Gathering detailed insights and metrics for vite
Gathering detailed insights and metrics for vite
npm install vite
Typescript
Module System
Min. Node Version
Node Version
NPM Version
70.8
Supply Chain
66.8
Quality
96.7
Maintenance
100
Vulnerability
88.5
License
TypeScript (83.03%)
JavaScript (9.96%)
HTML (5.13%)
CSS (1.31%)
Vue (0.15%)
AppleScript (0.12%)
Svelte (0.11%)
SCSS (0.08%)
Less (0.04%)
Stylus (0.02%)
Shell (0.01%)
Pug (0.01%)
Sass (0.01%)
SugarSS (0.01%)
Total Downloads
1,084,787,463
Last Day
3,621,146
Last Week
18,653,114
Last Month
60,165,967
Last Year
700,190,809
70,043 Stars
7,438 Commits
6,357 Forks
433 Watching
50 Branches
1,063 Contributors
Latest Version
6.0.7
Package Id
vite@6.0.7
Unpacked Size
2.69 MB
Size
655.59 kB
File Count
34
NPM Version
10.8.2
Node Version
20.18.1
Publised On
02 Jan 2025
Cumulative downloads
Total Downloads
Last day
8.9%
3,621,146
Compared to previous day
Last week
14.3%
18,653,114
Compared to previous week
Last month
-19.3%
60,165,967
Compared to previous month
Last year
132.5%
700,190,809
Compared to previous year
11
59
1
Next Generation Frontend Tooling
Vite (French word for "fast", pronounced /vit/
) is a new breed of frontend build tool that significantly improves the frontend development experience. It consists of two major parts:
A dev server that serves your source files over native ES modules, with rich built-in features and astonishingly fast Hot Module Replacement (HMR).
A build command that bundles your code with Rollup, pre-configured to output highly optimized static assets for production.
In addition, Vite is highly extensible via its Plugin API and JavaScript API with full typing support.
Stable Version
12
8.6/10
Summary
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service
Affected Versions
>= 3.0.0-alpha.0, < 3.0.0-beta.4
Patched Versions
3.0.0-beta.4
8.6/10
Summary
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service
Affected Versions
< 2.9.13
Patched Versions
2.9.13
7.5/10
Summary
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Affected Versions
>= 5.0.0, <= 5.0.11
Patched Versions
5.0.12
7.5/10
Summary
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Affected Versions
>= 4.0.0, <= 4.5.1
Patched Versions
4.5.2
7.5/10
Summary
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Affected Versions
>= 3.0.0, <= 3.2.7
Patched Versions
3.2.8
7.5/10
Summary
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Affected Versions
>= 2.7.0, <= 2.9.16
Patched Versions
2.9.17
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 4.3.0, < 4.3.9
Patched Versions
4.3.9
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 4.2.0, < 4.2.3
Patched Versions
4.2.3
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 4.1.0, < 4.1.5
Patched Versions
4.1.5
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 4.0.0, < 4.0.5
Patched Versions
4.0.5
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 3.0.2, < 3.2.7
Patched Versions
3.2.7
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
< 2.9.16
Patched Versions
2.9.16
21
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 5.0.0, <= 5.1.7
Patched Versions
5.1.8
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 5.2.0, < 5.2.14
Patched Versions
5.2.14
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 5.0.0, < 5.1.8
Patched Versions
5.1.8
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
< 3.2.11
Patched Versions
3.2.11
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 5.2.0, < 5.2.14
Patched Versions
5.2.14
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 5.3.0, < 5.3.6
Patched Versions
5.3.6
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 5.4.0, < 5.4.6
Patched Versions
5.4.6
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 4.0.0, < 4.5.4
Patched Versions
4.5.4
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
<= 3.2.10
Patched Versions
3.2.11
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 4.0.0, <= 4.5.3
Patched Versions
4.5.4
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 5.3.0, <= 5.3.5
Patched Versions
5.3.6
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 5.4.0, <= 5.4.5
Patched Versions
5.4.6
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 5.2.0, <= 5.2.5
Patched Versions
5.2.6
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 5.1.0, <= 5.1.6
Patched Versions
5.1.7
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 5.0.0, <= 5.0.12
Patched Versions
5.0.13
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 4.0.0, <= 4.5.2
Patched Versions
4.5.3
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 3.0.0, <= 3.2.8
Patched Versions
3.2.10
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 2.7.0, <= 2.9.17
Patched Versions
2.9.18
6.1/10
Summary
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload
Affected Versions
>= 5.0.0, < 5.0.5
Patched Versions
5.0.5
6.1/10
Summary
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload
Affected Versions
= 4.5.0
Patched Versions
4.5.1
6.1/10
Summary
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload
Affected Versions
>= 4.4.0, < 4.4.12
Patched Versions
4.4.12
Reason
no dangerous workflow patterns detected
Reason
30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Reason
license file detected
Details
Reason
security policy file detected
Details
Reason
1 existing vulnerabilities detected
Details
Reason
Found 23/28 approved changesets -- score normalized to 8
Reason
binaries present in source code
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
Reason
project is not fuzzed
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Score
Last Scanned on 2025-01-06
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More