Is expr-eval safe to use?

expr-eval has 1 known vulnerabilities on the latest version (2.0.2). DepScope rates its health at 39/100 (critical risk).

What is the latest version of expr-eval?

The latest version of expr-eval is 2.0.2, released 2019-09-28.

Yes. expr-eval has 1 known vulnerabilities. See depscope.dev/pkg/npm/expr-eval for details.

No, expr-eval is actively maintained. Latest release: 2.0.2 (2019-09-28).

Popular alternatives to expr-eval in npm include: debug, minimatch, strip-ansi, ms, lru-cache.

expr-eval is licensed under MIT.

npmv2.0.2

Mathematical expression evaluator

License MITpermissive17 versions1 maintainers0 deps

/ 100

Health

update required

[email protected] has vulnerabilities — update to latest

Update to >= 3.0.1 to fix known vulnerabilities

Health breakdown0 – 100

0/25

maintenance

0/20

popularity

20/25

security

12/15

maturity

7/15

community

Vulnerabilities

1 high

Advisories (1)

Severity	ID	Summary	Fixed in
high	CVE-2025-12735	expr-eval does not restrict functions passed to the evaluate function	3.0.1

🌟

10/10typed

bundled

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/expr-eval