Home
Docs
GitHub
Pricing
Blog
Log In

Run Sandworm Audit for your App

Get started
Hold on, we're currently generating a fresh version of this report
Generated on May 9, 2024 via pnpm

npm 6.14.18

a package manager for JavaScript
Package summary
Share
23
issues
15
high severity
vulnerability
1
license
3
meta
11
5
moderate severity
vulnerability
5
3
low severity
license
3
15
licenses
315
MIT
102
ISC
11
BSD-2-Clause
26
other licenses
Apache-2.0
8
BSD-3-Clause
4
Artistic-2.0
3
(WTFPL OR MIT)
3
+ 8 more
Package created
12 Jul 2013
Version published
21 Dec 2022
Maintainers
5
Total deps
454
Direct deps
116
License
Artistic-2.0

Issues

23

15 high severity issues

high
Recommendation: Upgrade to version 4.1.1 or later
via: libcipm@4.0.8 & others
Recommendation: Validate that the package complies with your license policy
via: qrcode-terminal@0.12.0
Recommendation: Validate that the license expression complies with your license policy
via: libnpx@10.2.4 & others
Recommendation: Read and validate the license terms
via: init-package-json@1.10.3 & others
via: bin-links@1.1.8 & others
via: bin-links@1.1.8 & others
via: libcipm@4.0.8 & others
via: libcipm@4.0.8
via: libnpm@3.0.1
via: libcipm@4.0.8 & others
via: read-package-tree@5.3.1
via: read-installed@4.0.3 & others
via: libcipm@4.0.8 & others
via: libnpm@3.0.1 & others
via: libcipm@4.0.8 & others
Collapse
Expand

5 moderate severity issues

moderate
Recommendation: Upgrade to version 11.8.5 or later
via: libnpx@10.2.4 & others
Recommendation: Upgrade to version 1.1.9 or later
via: libcipm@4.0.8 & others
Recommendation: Upgrade to version 4.1.3 or later
via: libcipm@4.0.8 & others
Recommendation: None
via: libcipm@4.0.8 & others
Recommendation: Upgrade to version 6.2.1 or later
via: libcipm@4.0.8 & others
Collapse
Expand

3 low severity issues

low
Recommendation: Read and validate the license terms
via: qrcode-terminal@0.12.0
Recommendation: Read and validate the license terms
via: init-package-json@1.10.3 & others
Recommendation: Read and validate the license terms
via: init-package-json@1.10.3 & others
Collapse
Expand

Licenses

MIT License

Permissive
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
modify
distribute
sublicense
private-use
Cannot
hold-liable
Must
include-copyright
include-license
315 Packages, Including:
@types/keyv@3.1.4
@types/node@20.12.11
@types/responselike@1.0.3
agent-base@4.2.1
agent-base@4.3.0
agentkeepalive@3.5.3
ajv@6.12.6
ansi-regex@2.1.1
ansi-regex@3.0.1
ansi-regex@4.1.1
ansi-styles@3.2.1
ansicolors@0.3.2
ansistyles@0.1.3
archy@1.0.0
array-buffer-byte-length@1.0.1
array.prototype.reduce@1.0.7
arraybuffer.prototype.slice@1.0.3
asap@2.0.6
asn1@0.2.6
assert-plus@1.0.0
asynckit@0.4.0
available-typed-arrays@1.0.7
aws4@1.12.0
balanced-match@1.0.2
bluebird@3.7.2
boxen@1.3.0
brace-expansion@1.1.11
buffer-from@1.1.2
builtins@1.0.3
byline@5.0.0
byte-size@5.0.1
call-bind@1.0.7
camelcase@4.1.0
camelcase@5.3.1
capture-stack-trace@1.0.2
chalk@2.4.2
ci-info@1.6.0
ci-info@2.0.0
cli-boxes@1.0.0
cli-columns@3.1.2
cli-table3@0.5.1
clone@1.0.4
code-point-at@1.1.0
color-convert@1.9.3
color-name@1.1.3
colors@1.4.0
columnify@1.5.4
combined-stream@1.0.8
concat-map@0.0.1
concat-stream@1.6.2

