Is huggingface-hub safe to use?

huggingface-hub has no known vulnerabilities on the latest version (1.13.0). DepScope rates its health at 73/100 (moderate risk).

What is the latest version of huggingface-hub?

The latest version of huggingface-hub is 1.13.0, released 2026-04-30.

Does huggingface-hub have known vulnerabilities?

No known vulnerabilities on the latest version of huggingface-hub.

Is huggingface-hub deprecated?

No, huggingface-hub is actively maintained. Latest release: 1.13.0 (2026-04-30).

What are alternatives to huggingface-hub?

Popular alternatives to huggingface-hub in PyPI include: boto3, packaging, urllib3, idna, certifi.

What license does huggingface-hub use?

huggingface-hub is licensed under Apache-2.0.

huggingface-hub

pypiv1.13.0

Client library to download and publish models, datasets and other repos on the huggingface.co hub

License Apache-2.0permissive273 versions1 maintainers112 deps

huggingface/huggingface_hub

73

/ 100

Health

safe to use

[email protected] is safe to use (health: 73/100)

Health breakdown0 – 100

25/25

maintenance

0/20

popularity

25/25

security

15/15

maturity

8/15

community

Vulnerabilities

0

none known

OSS Scorecard

OpenSSF security posture score

5.9/10

moderate

Maintainer trust

Active maintainers (3m)

22

Contributors (12m)

22

Primary author dominance

44%

GitHub stars

3,543

Quality signals

OSS Criticality

0.51high

Download trend

growing(+13.8%)

Publish security

API token

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/pypi/huggingface-hub