Synchronous version of the Fetch API
55%
Total Score
50
79
50
The package has a prepare install-time script. This is not inherently unsafe, but it adds installation behavior that should be understood before adoption.
The repository is user-owned rather than organization-owned, so the single-contributor maintenance concentration is not offset by visible organizational backing.
This release is the package's only release, published over four years ago, with no releases in the last 12 months. That limits evidence of ongoing registry maintenance despite recent repository activity.
All recent commits come from one contributor, so maintenance continuity depends heavily on that person and has little demonstrated redundancy.
The repository received two commits in the last three months from one active maintainer, showing current activity but only limited maintenance capacity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
node-fetch Version ^2.6.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.