CRA Index / npm
CRA Index: npm packages
200 popular npm packages and how many of nine public security signals are in place for each. The signals map to what the Cyber Resilience Act asks manufacturers to know about the components they ship.
| Package | Version | Signals | Advisories | Scorecard |
|---|---|---|---|---|
| react-is | 19.3.0 | 4 of 4 | 0 | n/a |
| lodash | 4.18.1 | 7 of 9 | 0 | 7.5 |
| @types/estree | 1.0.9 | 6 of 9 | 0 | 6.5 |
| @types/node | 26.6.4 | 6 of 9 | 0 | 6.5 |
| @jest/types | 30.5.1 | 3 of 3 | 0 | n/a |
| pretty-format | 30.5.1 | 3 of 3 | 0 | n/a |
| @babel/compat-data | 8.0.5 | 8 of 9 | 0 | 7.2 |
| @babel/core | 8.0.6 | 8 of 9 | 0 | 7.2 |
| @babel/generator | 8.0.6 | 8 of 9 | 0 | 7.2 |
| @babel/helper-compilation-targets | 8.0.6 | 8 of 9 | 0 | 7.2 |
| @babel/helper-module-imports | 7.29.7 | 8 of 9 | 0 | 7.2 |
| @babel/helper-module-transforms | 8.0.6 | 8 of 9 | 0 | 7.2 |
| @babel/helper-plugin-utils | 8.0.1 | 8 of 9 | 0 | 7.2 |
| @babel/helper-string-parser | 8.0.6 | 8 of 9 | 0 | 7.2 |
| @babel/helper-validator-identifier | 8.0.6 | 8 of 9 | 0 | 7.2 |
| @babel/helpers | 8.0.5 | 8 of 9 | 0 | 7.2 |
| @babel/parser | 7.29.9 | 8 of 9 | 0 | 7.2 |
| @babel/runtime | 8.0.5 | 8 of 9 | 0 | 7.2 |
| @babel/template | 7.29.7 | 8 of 9 | 0 | 7.2 |
| @babel/types | 8.0.6 | 8 of 9 | 0 | 7.2 |
| @esbuild/linux-x64 | 0.28.2 | 5 of 9 | 0 | 5 |
| esbuild | 0.28.2 | 5 of 9 | 0 | 5 |
| postcss | 8.5.29 | 8 of 9 | 0 | 7.5 |
| commander | 15.0.0 | 8 of 9 | 0 | 7.5 |
| eslint | 10.12.0 | 6 of 9 | 0 | 6.3 |
| nanoid | 6.0.1 | 8 of 9 | 0 | 6.5 |
| chalk | 6.0.1 | 5 of 9 | 0 | 4.6 |
| ws | 8.22.0 | 6 of 9 | 0 | 5.5 |
| dotenv | 18.0.5 | 5 of 9 | 0 | 4.6 |
| @radix-ui/react-primitive | 2.1.10 | 5 of 9 | 0 | 4.2 |
| type-fest | 5.10.0 | 6 of 9 | 0 | 5.4 |
| uuid | 14.0.2 | 6 of 9 | 0 | 4.4 |
| ajv | 8.20.0 | 5 of 9 | 0 | 4.8 |
| browserslist | 4.29.3 | 7 of 9 | 0 | 6.5 |
| chokidar | 5.0.0 | 5 of 9 | 0 | 5.3 |
| yargs | 18.2.0 | 6 of 9 | 0 | 6.8 |
| debug | 4.4.3 | 3 of 8 | 0 | 2.6 |
| acorn | 8.19.0 | 5 of 9 | 0 | 4.9 |
| fs-extra | 11.4.1 | 5 of 9 | 0 | 5.1 |
| qs | 6.16.0 | 5 of 9 | 0 | 5.4 |
| node-fetch | 3.3.2 | 5 of 9 | 0 | 4.9 |
| glob | 13.0.6 | 5 of 9 | 0 | 5 |
| path-to-regexp | 8.4.2 | 6 of 9 | 0 | 6.2 |
| undici-types | 8.11.2 | 8 of 9 | 0 | 8.1 |
