Is @pixiv/three-vrm safe to use?

@pixiv/three-vrm has no known vulnerabilities on the latest version (3.5.2). DepScope rates its health at 75/100 (moderate risk).

What is the latest version of @pixiv/three-vrm?

The latest version of @pixiv/three-vrm is 3.5.2, released 2026-04-16.

Does @pixiv/three-vrm have known vulnerabilities?

No known vulnerabilities on the latest version of @pixiv/three-vrm.

Is @pixiv/three-vrm deprecated?

No, @pixiv/three-vrm is actively maintained. Latest release: 3.5.2 (2026-04-16).

What are alternatives to @pixiv/three-vrm?

Popular alternatives to @pixiv/three-vrm in npm include: minimatch, chalk, commander, picomatch, eslint-visitor-keys.

What license does @pixiv/three-vrm use?

@pixiv/three-vrm is licensed under MIT.

@pixiv/three-vrm

npmv3.5.2

VRM file loader for three.js.

License MITpermissive123 versions6 maintainers6 deps

pixiv/three-vrm

/ 100

Health

safe to use

@pixiv/[email protected] is safe to use (health: 75/100)

Health breakdown0 – 100

25/25

maintenance

0/20

popularity

25/25

security

15/15

maturity

10/15

community

Vulnerabilities

none known

Bundle & TypeScript

📦

Bundle Size

147.4 KBminified

34.6 KB gzipped

6 direct dependencies

side effectsscoped

🌟

TypeScript

10/10typed

bundled

Health History

Dependency Tree

License Audit

Dependencies (6)

@pixiv/three-vrm-core @pixiv/three-vrm-materials-hdr-emissive-multiplier @pixiv/three-vrm-materials-mtoon @pixiv/three-vrm-materials-v0compat @pixiv/three-vrm-node-constraint @pixiv/three-vrm-springbone

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/@pixiv/three-vrm