Package Health

nitro

Build and Deploy Universal JavaScript Servers

Latest 3.0.260903-betaNPMNPM

91%

Total Score

healthy

Healthy release, supported by active maintenance and strong project transparency.

Are you affected? Scan for Free

Health Score Breakdown

Version stabilitycaution

This is a prerelease beta and 55% of recent releases are prereleases, so consumers should expect some instability despite the stable major line.

Workflow auditcaution

All four workflows were analyzed, use read-only permissions, and pin all 23 action references. High-confidence adhoc package installations and trusted-publishing audit findings create modest hygiene and publishing-process concerns; the high-severity cache finding has low confidence and is therefore limited to hygiene impact.

Vulnerabilities

TitleVersionsSeverity
CVE-2026-44372
nitro is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 0.0.0 - 3.0.260429-beta.
0.0.0 - 3.0.260429-beta
Medium
CVE-2026-44373
nitro is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 3.0.260429-beta.
0.0.0 - 3.0.260429-beta
Medium

Package versions

Maintainers

Direct Dependencies

DependencyLast ReleaseScore
h3
Version ^2.0.1-rc.31
—
—
db0
Version ^0.4.1
—
—
nf3
Version ^0.3.24
—
—
rou3
Version ^0.9.2
—
—
srvx
Version ^1.0.3
—
—

Weekly Downloads

Info

Last Published
1 month ago
Created
13 years ago
Unpacked Size
2.3 MB

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform