npm Trust Rankings — 217 Most-Downloaded Packages by Trust Score

Rank ↕	Package	Downloads/wk ↕	Trust Score ↓	Risk Level ↕	Maintainers ↕	Age ↕
#1	semver	793M	91	SAFE	4	15.4y
#2	ansi-styles	670M	74	CRITICAL	1	12.9y
#3	minimatch	660M	78	CRITICAL	1	14.9y
#4	debug	644M	76	SAFE	2	14.6y
#5	strip-ansi	580M	70	CRITICAL	1	12.5y
#6	string-width	515M	73	CRITICAL	1	10.9y
#7	lru-cache	501M	81	CRITICAL	1	14.9y
#8	ms	496M	83	SAFE	6	14.5y
#9	supports-color	453M	75	CRITICAL	1	12y
#10	chalk	449M	75	CRITICAL	1	12.9y
#11	commander	442M	86	SAFE	2	14.9y
#12	wrap-ansi	437M	71	CRITICAL	1	10.8y
#13	picomatch	404M	77	SAFE	4	7.6y
#14	glob	387M	76	CRITICAL	1	15.5y
#15	tslib	385M	83	SAFE	7	11.5y
#16	@types/node	372M	85	CRITICAL	1	10.1y
#17	color-name	339M	75	SAFE	3	11.6y
#18	color-convert	334M	74	CRITICAL	1	15y
#19	which	329M	84	SAFE	4	14.9y
#20	source-map	329M	80	SAFE	24	14.8y
#21	ajv	327M	83	SAFE	2	11.1y
#22	readable-stream	316M	80	SAFE	3	13.9y
#23	escape-string-regexp	312M	67	CRITICAL	1	12y
#24	yallist	299M	61	CRITICAL	1	10.5y
#25	glob-parent	298M	72	SAFE	4	11.4y
#26	has-flag	291M	59	CRITICAL	1	11y
#27	p-limit	285M	71	CRITICAL	1	9.7y
#28	locate-path	278M	70	CRITICAL	1	9.6y
#29	p-locate	277M	67	CRITICAL	1	9.6y
#30	safe-buffer	274M	65	SAFE	2	10.4y
#31	uuid	274M	83	SAFE	2	15.2y
#32	json-schema-traverse	273M	59	CRITICAL	1	9y
#33	signal-exit	271M	68	SAFE	2	11.1y
#34	agent-base	253M	81	CRITICAL	1	13y
#35	postcss	248M	81	CRITICAL	1	12.6y
#36	esbuild	243M	87	CRITICAL	1	8.6y
#37	https-proxy-agent	241M	81	CRITICAL	1	13y
#38	cross-spawn	232M	70	CRITICAL	1	12y
#39	isarray	232M	64	CRITICAL	1	13.1y
#40	string_decoder	230M	72	SAFE	4	12.5y
#41	ws	221M	84	SAFE	4	14.5y
#42	typescript	217M	94	SAFE	7	13.7y
#43	yargs	213M	81	SAFE	3	12.6y
#44	zod	203M	83	CRITICAL	1	6.3y
#45	fs-extra	195M	82	SAFE	3	14.6y
#46	graceful-fs	190M	70	CRITICAL	1	14.9y
#47	chokidar	189M	78	CRITICAL	1	14.2y
#48	inherits	180M	62	CRITICAL	1	15.2y
#49	form-data	173M	84	SAFE	6	15.1y
#50	is-glob	167M	67	SAFE	3	11.5y
#51	qs	165M	80	SAFE	2	15.4y
#52	braces	164M	71	SAFE	2	11.7y
#53	fill-range	163M	76	SAFE	3	11.6y
#54	micromatch	159M	77	SAFE	3	11.6y
#55	lodash	158M	80	CRITICAL	1	14.2y
#56	node-fetch	158M	79	SAFE	5	11.4y
#57	@babel/core	156M	90	SAFE	4	8.6y
#58	http-proxy-agent	148M	76	CRITICAL	1	13y
#59	rimraf	148M	73	CRITICAL	1	15.4y
#60	fast-glob	148M	72	CRITICAL	1	9.5y
#61	react	147M	90	SAFE	2	14.7y
#62	dotenv	146M	84	SAFE	3	13y
#63	mkdirp	146M	65	CRITICAL	1	15.5y
#64	execa	143M	76	SAFE	2	10.5y
#65	vite	141M	89	SAFE	2	6.2y
#66	eslint	141M	89	SAFE	2	13y
#67	react-dom	138M	90	SAFE	2	12.1y
#68	undici	133M	91	SAFE	3	7.9y
#69	@types/react	133M	85	CRITICAL	1	10.1y
#70	minimist	132M	74	SAFE	3	13y
#71	once	130M	63	CRITICAL	1	13.9y
#72	rollup	124M	92	SAFE	5	11.1y
#73	axios	124M	90	CRITICAL	1	11.8y
