node-liblzma

Native Node.js bindings for liblzma (XZ/LZMA2). Streaming, buffer and async APIs with browser support via WebAssembly. zlib-like API, TypeScript-first, prebuilt binaries for Linux/macOS/Windows.

Latest 5.1.3

NPM

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

Install and prepare scripts run during installation, which is expected for a native-binding package but increases the amount of build-time behavior consumers must trust.

Project backing

The repository is owned by an individual user rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factor

One contributor made 100% of the 101 commits in the last three months. This concentrated maintenance responsibility creates a real succession and abandonment risk.

Repo commit activity

There were 101 commits in the last three months, showing very active development. However, all of those commits came from one active maintainer, so the activity does not eliminate continuity risk.

Security policy

The repository has no SECURITY.md or other detected security policy, leaving vulnerability reporting and response expectations unclear.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-10783 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. node-liblzma is vulnerable to Denial of Service in versions 3.0.0 - 5.0.0.	3.0.0 - 5.0.0	Medium