01tek/npm-security-score
World-class security scoring system for npm packages
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Nov 28, 2025
- License
- MIT
Pinned Snippet
uses: 01tek/npm-security-score@a9a632fbc21b38baf7420fb9624c8ef375ae877b # v0.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| package | Package name to score (or path to package.json for dependency scanning) | no | package.json |
| fail-below | Fail if score is below this threshold | no | 70 |
| config | Path to config file | no | — |
| github-token | GitHub token for PR comments (optional) | no | — |
| comment-on-pr | Comment on PR with results | no | true |
| json-output | Output results as JSON | no | false |
| verbose | Verbose output | no | false |
Outputs
| name | description |
|---|---|
| score | Security score (0-100) |
| band | Score band (SAFE, REVIEW, HIGH_RISK, BLOCK) |
| passed | Whether the check passed |
| report | Full JSON report |