#74	tailwindcss	121M	94	SAFE	3	8.7y
#75	body-parser	119M	83	SAFE	4	12.5y
#76	prettier	117M	91	SAFE	11	9.4y
#77	serve-static	112M	78	SAFE	3	12.3y
#78	express	110M	90	SAFE	5	15.5y
#79	@types/react-dom	105M	81	CRITICAL	1	10.1y
#80	async	95M	79	SAFE	5	15.5y
#81	rxjs	93M	80	SAFE	3	14.3y
#82	date-fns	91M	71	CRITICAL	1	11.7y
#83	jose	87M	86	CRITICAL	1	12.3y
#84	chai	84M	84	CRITICAL	1	14.5y
#85	jsdom	78M	88	SAFE	6	14.6y
#86	ora	77M	77	CRITICAL	1	10.3y
#87	typescript-eslint	76M	90	SAFE	2	6.9y
#88	vitest	71M	89	SAFE	5	4.5y
#89	terser	70M	79	CRITICAL	1	8.1y
#90	jest-mock	68M	92	SAFE	5	10.3y
#91	sharp	66M	87	CRITICAL	1	12.8y
#92	playwright	63M	91	SAFE	4	11.4y
#93	autoprefixer	62M	81	CRITICAL	1	13.2y
#94	cors	61M	76	SAFE	3	13.4y
#95	dayjs	58M	87	CRITICAL	1	8.2y
#96	immer	54M	83	SAFE	2	9.7y
#97	webpack	51M	93	SAFE	8	14.3y
#98	@testing-library/jest-dom	51M	85	SAFE	17	7y
#99	bluebird	50M	75	CRITICAL	1	12.7y
#100	jsonwebtoken	49M	78	SAFE	3	13y
#101	react-router	49M	91	SAFE	2	12.4y
#102	hono	48M	81	CRITICAL	1	4.5y
#103	inquirer	47M	92	SAFE	3	13.1y
#104	jest	46M	92	SAFE	5	14.3y
#105	@testing-library/react	45M	87	SAFE	17	7.1y
#106	zustand	43M	90	SAFE	3	7.2y
#107	react-router-dom	43M	91	SAFE	2	9.5y
#108	next	42M	93	SAFE	4	14.9y
#109	@babel/preset-env	41M	90	SAFE	4	8.6y
#110	graphql	41M	93	SAFE	6	11.4y
#111	handlebars	40M	82	SAFE	6	14.8y
#112	rc	39M	78	SAFE	9	13.9y
#113	@modelcontextprotocol/sdk	39M	74	SAFE	6	1.6y
#114	lodash-es	39M	82	SAFE	3	11.4y
#115	cheerio	37M	79	SAFE	2	14.7y
#116	compression	37M	79	SAFE	3	12.5y
#117	pino	37M	84	SAFE	4	10.3y
#118	got	37M	83	CRITICAL	1	12.2y
#119	@swc/core	37M	88	CRITICAL	1	7.3y
#120	node-forge	36M	83	SAFE	3	13y
#121	redux	36M	84	SAFE	6	14.7y
#122	moment	35M	77	SAFE	5	14.7y
#123	ejs	34M	81	CRITICAL	1	15.3y
#124	pg	34M	82	CRITICAL	1	15.5y
#125	luxon	33M	77	SAFE	2	9.1y
#126	@aws-sdk/client-s3 ↑ trending	32M	92	SAFE	2	6.4y
#127	tweetnacl	32M	68	CRITICAL	1	12y
#128	archiver	31M	77	CRITICAL	1	13.7y
#129	sass	30M	86	SAFE	2	9y
#130	ua-parser-js	29M	82	CRITICAL	1	13.9y
#131	openai	26M	88	SAFE	20	6y
#132	@babel/preset-react	26M	90	SAFE	4	8.6y
#133	underscore	25M	74	SAFE	2	15.4y
#134	winston	25M	86	SAFE	8	15.4y
#135	@anthropic-ai/sdk ↑ trending	24M	89	SAFE	13	3.4y
#136	preact	23M	90	SAFE	6	10.8y
#137	joi	23M	87	SAFE	6	13.8y
#138	@reduxjs/toolkit	23M	94	SAFE	6	6.6y
#139	ioredis	23M	86	SAFE	2	11.2y
#140	superagent	21M	83	SAFE	7	14.8y
#141	cross-env	21M	70	CRITICAL	1	10.7y
#142	@tanstack/react-router ↑ trending	20M	80	CRITICAL	1	3.7y
#143	concurrently	18M	84	SAFE	2	11.4y
#144	multer	18M	88	SAFE	5	12.4y
#145	crypto-js	18M	67	CRITICAL	1	13.1y
#146	turbo	17M	90	SAFE	2	13.1y
#147	ai	15M	98	SAFE	5	12.3y
#148	supertest	15M	80	SAFE	6	14y
#149	socket.io	15M	85	SAFE	2	15.5y
#150	unzipper	15M	82	CRITICAL	1	10y
#151	request	15M	78	SAFE	4	15.4y