| execa | 10.0.1 | 5 of 9 | 0 | 4.4 |
| json5 | 2.2.3 | 4 of 8 | 0 | 3.8 |
| js-yaml | 5.4.2 | 6 of 9 | 0 | 6 |
| lru-cache | 11.5.3 | 4 of 9 | 0 | 4.1 |
| rimraf | 6.1.3 | 5 of 9 | 0 | 4.5 |
| ms | 2.1.3 | 5 of 9 | 0 | 5 |
| semver | 7.8.5 | 8 of 9 | 0 | 6.4 |
| source-map | 0.8.0 | 5 of 9 | 0 | 5.2 |
| eventemitter3 | 5.0.4 | 3 of 9 | 0 | 2.9 |
| minimatch | 10.2.6 | 5 of 9 | 0 | 5.6 |
| keyv | 5.6.0 | 6 of 9 | 0 | 7.1 |
| iconv-lite | 0.7.3 | 3 of 3 | 0 | n/a |
| micromatch | 4.0.8 | 4 of 9 | 0 | 3.7 |
| jiti | 2.7.0 | 4 of 9 | 0 | 4.4 |
| p-limit | 7.3.3 | 4 of 9 | 0 | 3.7 |
| fast-glob | 3.3.3 | 5 of 9 | 0 | 4.9 |
| magic-string | 1.4.3 | 6 of 9 | 0 | 4.5 |
| eslint-scope | 9.1.2 | 4 of 4 | 0 | n/a |
| eslint-visitor-keys | 5.0.1 | 4 of 4 | 0 | n/a |
| espree | 11.2.0 | 4 of 4 | 0 | n/a |
| form-data | 4.0.6 | 5 of 9 | 0 | 5.4 |
| mime | 4.1.0 | 3 of 9 | 0 | 3.9 |
| fast-deep-equal | 3.1.3 | 3 of 8 | 0 | 2.3 |
| file-entry-cache | 11.1.5 | 4 of 4 | 0 | n/a |
| flat-cache | 6.1.23 | 4 of 4 | 0 | n/a |
| emoji-regex | 11.0.0 | 4 of 9 | 0 | 3.3 |
| buffer | 6.0.3 | 3 of 9 | 0 | 3.7 |
| csstype | 3.2.3 | 3 of 9 | 0 | 3.4 |
| picocolors | 1.1.1 | 3 of 9 | 0 | 3.2 |
| fdir | 6.5.0 | 3 of 9 | 0 | 3.3 |
| yaml | 2.9.1 | 8 of 9 | 0 | 8 |
| punycode | 2.3.1 | 3 of 9 | 0 | 3.2 |
| http-errors | 2.0.1 | 7 of 9 | 0 | 6.8 |
| cookie | 2.0.1 | 8 of 9 | 0 | 8.2 |
| pify | 6.1.0 | 4 of 9 | 0 | 3.8 |
| mime-types | 3.0.2 | 7 of 9 | 0 | 6.4 |
| tslib | 2.8.1 | 6 of 9 | 0 | 6.9 |
| graceful-fs | 4.2.11 | 4 of 9 | 0 | 3.4 |
| picomatch | 4.0.7 | 7 of 9 | 0 | 6.7 |
| mime-db | 1.54.0 | 6 of 9 | 0 | 5.8 |
| cross-spawn | 7.0.6 | 3 of 9 | 0 | 3.2 |
| agent-base | 9.0.0 | 4 of 9 | 0 | 2.8 |
| http-proxy-agent | 9.1.0 | 4 of 9 | 0 | 2.8 |
| https-proxy-agent | 9.1.0 | 4 of 9 | 0 | 2.8 |
| flatted | 3.4.4 | 5 of 9 | 0 | 4.3 |
| fastq | 1.20.3 | 5 of 9 | 0 | 4.2 |
| readable-stream | 4.7.0 | 5 of 9 | 0 | 5 |
| estraverse | 5.3.0 | 3 of 8 | 0 | 2.6 |
| object-assign | 4.1.1 | 4 of 9 | 0 | 3.7 |
| update-browserslist-db | 1.3.3 | 6 of 9 | 0 | 5.5 |
| color-convert | 3.1.3 | 3 of 9 | 0 | 3.3 |
| jsesc | 3.1.0 | 3 of 8 | 0 | 2.1 |
| resolve | 1.22.12 | 6 of 9 | 0 | 6 |
| camelcase | 9.0.0 | 4 of 9 | 0 | 3.7 |
| minimist | 1.2.8 | 5 of 9 | 0 | 5.3 |
| find-up | 8.0.0 | 4 of 9 | 0 | 3.7 |
| strip-json-comments | 5.0.3 | 4 of 9 | 0 | 3.7 |
