Is metalsmith safe to use?

metalsmith has no known vulnerabilities on the latest version (2.7.0). DepScope rates its health at 75/100 (moderate risk).

What is the latest version of metalsmith?

The latest version of metalsmith is 2.7.0, released 2026-02-09.

Does metalsmith have known vulnerabilities?

No known vulnerabilities on the latest version of metalsmith.

Is metalsmith deprecated?

No, metalsmith is actively maintained. Latest release: 2.7.0 (2026-02-09).

What are alternatives to metalsmith?

Popular alternatives to metalsmith in npm include: semver, ansi-styles, debug, minimatch, brace-expansion.

What license does metalsmith use?

metalsmith is licensed under MIT.

metalsmith

npmv2.7.0

An extremely simple, pluggable static site generator.

License MITpermissive51 versions5 maintainers9 deps28,867 weekly dl

metalsmith/metalsmith

/ 100

Health

safe to use

[email protected] is safe to use (health: 75/100)

Health breakdown0 – 100

20/25

maintenance

10/20

popularity

25/25

security

15/15

maturity

5/15

community

Vulnerabilities

none known

Bundle & TypeScript

📦

Bundle Size

56.9 KBminified

19.4 KB gzipped

9 direct dependencies

side effects

🌟

TypeScript

10/10typed

bundled

Health History

Dependency Tree

License Audit

Dependencies (9)

chokidar commander debug gray-matter is-utf8 lodash.clonedeepwith micromatch stat-mode ware

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/metalsmith