Package Health

tsup

Bundle your TypeScript library with no config, powered by esbuild

Latest 8.5.1NPMNPM

52%

Total Score

Maintainer Stability
Maintainer Stability
Assesses the consistency and reliability of package maintainers

25

Dependencies
Dependencies
Evaluates the health and security of package dependencies

50

Maturity
Maturity
Indicates package age, release frequency, and adoption metrics

94

Supply Chain
Supply Chain
Evaluates supply chain security practices and risks

67

Attestations
Attestations
Measures the presence and validity of package attestations and signatures

100

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activitydanger

The repository recorded 0 commits and 0 active maintainers over the last 3 months, a direct sign of stalled development capacity.

Dependency profilecaution

The package has 17 runtime dependencies, including substantial build-tooling components such as esbuild and rollup; this increases dependency surface and maintenance exposure for a build tool.

Release historycaution

The project has 204 releases over about 6 years, but only 1 release in the last 12 months, indicating a sharply slower release cadence.

Repo issue activitycaution

There are 356 open issues and 58 open pull requests, while no issues or pull requests were closed in the last month; this suggests a backlog with limited recent triage.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear.

Vulnerabilities

TitleVersionsSeverity
AIKIDO-2025-10811
tsup is vulnerable to Cross-Site Scripting in versions 5.0.0 - 8.5.0.
5.0.0 - 8.5.0
Low

Package versions

Maintainers

Direct Dependencies

DependencyLast ReleaseScore
cac
Version ^6.7.14
—
—
debug
Version ^4.4.0
—
—
joycon
Version ^3.1.1
—
—
rollup
Version ^4.34.8
—
—
consola
Version ^3.4.0
—
—

Weekly Downloads

Info

Last Published
11 months ago
Created
6 years ago
Unpacked Size
0.4 MB

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform