pm2
Production process manager for Node.JS applications with a built-in load balancer.
78%
Total Score
70
50
94
83
50
Health Score Breakdown
No build attestation or trusted-publisher provenance is present, limiting verification of how the registry artifact was produced.
The package has 22 runtime dependencies for a substantial process-management tool, which adds maintenance surface but is not disproportionate to its functionality.
Only one registry account has publish access, which is a modest publishing-continuity concern, though the repository has a long release history.
The repository is owned by an individual account rather than an organization, so the concentrated recent activity has no visible organizational handoff signal to offset it.
All 14 recent commits came from one contributor, leaving maintenance highly dependent on a single person and increasing continuity risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10690 pm2 is vulnerable to Command Injection in versions 0.1.0 - 6.0.14. | 0.1.0 - 6.0.14 | High |
AIKIDO-2025-10602 pm2 is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.12.2 - 6.0.8. | 0.12.2 - 6.0.8 | Low |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ws Version 8.21.0 | — | — |
amp Version 0.3.1 | — | — |
tx2 Version 1.0.5 | — | — |
ansis Version 4.0.0-node10 | — | — |
async Version 3.2.6 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 13 years ago
- Unpacked Size
- 1.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.