sqlite3

Unfit to use for a new dependency because the source repository is archived and has no recent development or issue activity. The long release history, strong package documentation, tests in the repository, licensing, and a recent release provide maturity but do not offset abandonment risk.

Latest 6.0.1

NPM

22%

Total Score

Maintainer Stability

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the archived status and leaving no evidence of ongoing maintenance.

Repository archived

The linked repository is archived, which is a severe maintenance and abandonment risk even though it was pushed as recently as June 2026.

Build provenance

No build attestation or trusted publisher provenance is available, reducing publication transparency; the repository’s matching source and release notes provide only partial compensation.

Lifecycle scripts

An install script is used, which is expected for a native SQLite binding that may install or build platform binaries, though it increases installation complexity.

Project backing

The repository is owned by the TryGhost organization, providing organizational backing, but that backing does not overcome the explicit archived status and zero recent activity.

Vulnerabilities

Title	Versions	Severity
CVE-2022-43441 sqlite3 is vulnerable to Improper Control of Dynamically-Managed Code Resources in versions 5.0.0 - 5.1.5.	5.0.0 - 5.1.5	High
CVE-2022-21227 sqlite3 is vulnerable to Uncaught Exception in versions 5.0.0 - 5.0.3.	5.0.0 - 5.0.3	High