{"package":"@builder.io/dev-tools","ecosystem":"npm","latest_version":"1.85.1","description":"Builder.io Visual CMS Devtools","license":"MIT","license_risk":"permissive","commercial_use_notes":"Permissive: commercial closed-source use OK; preserve the copyright notice.","homepage":"https://builder.io/","repository":"","downloads_weekly":14970,"health":{"score":40,"risk":"high","breakdown":{"maintenance":25,"popularity":10,"security":15,"maturity":15,"community":5},"deprecated":false,"max_score":100},"vulnerabilities":{"count":1,"critical":1,"high":0,"medium":0,"low":0,"details":[{"vuln_id":"GHSA-4fm3-j964-p869","severity":"critical","summary":"Malicious code in @builder.io/dev-tools (npm)","affected_versions":"=1.64.2-dev.202606082025.8ce823363","fixed_version":null,"source":"osv","published_at":"2026-06-10T08:27:19Z"}],"actively_exploited_count":0,"likely_exploited_count":0},"versions":{"latest":"1.85.1","total_count":3125,"recent":["1.84.0-beta.202609171705.c8c17e1.add-a-structured-error-code-for-assistan","1.84.0-beta.202609171717.ad31f04.add-request-response-schemas-for-the-new","1.84.0-beta.202609171857.6790eed.add-request-response-schemas-for-the-new","1.84.0-beta.202609181213.7fa2d44.add-request-response-schemas-for-the-new","1.84.0-beta.202609181241.5240043.add-request-response-schemas-for-the-new","1.85.0","1.85.0-beta.202609181459.953a127.refresh-the-origin-url-before-corrupt-gi","1.85.0-beta.202609181614.ca64494.reject-figma-com-urls-in-the-pullprototy","1.85.1","1.85.1-beta.202609181955.0b8174d.add-shared-system-one-jev-request-and-re","1.85.1-beta.202609182012.bb3ea4e.add-shared-system-one-jev-request-and-re","1.85.1-beta.202609211155.0b668f5.add-shared-system-one-jev-request-and-re","1.85.1-beta.202609211444.b6025a7.add-shared-system-one-jev-request-and-re","1.85.1-beta.202609211532.49e73d9.add-dsitier-and-dsitierlimitresponse-typ","1.86.0-beta.202609211540.c43db5e.add-dsitier-and-dsitierlimitresponse-typ","1.86.0-beta.202609211623.d71915d.add-dsitier-and-dsitierlimitresponse-typ","1.86.0-beta.202609211631.5aea7ab.add-dsitier-and-dsitierlimitresponse-typ","1.86.0-beta.202609211654.0225f25.add-dsitier-and-dsitierlimitresponse-typ","1.86.0-beta.202609211713.43e60e2.add-dsitier-and-dsitierlimitresponse-typ","1.86.0-beta.202609211822.cd026f4.add-dsitier-and-dsitierlimitresponse-typ"]},"metadata":{"deprecated":false,"deprecated_message":null,"maintainers_count":23,"first_published":"2023-06-03T16:14:03.982Z","last_published":"2026-09-18T16:46:52.209Z","dependencies_count":30,"dependencies":["ws","zod","glob","open","ignore","undici","express","prompts","chokidar","get-port","prettier","@types/ws","bufferutil","micromatch","strip-ansi","typescript","detect-port","@sentry/node","cli-progress","http-proxy-3","pac-resolver","@babel/parser","cookie-parser","launch-editor","@clack/prompts","utf-8-validate","urlpattern-polyfill","@amplitude/analytics-node","@tootallnate/quickjs-emscripten","@netlify/serverless-functions-api"]},"github_stats":null,"bundle":null,"typescript":{"score":10,"has_types":true,"types_source":"bundled","types_package":null},"known_issues":{"bugs_count":0,"bugs_severity":{},"status_breakdown":{},"link":null,"scope":"none"},"historical_compromise":null,"recommendation":{"action":"do_not_use","issues":["Moderate health score (40/100) — verify manually","1 critical vulnerabilities"],"use_version":"1.85.1","version_hint":null,"summary":"@builder.io/dev-tools has critical vulnerabilities — do not use"},"version_scoped":null,"_meta":{"endpoint":"check","tier":"full","philosophy":"DepScope is free. Use the cheapest endpoint that answers your real question.","cheaper_alternatives":[{"endpoint":"/api/exists/npm/%40builder.io%2Fdev-tools","tokens_estimated":12,"use_when":"you only need to know if the package exists (hallucination guard)"},{"endpoint":"/api/health/npm/%40builder.io%2Fdev-tools","tokens_estimated":80,"use_when":"you only need a 0-100 score for go/no-go (>=70 = safe)"},{"endpoint":"/api/prompt/npm/%40builder.io%2Fdev-tools","tokens_estimated":280,"use_when":"you want a plain-text LLM-friendly brief instead of JSON"},{"endpoint":"POST /api/check_bulk","tokens_estimated":60,"use_when":"you have 5+ packages to check; sends one round-trip instead of N"}],"docs":"https://depscope.dev/integrate","hint_bulk":"You've called /api/check 91 times in 60s. Save bandwidth + tokens with POST /api/check_bulk (1 round-trip for N pkgs)."},"requested_version":null,"_cache":"hit","_response_ms":0,"_powered_by":"depscope.dev — free package intelligence for AI agents","typosquat":{"is_suspected":false},"maintainer_trust":{"available":false},"malicious":{"is_malicious":false,"advisory_id":"MAL-2026-5493","summary":"Malicious code in @builder.io/dev-tools (npm)","action":"use_with_caution","affected_versions":["1.64.2-dev.202606082025.8ce823363"],"latest_version_safe":true,"note":"Advisory MAL-2026-5493: versions 1.64.2-dev.202606082025.8ce823363 are compromised. Current latest (1.85.1) is safe."},"scorecard":{"available":false},"quality":{"available":false},"version_history_summary":{"total_versions":20,"first_release_age_days":null,"last_release_days_ago":3,"avg_days_between_releases":null,"release_velocity":"active"}}