Is string-math safe to use?

string-math has 1 known vulnerabilities on the latest version (1.2.2). DepScope rates its health at 45/100 (high risk).

What is the latest version of string-math?

The latest version of string-math is 1.2.2, released 2020-08-18.

Does string-math have known vulnerabilities?

Yes. string-math has 1 known vulnerabilities. See depscope.dev/pkg/npm/string-math for details.

Is string-math deprecated?

No, string-math is actively maintained. Latest release: 1.2.2 (2020-08-18).

What are alternatives to string-math?

Popular alternatives to string-math in npm include: semver, debug, ansi-styles, minimatch, brace-expansion.

What license does string-math use?

string-math is licensed under MIT.

string-math

npmv1.2.2

Evaluates the result of the String arithmetical expression

License MITpermissive3 versions1 maintainers0 deps4,582 weekly dl

devrafalko/string-math

/ 100

Health

use with caution

[email protected] low health (45/100) — consider alternatives

Moderate health score (45/100) — verify manually

Health breakdown0 – 100

0/25

maintenance

6/20

popularity

25/25

security

12/15

maturity

2/15

community

Vulnerabilities

1 low

Advisories (1)

Severity	ID	Summary	Fixed in
low	CVE-2025-45143	string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)	—

Bundle & TypeScript

📦

Bundle Size

1.2 KBminified

0.5 KB gzipped

0 direct dependencies

side effects

🌟

TypeScript

7/10typed

Types from @types/string-math (DefinitelyTyped)

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/string-math