true has 1 known vulnerabilities on the latest version (0.0.4). DepScope rates its health at 38/100 (critical risk).

What is the latest version of true?

The latest version of true is 0.0.4, released 2014-09-16.

Does true have known vulnerabilities?

Yes. true has 1 known vulnerabilities. See depscope.dev/pkg/npm/true for details.

No, true is actively maintained. Latest release: 0.0.4 (2014-09-16).

What are alternatives to true?

Popular alternatives to true in npm include: ?, semver, minimatch, debug, ansi-styles.

What license does true use?

true is licensed under Apache-2.0.

true

npmv0.0.4

A JavaScript port of the Unix utility 'true'. Returns the Boolean value `true`

License Apache-2.0permissive4 versions1 maintainers0 deps1,669 weekly dl

mde/true

/ 100

Health

do not use

Do not install. Package is flagged as malicious (advisory MAL-2026-10667).

Health breakdown0 – 100

0/25

maintenance

6/20

popularity

15/25

security

15/15

maturity

2/15

community

Vulnerabilities

1 critical

Advisories (1)

Severity	ID	Summary	Fixed in
critical	GHSA-f59f-vj5q-c725	Malicious code in true (npm)	—

Bundle & TypeScript

🌟

TypeScript

0/10untyped

No type definitions available

⚠ Malicious package

This package is flagged as malicious by the OpenSSF/OSV community feed. Do not install.

Advisory: MAL-2026-10667 — Malicious code in true (npm)

⚠ Possible typosquat

Name is close to a popular package. Targets:

trim (adjacent_swap_or_double dist 2)tr46 (adjacent_swap_or_double dist 2)

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/true