| caniuse-lite | 1.0.30001814 | 5 of 9 | 0 | 4.6 |
| fast-levenshtein | 3.0.0 | 3 of 8 | 0 | 2.1 |
| globals | 17.13.0 | 5 of 9 | 0 | 4.8 |
| escape-string-regexp | 5.0.0 | 4 of 9 | 0 | 3.7 |
| js-tokens | 10.0.0 | 3 of 9 | 0 | 2.9 |
| tinyglobby | 0.2.17 | 4 of 4 | 0 | n/a |
| string-width | 8.3.0 | 4 of 9 | 0 | 3.9 |
| yargs-parser | 22.0.0 | 4 of 9 | 0 | 4.8 |
| argparse | 3.0.2 | 5 of 9 | 0 | 5.3 |
| ignore | 7.0.12 | 3 of 9 | 0 | 3.3 |
| strip-ansi | 7.2.0 | 4 of 9 | 0 | 3.7 |
| ansi-styles | 7.0.0 | 4 of 9 | 0 | 4 |
| yocto-queue | 1.2.2 | 4 of 9 | 0 | 3.6 |
| estree-walker | 3.0.3 | 3 of 8 | 0 | 2.1 |
| readdirp | 5.1.1 | 4 of 9 | 0 | 3.8 |
| whatwg-url | 17.2.0 | 6 of 9 | 0 | 5 |
| cliui | 9.0.1 | 3 of 9 | 0 | 4.4 |
| entities | 8.1.0 | 7 of 9 | 0 | 6.6 |
| negotiator | 1.1.0 | 6 of 9 | 0 | 6.2 |
| supports-color | 11.0.0 | 4 of 9 | 0 | 4.2 |
| get-stream | 9.0.1 | 5 of 9 | 0 | 4.3 |
| kind-of | 6.0.3 | 3 of 8 | 0 | 2.1 |
| inherits | 2.0.4 | 4 of 9 | 0 | 3.6 |
| which | 7.0.0 | 7 of 9 | 0 | 5.7 |
| safe-buffer | 5.2.1 | 3 of 8 | 0 | 2.5 |
| fast-json-stable-stringify | 2.1.0 | 3 of 8 | 0 | 2.2 |
| uri-js | 4.4.1 | 3 of 8 | 0 | 2.4 |
| is-number | 7.0.0 | 3 of 8 | 0 | 2.1 |
| import-fresh | 4.0.1 | 4 of 9 | 0 | 3.7 |
| statuses | 2.0.2 | 7 of 9 | 0 | 6.1 |
| callsites | 4.2.0 | 4 of 9 | 0 | 3.8 |
| minipass | 7.1.3 | 4 of 9 | 0 | 3.4 |
| braces | 3.0.3 | 3 of 9 | 1 | 3.8 |
| brace-expansion | 5.0.12 | 6 of 9 | 0 | 7.2 |
| yallist | 5.0.0 | 4 of 9 | 0 | 3.4 |
| postcss-selector-parser | 7.1.6 | 5 of 9 | 0 | 5.1 |
| ansi-regex | 6.4.0 | 4 of 9 | 0 | 3.8 |
| signal-exit | 4.1.0 | 4 of 9 | 0 | 3.4 |
| mkdirp | 3.0.1 | 4 of 9 | 0 | 3.5 |
| reusify | 1.1.0 | 4 of 9 | 0 | 3.9 |
| to-regex-range | 5.0.1 | 4 of 8 | 0 | 3 |
| convert-source-map | 2.0.0 | 4 of 9 | 0 | 3.9 |
| onetime | 8.0.0 | 4 of 9 | 0 | 3.7 |
| optionator | 0.9.4 | 3 of 8 | 0 | 2.1 |
| object-inspect | 1.13.4 | 4 of 9 | 0 | 4 |
| electron-to-chromium | 1.5.444 | 5 of 9 | 0 | 4.5 |
| escalade | 3.2.0 | 3 of 9 | 0 | 2.9 |
| path-exists | 5.0.0 | 4 of 9 | 0 | 3.7 |
| y18n | 5.0.8 | 3 of 9 | 0 | 4.2 |
| resolve-from | 5.0.0 | 4 of 9 | 0 | 3.7 |
| wrap-ansi | 10.0.2 | 4 of 9 | 0 | 4 |
| function-bind | 1.1.2 | 5 of 9 | 0 | 4.5 |
| balanced-match | 4.0.4 | 6 of 9 | 0 | 5.6 |
