Is package-lock.json safe to use?

package-lock.json has no known vulnerabilities on the latest version (1.0.0). DepScope rates its health at 45/100 (high risk).

What is the latest version of package-lock.json?

The latest version of package-lock.json is 1.0.0, released 2018-01-05.

Does package-lock.json have known vulnerabilities?

No known vulnerabilities on the latest version of package-lock.json.

Is package-lock.json deprecated?

No, package-lock.json is actively maintained. Latest release: 1.0.0 (2018-01-05).

What are alternatives to package-lock.json?

Popular alternatives to package-lock.json in npm include: semver, debug, ansi-styles, minimatch, brace-expansion.

What license does package-lock.json use?

License information for package-lock.json is not declared in the registry metadata.

package-lock.json

npmv1.0.0

You probably didn’t mean to install a package.

1 versions1 maintainers0 deps6,266 weekly dl

/ 100

Health

use with caution

[email protected] low health (45/100) — consider alternatives

Moderate health score (45/100) — verify manually

Health breakdown0 – 100

0/25

maintenance

6/20

popularity

25/25

security

12/15

maturity

2/15

community

Vulnerabilities

none known

Bundle & TypeScript

🌟

TypeScript

0/10untyped

No type definitions available

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/package-lock.json