dref has 1 known vulnerabilities on the latest version (0.1.2). DepScope rates its health at 41/100 (high risk).

What is the latest version of dref?

The latest version of dref is 0.1.2, released 2013-08-13.

Does dref have known vulnerabilities?

Yes. dref has 1 known vulnerabilities. See depscope.dev/pkg/npm/dref for details.

No, dref is actively maintained. Latest release: 0.1.2 (2013-08-13).

What are alternatives to dref?

Popular alternatives to dref in npm include: semver, debug, ansi-styles, minimatch, brace-expansion.

What license does dref use?

License information for dref is not declared in the registry metadata.

dref

npmv0.1.2

deep object refs

10 versions2 maintainers3 deps9,225 weekly dl

crcn/dref.js

/ 100

Health

update required

[email protected] has vulnerabilities — update to latest

Moderate health score (41/100) — verify manually
1 high severity vulnerabilities

Health breakdown0 – 100

0/25

maintenance

6/20

popularity

20/25

security

15/15

maturity

0/15

community

Vulnerabilities

1 high

Advisories (1)

Severity	ID	Summary	Fixed in
high	CVE-2025-26278	dref is vulnerable to prototype pollution	—

Bundle & TypeScript

📦

Bundle Size

1.0 KBminified

0.5 KB gzipped

3 direct dependencies

side effects

🌟

TypeScript

0/10untyped

No type definitions available

⚠ Possible typosquat

Name is close to a popular package. Targets:

diff (adjacent_swap_or_double dist 2)

Health History

Dependency Tree

License Audit

Dependencies (3)

structr dref type-component

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/dref