jsdom
A JavaScript implementation of many web standards
88%
Total Score
healthy
Healthy, with active maintenance and provenance; unpinned GitHub Actions references are the main caveat.
Health Score Breakdown
The package declares a prepare lifecycle script, so installation performs an additional package-defined action. This adds some installation complexity, but the signal alone does not show harmful behavior or make the release unfit.
No build tool or security-scanning tool was detected in the collected repository metadata. This is a transparency and hygiene gap, although the active repository, tests, and release activity provide compensating evidence.
Both workflows were analyzed without failures and no untrusted checkout or script-injection paths were found, but all 8 action references are unpinned and one workflow grants top-level write access. The low-confidence cache-poisoning finding is hygiene only; the high-confidence adhoc-package finding is a smaller reproducibility concern.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2021-20066 jsdom is vulnerable to Insufficient Granularity of Access Control in versions 0.0.0 - 16.4.0. | 0.0.0 - 16.4.0 | Medium |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 saxes Version ^6.0.0 | — | — |
parse5 Version ^8.0.1 | — | — |
undici Version ^8.11.2 | — | — |
css-tree Version ^3.2.1 | — | — |
data-urls Version ^8.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 9 days ago
- Created
- 14 years ago
- Unpacked Size
- 5.3 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.