fabric

Object model for HTML5 canvas, and SVG-to-canvas parser. Backed by jsdom and node-canvas.

Latest 7.4.0

NPM

88%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Dangerous workflows

Most workflow checks are clean, with no pull_request_target or untrusted-checkout findings, but one workflow has a detected script-injection pattern that warrants review.

Lifecycle scripts

A prepare install-time script is present, adding some installation complexity and execution surface, although the broader build and provenance evidence is strong.

Repo bus factor

Two contributors were active, but one made 87.5% of the recent commits, creating meaningful concentration risk; organization backing and a second active contributor partly compensate.

Vulnerabilities

Title	Versions	Severity
CVE-2026-44311 fabric is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 7.4.0.	0.0.0 - 7.4.0	Medium
CVE-2026-27013 fabric is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 7.2.0.	0.0.0 - 7.2.0	High
AIKIDO-2025-10802 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. fabric is vulnerable to Prototype Pollution in versions 0.0.1 - 6.8.0.	0.0.1 - 6.8.0	Medium
AIKIDO-2025-10801 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. fabric is vulnerable to Inefficient Regular Expression Complexity in versions 0.0.1 - 6.7.1.	0.0.1 - 6.7.1	Low