braces

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Latest 3.0.3

NPM

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Release history

The package has 38 releases over roughly 12 years, but no releases in the last 12 months and its latest release was in May 2024, indicating slowing maintenance.

Repo commit activity

There were no commits or active maintainers in the last three months, which is a meaningful maintenance warning, although the repository was pushed in January 2025.

Repo tooling

The repository uses a build tool, but no security scanning tools were detected; this is a modest transparency and hygiene gap rather than a standalone adoption blocker.

Type declarations

No type declarations are included, which reduces ergonomics and type safety for developers consuming this JavaScript library from TypeScript.

Workflow audit

The single workflow was fully audited with no dangerous triggers, untrusted checkouts, script injection, or audit findings. Both action references are unpinned, which is a supply-chain hygiene caution, while the absence of a top-level permissions block is acceptable on its own.

Vulnerabilities

Title	Versions	Severity
CVE-2026-93687 braces is vulnerable to Uncontrolled Recursion in versions 0.0.0 - 3.0.3.	0.0.0 - 3.0.3	High
CVE-2024-4068 braces is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 3.0.3.	0.0.0 - 3.0.3	High
CVE-2018-1109 braces is vulnerable to Uncontrolled Resource Consumption in versions 2.2.0 - 2.3.1.	2.2.0 - 2.3.1	Medium