ISC License

Permissive
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
modify
distribute
Cannot
hold-liable
Must
include-copyright
include-license
102 Packages, Including:
@iarna/cli@2.1.0
abbrev@1.1.1
ansi-align@2.0.0
aproba@1.2.0
aproba@2.0.0
are-we-there-yet@1.1.7
cacache@12.0.4
call-limit@1.1.1
chownr@1.1.4
cliui@5.0.0
cmd-shim@3.0.3
console-control-strings@1.1.0
copy-concurrently@1.0.5
dezalgo@1.0.4
figgy-pudding@3.5.2
find-npm-prefix@1.0.2
fs-minipass@1.2.7
fs-vacuum@1.2.10
fs-write-stream-atomic@1.0.10
fs.realpath@1.0.0
gauge@2.7.4
get-caller-file@2.0.5
glob@7.2.3
graceful-fs@4.2.11
har-schema@2.0.0
has-unicode@2.0.1
hosted-git-info@2.8.9
ignore-walk@3.0.4
infer-owner@1.0.4
inflight@1.0.6
inherits@2.0.4
ini@1.3.8
init-package-json@1.10.3
isexe@2.0.0
json-stringify-safe@5.0.1
libnpm@3.0.1
libnpmaccess@3.0.2
libnpmconfig@1.2.1
libnpmhook@5.0.3
libnpmorg@1.0.1
libnpmpublish@1.1.3
libnpmsearch@2.0.2
libnpmteam@1.0.2
libnpx@10.2.4
lock-verify@2.2.2
lockfile@1.0.4
lru-cache@4.1.5
lru-cache@5.1.1
make-fetch-happen@5.0.2
minimatch@3.1.2

BSD 2-Clause "Simplified" License

Permissive
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
modify
distribute
place-warranty
Cannot
hold-liable
Must
include-copyright
include-license
11 Packages, Including:
cidr-regex@2.0.10
configstore@3.1.5
dotenv@5.0.1
http-cache-semantics@3.8.1
is-cidr@3.1.1
mississippi@3.0.0
normalize-package-data@2.5.0
npm-install-checks@3.0.2
npm-user-validate@1.0.1
update-notifier@2.5.0
uri-js@4.4.1

Apache License 2.0

Permissive
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
modify
distribute
sublicense
private-use
use-patent-claims
place-warranty
Cannot
hold-liable
use-trademark
Must
include-copyright
include-license
state-changes
include-notice
8 Packages, Including:
aws-sign2@0.7.0
caseless@0.12.0
forever-agent@0.6.1
oauth-sign@0.9.0
request@2.88.2
spdx-correct@3.2.0
tunnel-agent@0.6.0
validate-npm-package-license@3.0.4

BSD 3-Clause "New" or "Revised" License

Permissive
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
modify
distribute
place-warranty
Cannot
use-trademark
hold-liable
Must
include-copyright
include-license
4 Packages, Including:
bcrypt-pbkdf@1.0.2
duplexer3@0.1.5
qs@6.5.3
tough-cookie@2.5.0

Artistic License 2.0

Permissive
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
modify
distribute
sublicense
private-use
Cannot
use-trademark
hold-liable
Must
rename
state-changes
include-original
include-install-instructions
3 Packages, Including:
bin-links@1.1.8
gentle-fs@2.3.1
npm-lifecycle@3.1.5

(WTFPL OR MIT)

Permissive
3 Packages, Including:
opener@1.5.2
path-is-inside@1.0.2
sorted-object@2.0.1

(MIT OR Apache-2.0)

Permissive
1 Packages, Including:
JSONStream@1.3.5

(AFL-2.1 OR BSD-3-Clause)

Permissive
1 Packages, Including:
json-schema@0.4.0

Apache 2.0

Invalid
Not OSI Approved
1 Packages, Including:
qrcode-terminal@0.12.0

(BSD-2-Clause OR MIT OR Apache-2.0)

Expression
1 Packages, Including:
rc@1.2.8

(BSD-2-Clause OR MIT)

Permissive
1 Packages, Including:
sha@3.0.0

Creative Commons Attribution 3.0 Unported

Uncategorized
Not OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
Cannot
Must
1 Packages, Including:
spdx-exceptions@2.5.0

Creative Commons Zero v1.0 Universal

Public Domain
Not OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
Cannot
Must
1 Packages, Including:
spdx-license-ids@3.0.17

The Unlicense

Public Domain
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
private-use
modify
Cannot
include-copyright
hold-liable
Must
1 Packages, Including:
tweetnacl@0.14.5
Disclaimer

This deed highlights only some of the key features and terms of the actual license. It is not a license and has no legal value. You should carefully review all of the terms and conditions of the actual license before using the licensed material.

