Is pacote safe to use?

pacote has no known vulnerabilities on the latest version (22.0.0). DepScope rates its health at 86/100 (low risk).

What is the latest version of pacote?

The latest version of pacote is 22.0.0, released 2026-06-15.

Does pacote have known vulnerabilities?

No known vulnerabilities on the latest version of pacote.

Is pacote deprecated?

No, pacote is actively maintained. Latest release: 22.0.0 (2026-06-15).

What are alternatives to pacote?

Popular alternatives to pacote in npm include: ?, ansi-styles, semver, brace-expansion, ms.

pacote

npmv22.0.0

JavaScript package downloader

License ISCpermissive238 versions3 maintainers17 deps13,810,001 weekly dl

npm/pacote

/ 100

Health

safe to use

[email protected] is safe to use (health: 86/100)

Health breakdown0 – 100

20/25

maintenance

20/20

popularity

25/25

security

15/15

maturity

6/15

community

0/15

popularity_floor

Vulnerabilities

none known

Bundle & TypeScript

🌟

TypeScript

7/10typed

Types from @types/pacote (DefinitelyTyped)

Quality signals

OSS Criticality

0.77critical

Download trend

stable(0%)

Publish security

npm attested

Health History

Dependency Tree

License Audit

Dependencies (17)

tar ssri cacache minipass proc-log sigstore @npmcli/git fs-minipass npm-packlist npm-package-arg npm-pick-manifest @gar/promise-retry @npmcli/run-script npm-registry-fetch @npmcli/package-json @npmcli/promise-spawn @npmcli/installed-package-contents

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/pacote