{"package":"decimal","ecosystem":"hex","latest_version":"3.1.1","description":"Arbitrary precision decimal arithmetic.","license":"Apache-2.0","license_risk":"permissive","commercial_use_notes":"Permissive: commercial closed-source use OK; preserve the copyright notice.","homepage":"https://github.com/ericmj/decimal","repository":"https://github.com/ericmj/decimal","downloads_weekly":543763,"health":{"score":83,"risk":"low","breakdown":{"maintenance":25,"popularity":14,"security":23,"maturity":15,"community":6,"popularity_floor":0},"deprecated":false,"max_score":100},"vulnerabilities":{"count":1,"critical":0,"high":0,"medium":1,"low":0,"details":[{"vuln_id":"CVE-2026-32686","severity":"medium","summary":"Unbounded exponent in decimal enables unauthenticated DoS","affected_versions":">=0.1.0,<3.0.0|>=bc11f4a2b6fb61fc1360a0ab4e79141bba918841,<6a523f3a73b8c9974540e21c7aa88f1258bb35ae|=0.1.1|=0.1.2|=0.2.0|=0.2.1|=0.2.2|=0.2.3|=0.2.4|=0.2.5|=1.0.0|=1.0.1|=1.1.0|=1.1.1|=1.1.2|=1.2.0|=1.3.0|=1.3.1|=1.4.0|=1.4.1|=1.5.0|=1.6.0|=1.7.0|=1.8.0|=1.8.1|=1.9.0|=1.9.0-rc.0|=2.0.0|=2.0.0-rc.0|=2.1.0|=2.1.1|=2.2.0|=2.3.0|=2.4.0|=2.4.1|=v2.4.0|=v2.3.0|=v2.2.0|=v2.1.1|=v2.1.0|=v2.0.0|=v1.9.0-rc.0|=v2.0.0-rc.0|=v1.8.1|=v1.8.0|=v1.7.0|=v1.6.0|=v1.5.0|=v1.4.1|=v1.4.0|=v1.3.1|=v1.3.0|=v1.2.0|=v1.1.2|=v1.1.1|=v1.1.0|=v1.0.1|=v1.0.0|=v0.2.5|=v0.2.4|=v0.2.3|=v0.2.2|=v0.2.1|=v0.2.0|=v0.1.2|=v0.1.1|=v0.1.0","fixed_version":"6a523f3a73b8c9974540e21c7aa88f1258bb35ae","source":"osv","published_at":"2026-05-07T14:04:47.222Z","in_kev":false,"epss_prob":0.00321,"epss_percentile":0.24542,"threat_tier":"theoretical"}],"actively_exploited_count":0,"likely_exploited_count":0},"versions":{"latest":"3.1.1","total_count":36,"recent":["3.1.1","3.1.0","3.0.0","2.4.1","2.4.0","2.3.0","2.2.0","2.1.1","2.1.0","2.0.0","2.0.0-rc.0","1.9.0","1.9.0-rc.0","1.8.1","1.8.0","1.7.0","1.6.0","1.5.0","1.4.1","1.4.0"]},"metadata":{"deprecated":false,"deprecated_message":null,"maintainers_count":2,"first_published":"2014-04-21T18:22:13.000000Z","last_published":"2026-05-27T12:42:10.349392Z","dependencies_count":0,"dependencies":[]},"github_stats":{"stars":477,"forks":109,"open_issues":0,"is_archived":false,"pushed_at":"2026-07-12T00:28:33Z","subscribers_count":10},"bundle":null,"typescript":null,"known_issues":{"bugs_count":0,"bugs_severity":{},"status_breakdown":{},"link":null,"scope":"none"},"historical_compromise":null,"recommendation":{"action":"safe_to_use","issues":[],"use_version":"3.1.1","version_hint":"Update to >= 6a523f3a73b8c9974540e21c7aa88f1258bb35ae to fix known vulnerabilities","summary":"decimal@3.1.1 is safe to use (health: 83/100)"},"version_scoped":null,"_meta":{"endpoint":"check","tier":"full","philosophy":"DepScope is free. Use the cheapest endpoint that answers your real question.","cheaper_alternatives":[{"endpoint":"/api/exists/hex/decimal","tokens_estimated":12,"use_when":"you only need to know if the package exists (hallucination guard)"},{"endpoint":"/api/health/hex/decimal","tokens_estimated":80,"use_when":"you only need a 0-100 score for go/no-go (>=70 = safe)"},{"endpoint":"/api/prompt/hex/decimal","tokens_estimated":280,"use_when":"you want a plain-text LLM-friendly brief instead of JSON"},{"endpoint":"POST /api/check_bulk","tokens_estimated":60,"use_when":"you have 5+ packages to check; sends one round-trip instead of N"}],"docs":"https://depscope.dev/integrate","hint_bulk":"You've called /api/check 30 times in 60s. Save bandwidth + tokens with POST /api/check_bulk (1 round-trip for N pkgs)."},"requested_version":null,"_cache":"hit","_response_ms":0,"_powered_by":"depscope.dev — free package intelligence for AI agents","typosquat":{"is_suspected":false},"maintainer_trust":{"available":true,"bus_factor_3m":4,"active_contributors_12m":5,"primary_author_ratio":0.5333333333333333,"owner_account_age_days":5874,"is_archived":false,"stars":477,"alerts":[]},"malicious":{"is_malicious":false},"scorecard":{"available":true,"score":3.6,"tier":"weak"},"quality":{"available":false},"breaking_changes_link":{"url":"/api/breaking/hex/decimal","count":14,"hint":"Use this endpoint to get version-pair breaking changes + migration hints."},"version_history_summary":{"total_versions":20,"first_release_age_days":4484,"last_release_days_ago":65,"avg_days_between_releases":236,"release_velocity":"active"}}