| isarray | 2.0.5 | 6 of 9 | 0 | 7.2 |
| color-name | 2.1.1 | 3 of 8 | 0 | 3 |
| is-stream | 4.0.1 | 4 of 9 | 0 | 3.7 |
| normalize-path | 3.0.0 | 3 of 8 | 0 | 2 |
| universalify | 2.0.1 | 3 of 9 | 0 | 2.9 |
| npm-run-path | 6.0.0 | 4 of 9 | 0 | 3.9 |
| imurmurhash | 0.1.4 | 3 of 8 | 0 | 2 |
| json-schema-traverse | 1.0.0 | 3 of 9 | 0 | 3 |
| source-map-js | 1.2.1 | 3 of 9 | 0 | 2.8 |
| is-glob | 4.0.3 | 4 of 9 | 0 | 3.6 |
| has-flag | 5.0.1 | 4 of 9 | 0 | 3.6 |
| levn | 0.4.1 | 3 of 8 | 0 | 2 |
| glob-parent | 6.0.2 | 4 of 9 | 0 | 3.7 |
| p-locate | 7.0.0 | 4 of 9 | 0 | 3.7 |
| detect-libc | 2.1.2 | 5 of 9 | 0 | 3.8 |
| locate-path | 8.0.0 | 4 of 9 | 0 | 3.7 |
| fill-range | 7.1.1 | 4 of 9 | 0 | 3.3 |
| path-parse | 1.0.7 | 3 of 8 | 0 | 2.5 |
| @jridgewell/trace-mapping | 0.3.31 | 3 of 3 | 0 | n/a |
| isexe | 4.0.0 | 5 of 9 | 0 | 4.5 |
| is-fullwidth-code-point | 5.1.0 | 4 of 9 | 0 | 3.8 |
| shebang-regex | 4.0.0 | 4 of 9 | 0 | 3.7 |
| path-key | 4.0.0 | 4 of 9 | 0 | 3.8 |
| path-scurry | 2.0.2 | 5 of 9 | 0 | 4.4 |
| webidl-conversions | 8.0.1 | 5 of 9 | 0 | 4.6 |
| node-releases | 2.0.57 | 5 of 9 | 0 | 4 |
| tr46 | 7.0.0 | 5 of 9 | 0 | 3.8 |
| util-deprecate | 1.0.2 | 3 of 8 | 0 | 2.3 |
| get-intrinsic | 1.3.0 | 4 of 9 | 0 | 3.8 |
| string_decoder | 1.3.0 | 4 of 8 | 0 | 3.4 |
| lines-and-columns | 2.0.4 | 3 of 9 | 0 | 3.1 |
| safer-buffer | 2.1.2 | 3 of 8 | 0 | 2.1 |
| is-core-module | 2.16.2 | 4 of 9 | 0 | 3.8 |
| is-extglob | 2.1.1 | 4 of 8 | 0 | 3 |
| shebang-command | 2.0.0 | 4 of 8 | 0 | 3.1 |
| has-symbols | 1.1.0 | 4 of 9 | 0 | 3.8 |
| @jridgewell/resolve-uri | 3.1.2 | 3 of 9 | 0 | 2.8 |
| es-errors | 1.3.0 | 3 of 3 | 0 | n/a |
| call-bind-apply-helpers | 1.0.2 | 3 of 3 | 0 | n/a |
| es-define-property | 1.0.1 | 3 of 3 | 0 | n/a |
| get-proto | 1.0.1 | 3 of 3 | 0 | n/a |
| hasown | 2.0.4 | 4 of 9 | 0 | 4 |
| math-intrinsics | 1.1.0 | 3 of 3 | 0 | n/a |
| concat-map | 0.0.2 | 4 of 9 | 0 | 3.8 |
| dunder-proto | 1.0.1 | 3 of 3 | 0 | n/a |
| gopd | 1.2.0 | 4 of 9 | 0 | 3.8 |
Sorted by repository stars. Data checked 2026-10-05 from deps.dev (CC BY 4.0) and the OpenSSF Scorecard.
Information generated from your inputs, with article references to Regulation (EU) 2024/2847. It is not legal advice and does not replace your own assessment; check the references against the Official Journal.