Sandworm is not a law firm and does not provide legal services. Distributing, displaying, or linking to this deed or the license that it summarizes does not create a lawyer-client or any other relationship.

Direct Dependencies

116
All Dependencies CSV
β“˜ This is a list of npm 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.
NameVersionSizeLicenseTypeVulnerabilities
JSONStream1.3.5136.16 kB(MIT OR Apache-2.0)
prod
abbrev1.1.12.25 kBISC
prod
ansicolors0.3.22.8 kBMIT
prod
ansistyles0.1.32.57 kBMIT
prod
aproba2.0.03.6 kBISC
prod
archy1.0.02.95 kBMIT
prod dev
bin-links1.1.87.59 kBArtistic-2.0
prod
2
bluebird3.7.2136.03 kBMIT
prod peer
byte-size5.0.14.22 kBMIT
prod
cacache12.0.431.81 kBISC
prod
call-limit1.1.12.57 kBISC
prod
chownr1.1.42.17 kBISC
prod dev
ci-info2.0.04.75 kBMIT
prod
cli-columns3.1.23.48 kBMIT
prod
cli-table30.5.112.28 kBMIT
prod
cmd-shim3.0.34.11 kBISC
prod
columnify1.5.49.47 kBMIT
prod
config-chain1.1.135.84 kBMIT
prod
detect-indent5.0.03.04 kBMIT
prod
detect-newline2.1.01.65 kBMIT
prod
dezalgo1.0.41.65 kBISC
prod
editor1.0.01.82 kBMIT
prod
figgy-pudding3.5.26.26 kBISC
prod
find-npm-prefix1.0.22.52 kBISC
prod
fs-vacuum1.2.105.69 kBISC
prod
1
fs-write-stream-atomic1.0.105.49 kBISC
prod
gentle-fs2.3.110.21 kBArtistic-2.0
prod
2
get-stream4.1.03.36 kBMIT
prod dev
glob7.2.315.08 kBISC
prod dev
graceful-fs4.2.119.57 kBISC
prod dev optional
has-unicode2.0.11.92 kBISC
prod
hosted-git-info2.8.97.92 kBISC
prod
iferr1.0.21.72 kBMIT
prod
infer-owner1.0.42.01 kBISC
prod
inflight1.0.61.99 kBISC
prod
inherits2.0.41.98 kBISC
prod dev
ini1.3.83.9 kBISC
prod
init-package-json1.10.35.37 kBISC
prod
1
2
is-cidr3.1.12.04 kBBSD-2-Clause
prod
json-parse-better-errors1.0.22.98 kBMIT
prod dev
lazy-property1.0.01.8 kBMIT
prod
libcipm4.0.810.67 kBMIT
prod
9
4
2
libnpm3.0.13.77 kBISC
prod
10
4
2
libnpmaccess3.0.218.91 kBISC
prod
2
1
libnpmhook5.0.34.55 kBISC
prod
2
1
libnpmorg1.0.115.56 kBISC
prod
2
1
libnpmsearch2.0.216.25 kBISC
prod
2
1
libnpmteam1.0.215.96 kBISC
prod
2
1
libnpx10.2.432.38 kBISC
prod
1
1
lock-verify2.2.22.32 kBISC
prod
lockfile1.0.49.4 kBISC
prod
lodash._baseuniq4.6.06.13 kBMIT
prod
lodash.clonedeep4.5.011.36 kBMIT
prod
lodash.union4.6.08.31 kBMIT
prod
lodash.uniq4.5.06.78 kBMIT
prod dev
lodash.without4.4.07.59 kBMIT
prod
lru-cache5.1.15.69 kBISC
prod
meant1.0.32.7 kBMIT
prod
mississippi3.0.05.89 kBBSD-2-Clause
prod
mkdirp0.5.62.95 kBMIT
prod dev
move-concurrently1.0.12.86 kBISC
prod
node-gyp5.1.1407.82 kBMIT
prod
3
3
nopt4.0.39.11 kBISC
prod
normalize-package-data2.5.08.46 kBBSD-2-Clause
prod dev
1
2
npm-audit-report1.3.35.74 kBISC
prod
npm-cache-filename1.0.21.69 kBISC
prod
npm-install-checks3.0.23.24 kBBSD-2-Clause
prod
npm-lifecycle3.1.511.58 kBArtistic-2.0
prod
3
3
npm-package-arg6.1.15.79 kBISC
prod
npm-packlist1.4.85.11 kBISC
prod
npm-pick-manifest3.0.24.84 kBISC
prod
npm-profile4.0.48.06 kBISC
prod
2
1
npm-registry-fetch4.0.713.95 kBISC
prod
2
1
npm-user-validate1.0.11.77 kBBSD-2-Clause
prod
npmlog4.1.26.36 kBISC
prod dev
once1.4.01.93 kBISC
prod dev
opener1.5.23 kB(WTFPL OR MIT)
prod dev
osenv0.1.52.25 kBISC
prod
pacote9.5.1232.51 kBMIT
prod
3
2
2
path-is-inside1.0.21.78 kB(WTFPL OR MIT)
prod dev
promise-inflight1.0.11.63 kBISC
prod
qrcode-terminal0.12.051.46 kBApache 2.0
prod
1
1
query-string6.14.18.07 kBMIT
prod
qw1.0.21.68 kBISC
prod
read-cmd-shim1.0.52.07 kBISC
prod
read-installed4.0.38.1 kBISC
prod
2
2
read-package-json2.1.26.58 kBISC
prod
1
2
read-package-tree5.3.15.14 kBISC
prod dev
3
2
read1.0.72.61 kBISC
prod
readable-stream3.6.232.46 kBMIT
prod dev
readdir-scoped-modules1.1.01.85 kBISC
prod dev
1
request2.88.257.83 kBApache-2.0
prod dev
3
2
retry0.12.010.19 kBMIT
prod
rimraf2.7.15.53 kBISC
prod dev
safe-buffer5.2.19.74 kBMIT
prod dev
semver5.7.217.45 kBISC
prod dev
sha3.0.02.8 kB(BSD-2-Clause OR MIT)
prod
slide1.1.64.29 kBISC
prod
sorted-object2.0.11.5 kB(WTFPL OR MIT)
prod
sorted-union-stream2.1.32.71 kBMIT
prod
ssri6.0.212.04 kBISC
prod
stringify-package1.0.12.28 kBISC
prod
1
tar4.4.1938.02 kBISC
prod
1
text-table0.2.03.81 kBMIT
prod dev
tiny-relative-date1.3.04.73 kBMIT
prod
uid-number0.0.62 kBISC
prod
umask1.1.04.04 kBMIT
prod
unique-filename1.1.113.26 kBISC
prod
unpipe1.0.02.05 kBMIT
prod
update-notifier2.5.05.47 kBBSD-2-Clause
prod
1
1
uuid3.4.011.87 kBMIT
prod dev
1
validate-npm-package-license3.0.45.54 kBApache-2.0
prod
1
2
validate-npm-package-name3.0.05.25 kBISC
prod
which1.3.14.08 kBISC
prod dev
worker-farm1.7.013.88 kBMIT
prod
write-file-atomic2.4.34.39 kBISC
prod dev

