Is pacote safe to use?

pacote has no known vulnerabilities on the latest version (21.5.1). DepScope rates its health at 91/100 (low risk).

What is the latest version of pacote?

The latest version of pacote is 21.5.1, released 2026-06-09.

Does pacote have known vulnerabilities?

No known vulnerabilities on the latest version of pacote.

Is pacote deprecated?

No, pacote is actively maintained. Latest release: 21.5.1 (2026-06-09).

What are alternatives to pacote?

Popular alternatives to pacote in npm include: ?, semver, minimatch, debug, brace-expansion.

pacote

npmv21.5.1

JavaScript package downloader

License ISCpermissive237 versions4 maintainers17 deps13,057,571 weekly dl

npm/pacote

/ 100

Health

safe to use

[email protected] is safe to use (health: 91/100)

Health breakdown0 – 100

25/25

maintenance

20/20

popularity

25/25

security

15/15

maturity

6/15

community

0/15

popularity_floor

Vulnerabilities

none known

Bundle & TypeScript

🌟

TypeScript

7/10typed

Types from @types/pacote (DefinitelyTyped)

Quality signals

Download trend

stable(0%)

Publish security

npm attested

Health History

Dependency Tree

License Audit

Dependencies (17)

@gar/promise-retry @npmcli/git @npmcli/installed-package-contents @npmcli/package-json @npmcli/promise-spawn @npmcli/run-script cacache fs-minipass minipass npm-package-arg npm-packlist npm-pick-manifest npm-registry-fetch proc-log sigstore ssri tar

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/pacote

pacote

npmv21.5.1

JavaScript package downloader

License ISCpermissive237 versions4 maintainers17 deps13,057,571 weekly dl

npm/pacote

/ 100

Health

safe to use

[email protected] is safe to use (health: 91/100)

Health breakdown0 – 100

25/25

maintenance

20/20

popularity

25/25

security

15/15

maturity

6/15

community

0/15

popularity_floor

Vulnerabilities

none known

Bundle & TypeScript

🌟

TypeScript

7/10typed

Types from @types/pacote (DefinitelyTyped)

Quality signals

Download trend

stable(0%)

Publish security

npm attested

Health History

Dependency Tree

License Audit

Dependencies (17)

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/pacote