read-package-json
The thing npm uses to read package.json files with semantics and defaults and validation
12%
Total Score
50
69
75
100
Health Score Breakdown
The registry marks the entire package as no longer supported and directs users to @npmcli/package-json, making continued adoption a severe maintenance risk.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the archived and deprecated status.
The linked repository is archived, which strongly indicates that this package is no longer an actively maintained dependency.
The package has a long history with 91 releases, but it has had no releases in the last 12 months; this supports the conclusion that maintenance has ended.
All eight workflows were analyzed with no untrusted checkout or script-injection findings, but all 38 action references are unpinned and high-confidence template-injection findings affect two workflows; these are secondary concerns here.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 glob Version ^10.2.2 | — | — |
normalize-package-data Version ^6.0.0 | — | — |
npm-normalize-package-bin Version ^3.0.0 | — | — |
json-parse-even-better-errors Version ^3.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 years ago
- Created
- 14 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.