#152	mocha	14M	89	SAFE	2	14.6y
#153	q	14M	68	SAFE	2	15.5y
#154	vue	14M	88	SAFE	2	12.5y
#155	ramda	14M	81	SAFE	8	12.1y
#156	@google-cloud/storage	14M	86	CRITICAL	1	9.9y
#157	prisma	14M	88	SAFE	2	10y
#158	nodemon	13M	81	CRITICAL	1	15.4y
#159	helmet	13M	81	SAFE	2	14.4y
#160	yup	12M	77	CRITICAL	1	11.7y
#161	morgan	12M	82	SAFE	3	12.4y
#162	mysql2	12M	87	CRITICAL	1	13.2y
#163	@nestjs/common ↑ trending	12M	89	CRITICAL	1	9.1y
#164	papaparse	12M	81	SAFE	2	11.6y
#165	drizzle-orm	12M	79	SAFE	4	4.8y
#166	xlsx	12M	71	CRITICAL	1	12.5y
#167	@nestjs/core ↑ trending	11M	89	CRITICAL	1	9.1y
#168	bcryptjs	11M	73	CRITICAL	1	13.1y
#169	redis	11M	92	SAFE	5	15.5y
#170	less	11M	96	SAFE	5	15.4y
#171	puppeteer	11M	74	SAFE	2	13.2y
#172	sinon	11M	85	SAFE	4	15.5y
#173	class-validator	10M	78	SAFE	2	10.2y
#174	cookie-parser	10M	74	SAFE	3	12.3y
#175	stylelint	10M	90	SAFE	4	11.5y
#176	aws-sdk	9M	70	SAFE	2	13.5y
#177	fastify	8M	92	SAFE	5	9.7y
#178	firebase	8M	88	SAFE	4	14.3y
#179	log4js	8M	78	SAFE	2	15.4y
#180	@ai-sdk/openai ↑ trending	8M	86	SAFE	3	2.2y
#181	better-sqlite3	8M	86	HIGH	1	9.8y
#182	koa	8M	88	SAFE	11	12.6y
#183	passport	8M	70	HIGH	1	14.7y
#184	cypress	7M	87	SAFE	2	12.3y
#185	@ai-sdk/anthropic ↑ trending	7M	86	SAFE	3	2.2y
#186	@apollo/client	7M	90	SAFE	4	6.8y
#187	nock	7M	81	SAFE	4	14.7y
#188	lit	6M	81	SAFE	8	14y
#189	coa	6M	67	SAFE	2	14.9y
#190	mongoose	6M	91	SAFE	3	15.5y
#191	@angular/core	6M	83	SAFE	2	10.1y
#192	event-stream	6M	64	HIGH	1	14.8y
#193	bcrypt	5M	75	SAFE	5	15.3y
#194	@angular/cli	5M	83	SAFE	2	9.4y
#195	jotai	5M	79	SAFE	2	5.9y
#196	@langchain/core ↑ trending	5M	78	SAFE	2	2.6y
#197	svelte	5M	87	SAFE	3	9.6y
#198	typeorm	5M	82	SAFE	2	10.2y
#199	knex	4M	86	SAFE	5	13.1y
#200	mobx	4M	88	SAFE	6	10.3y
#201	pug	4M	62	SAFE	2	12.8y
#202	bunyan	4M	64	HIGH	1	14.4y
#203	pm2	3M	76	HIGH	1	13y
#204	@langchain/openai	3M	75	SAFE	2	2.6y
#205	csv-parser	3M	75	SAFE	4	12.1y
#206	sequelize	3M	80	SAFE	9	15.1y
#207	solid-js	3M	76	HIGH	1	8.2y
#208	@apollo/server	3M	86	SAFE	6	6.8y
#209	langchain	2M	75	SAFE	2	3.3y
#210	node-ipc	849K	64	SAFE	1	12.3y
#211	recoil	448K	64	SAFE	3	6.1y
#212	parcel	413K	70	SAFE	1	13.1y
#213	chalk-animation	391K	55	SAFE	1	8.9y
#214	x402	279K	54	SAFE	2	1.3y
#215	llamaindex	116K	54	SAFE	2	2.9y
#216	hapi	67K	70	SAFE	4	14.9y
#217	nestjs	17K	40	SAFE	1	10.5y

Trust Score measures behavioral commitment signals: publish frequency, maintainer depth, download momentum, and age. It does not scan for malicious code — use Socket for that. How Commit compares to other tools →

We scored the 217 most-downloaded
npm packages. Here's what we found.

Audit your own dependencies

We scored the 217 most-downloaded npm packages. Here's what we found.

Audit your own dependencies

We scored the 217 most-downloaded
npm packages. Here's what we found.