mapshaper
Contributor activity is highly concentrated in one person, and the repository has no automated security-scanning tool. The project otherwise shows sustained maintenance, clear documentation, licensing, and release notes.
84%
Total Score
83
100
94
100
50
Health Score Breakdown
No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the otherwise active project.
One contributor made 159 of 160 recent commits, so maintenance is heavily dependent on a single person; the second active contributor provides only limited compensation.
The project uses Rollup and npm scripts, showing an established build process, but no security-scanning tools were detected, leaving a modest security-process gap.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-671328 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. mapshaper is vulnerable to Path Traversal in versions 0.1.3 - 0.7.26. | 0.1.3 - 0.7.26 | Medium |
CVE-2024-1163 mapshaper is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 0.6.44. | 0.0.0 - 0.6.44 | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 rw Version ~1.3.3 | — | — |
open Version ^11.0.0 | — | — |
mproj Version 0.1.6 | — | — |
pngjs Version ^7.0.0 | — | — |
fflate Version 0.8.2 | — | — |
Weekly Downloads
Info
- Last Published
- 6 hours ago
- Created
- 13 years ago
- Unpacked Size
- 15.3 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.