npmpackage.info

Gathering detailed insights and metrics for verdaccio-audit

Other packages similar to verdaccio-audit

verdaccio-htpasswd

10.5.5

htpasswd auth plugin for Verdaccio

@verdaccio/file-locking

10.3.1

library that handle file locking

@verdaccio/ui-theme

3.4.1

Verdaccio User Interface

@verdaccio/commons-api

10.2.0

Commons API utilities for Verdaccio

Gathering detailed insights and metrics for verdaccio-audit

verdaccio-audit

🏰 Core dependencies and plugins for verdaccio 5.x branch ⚠️ DEPRECATED

10.2.4

MIT

TypeScript

236.38 kB

23,378,414 3.1

Installations

npm install verdaccio-audit

Score

49.3

Supply Chain

71.3

Quality

91.3

Maintenance

Vulnerability

100

License

Pull Requests

Open

1

Total

643

Closed

143

Merged

499

Issues

Open

9

Total

63

Closed

54

Releases

131

verdaccio-aws-s3-storage@10.4.0

Published on 03 May 2024

@verdaccio/local-storage-legacy@11.0.2

Published on 16 Mar 2024

@verdaccio/local-storage-legacy@11.0.1

Published on 16 Mar 2024

@verdaccio/active-directory@10.2.2

Published on 17 Feb 2024

verdaccio-aws-s3-storage@10.3.3

Published on 17 Feb 2024

verdaccio-aws-s3-storage@10.3.2

Published on 02 Sept 2023

View all 131 releases

Developer

verdaccio

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

>=8

Typescript Support

Yes

Node Version

14.21.2

NPM Version

6.14.17 Statistics

81 Stars

1,767 Commits

62 Forks

6 Watching

3 Branches

84 Contributors

Updated on 22 May 2024

Bundle Size

596.91 kB

Minified

236.38 kB

Minified + Gzipped

Bundlephobia

Languages

TypeScript (97.7%)

JavaScript (2.13%)

Dockerfile (0.17%)

Total Downloads

Cumulative downloads

Total Downloads

23,378,414

Last day

9.9%

43,245

Compared to previous day

Last week

16.2%

242,505

Compared to previous week

Last month

13.3%

918,625

Compared to previous month

Last year

47.7%

8,727,111

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

express node-fetch body-parser https-proxy-agent

Dev Dependencies

@verdaccio/types

Versions

Verdaccio Monorepo

This monorepo contains all the packages that composes the Verdaccio 5.x architecture, except Verdaccio itself and UI.

⚠️ DEPRECATED All packages were moved to verdaccio/verdaccio/ master branch, only security vulnerabilities will be commited on this repo until verdaccio@5.x.x is being is replaced by major release. Features please refer to the main repository. Only bugs and security updates are allowed on this repository.

Contributing

Please, refer to our CONTRIBUTING to learn how to contribute.

License

Verdaccio Monorepo is an open source project with MIT license

No vulnerabilities found.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

3

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

Security-Policy

Determines if the project has published a security policy.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/changesets.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/changesets.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/changesets.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/changesets.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/changesets.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/changesets.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/verdaccio/monorepo/ci.yml/main?enable=pin
Warn: containerImage not pinned by hash: plugins/aws-s3-storage/Dockerfile:1: pin your Docker image by updating verdaccio/verdaccio:5 to verdaccio/verdaccio:5@sha256:9c02076ba2aadb0f44b803a35297adda39387329a0e5194712991a63c13a414e
Warn: npmCommand not pinned by hash: plugins/aws-s3-storage/Dockerfile:15
Warn: npmCommand not pinned by hash: plugins/aws-s3-storage/Dockerfile:15
Info: 0 out of 9 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 1 third-party GitHubAction dependencies pinned
Info: 0 out of 2 npmCommand dependencies pinned
Info: 0 out of 1 containerImage dependencies pinned

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

3.1

/10

Last Scanned on 2024-11-18

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More