serve

Static file serving and directory listing

Latest 14.2.6

NPM

68%

Total Score

Maintainer Stability

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Release history

The package is mature, with 157 releases over roughly 15 years, but only 1 release in the last 12 months; the latest release was about 6 months before collection, so current maintenance is slower than its historical cadence.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, indicating a recent pause in development despite the package's long history.

Workflow audit

All 13 analyzed action references are unpinned, reducing workflow reproducibility. The audit also found high-confidence use-trusted-publishing in the snapshot release workflow, indicating reliance on long-lived registry credentials; no untrusted checkout or script-injection paths were found.

Vulnerabilities

Title	Versions	Severity
CVE-2018-3718 serve is vulnerable to Improper Handling of URL Encoding (Hex Encoding) in versions 0.0.0 - 6.5.2.	0.0.0 - 6.5.2	Medium
CVE-2019-5415 serve is vulnerable to Exposure of Information Through Directory Listing in versions 0.0.0 - 7.0.0.	0.0.0 - 7.0.0	High
CVE-2019-5417 serve is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 7.1.3.	0.0.0 - 7.1.3	High
CVE-2018-3712 serve is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 6.4.8.	0.0.0 - 6.4.8	Medium
CVE-2018-3809 serve is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.0 - 7.0.0.	0.0.0 - 7.0.0	Medium