Visualizations

Frequently Asked Questions

What does npm do?

NPM, or Node Package Manager, is a powerful tool catering to the JavaScript programming community. It serves as a package manager for JavaScript, providing a convenient platform for programmers to share and reuse code components. Aside from being an online repository of open-source projects, NPM also features command-line utility for interacting with said repository. It facilitates the installation of packages, version management, and dependency management of Node.js software packages, making it an essential tool for JavaScript developers.

How do you use npm?

Using NPM is quite straightforward. It comes bundled with Node.js installations so make sure to install Node.js first. To verify if it's installed correctly, simply run node -v and npm -v in your terminal. Both commands should return version numbers. Once set up, you can begin using NPM by including npm followed by the desired command in your terminal. For instance, to install a package, you would use npm install <package-name>. This code utilises the install command to download the specified package. Similarly, you can remove packages with npm uninstall <package-name>, update with npm update <package-name> and so forth.

# install a package
npm install <package-name>

# remove a package
npm uninstall <package-name>

# update a package
npm update <package-name>

Where are the npm docs?

The official NPM documentation, an extensive repository of guides, how-tos, and reference materials around the functionalities of NPM, can be found at https://docs.npmjs.com/. Users can find information varying from introduction to advanced topics, aiding both beginners and experienced developers in mastering the tool. This documentation is the central place for knowledge and advice on all things NPM, from installing packages to troubleshooting errors. Finally, remember that you can also search the docs locally with the command npm help-search <query>.