflare contributor org/company found, minibuf contributor org/company found, Pseudo-Corp contributor org/company found, nock contributor org/company found, BoostIO contributor org/company found, Trendyol contributor org/company found, nodejs contributor org/company found, elastic contributor org/company found, babel contributor org/company found, ubie-oss contributor org/company found, cheminfo contributor org/company found, mljs contributor org/company found, pinojs contributor org/company found, fastify contributor org/company found, openjs-foundation contributor org/company found, auth0 contributor org/company found, tech-conferences contributor org/company found, WebAssembly contributor org/company found, aws contributor org/company found, pnpm contributor org/company found, malijs contributor org/company found, pasokonistan contributor org/company found, hackwitus contributor org/company found, prettier contributor org/company found, wintercg contributor org/company found,
Reason
no dangerous workflow patterns detected
Reason
update tool detected
Details
- Info: detected update tool: Dependabot: .github/dependabot.yml:1
Reason
project is fuzzed
Details
- Info: JavaScriptPropertyBasedTesting integration found: test/fuzzing/fuzzing.test.js:4
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release.yml:40
Reason
0 existing vulnerabilities detected
Reason
SAST tool detected but not run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Warn: 22 commits out of 27 are checked with a SAST tool
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
- Info: Found text in security policy: SECURITY.md:1
Reason
binaries present in source code
Details
- Warn: binary detected: lib/llhttp/llhttp.wasm:1
- Warn: binary detected: lib/llhttp/llhttp_simd.wasm:1
Reason
Found 16/19 approved changesets -- score normalized to 8
Reason
dependency not pinned by hash detected -- score normalized to 3
Details
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/autobahn.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/autobahn.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/backport.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/backport.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-create-pr.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release-create-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-create-pr.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release-create-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-create-pr.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release-create-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: test/fixtures/wpt/resources/webidl2/build.sh:7
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:25
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:27
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:46
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:48
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:68
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:70
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:89
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:91
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:111
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:113
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:132
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:134
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs-shared.yml:42
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:95
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:159
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:180
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:201
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:49
- Warn: npmCommand not pinned by hash: .github/workflows/release.yml:58
- Warn: npmCommand not pinned by hash: .github/workflows/release.yml:59
- Warn: npmCommand not pinned by hash: .github/workflows/test.yml:41
- Info: 42 out of 50 GitHub-owned GitHubAction dependencies pinned
- Info: 9 out of 11 third-party GitHubAction dependencies pinned
- Info: 0 out of 22 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:32
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:31
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/nodejs.yml:217
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-create-pr.yml:26
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:46
- Info: topLevel 'contents' permission set to 'read': .github/workflows/autobahn.yml:16
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/backport.yml:10
- Info: topLevel 'contents' permission set to 'read': .github/workflows/bench.yml:7
- Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24
- Info: topLevel 'contents' permission set to 'read': .github/workflows/nightly.yml:9
- Info: topLevel 'contents' permission set to 'read': .github/workflows/nodejs-shared.yml:13
- Info: topLevel 'contents' permission set to 'read': .github/workflows/nodejs.yml:13
- Info: topLevel 'contents' permission set to 'read': .github/workflows/release-create-pr.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/release.yml:11
- Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18
- Info: topLevel 'contents' permission set to 'read': .github/workflows/test.yml:14
- Info: topLevel 'contents' permission set to 'read': .github/workflows/triggered-autobahn.yml:9
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/update-cache-tests.yml:9
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/update-wpt.yml:9
Score
8.1
/10
Last Scanned on 2025-02-02T10:32:33Z
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More