pm2 npm Security Score: 76/100

npm publisher

Single point of failure

downloads/week

Blast radius if compromised

13.0y

package age

Established package

41 days ago

last release

Active maintenance

Risk analysis

pm2 is flagged HIGH risk due to rapid adoption with limited publisher depth. New packages with fast growth are higher-risk targets.

Publisher depth — How many people can push to npm? Single-publisher packages are the #1 structural risk.
Longevity — Older packages have track records. New packages with high adoption are higher risk.
Release consistency — Regular releases signal active oversight. Long gaps mean unpatched vulnerabilities.
Download trend — Growing packages attract more scrutiny (and more attacks).
OpenSSF Scorecard — Process security: branch protection, code review, CI/CD safety.

You came looking for pm2. Your node_modules has hundreds more. Run one command to score every dependency you ship:

npx proof-of-commitment

Auto-detects your lockfile. Scores every dependency. Zero install.

![Commit Trust](https://getcommit.dev/badge/npm/pm2)