</>PackageGraphPackageGraph

is-unsafe

npmv2.0.2TypeScript

Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across HTML, XML, SVG, SQL, SHELL, and REGEX contexts

Safe to adopt

Yes — is-unsafe scores well across adoption, maintenance, weight, supply chain, and licensing. No download data reported for this package yet. Last published 21 days ago. 4 releases in the last 2 years.

  • ?Adoption: grade ?, Not reported by this registry.

    No download data reported for this package yet.

  • AMaintenance: grade A, Excellent.

    Last published 21 days ago. 4 releases in the last 2 years.

  • AWeight: grade A, Excellent.

    Zero runtime dependencies, about 63 KB installed.

  • BSupply chain: grade B, Good.

    This package has a single maintainer (bus factor of 1).

  • ALicense: grade A, Excellent.

    MIT — permissive, with no copyleft found in the dependency tree.

Grades are computed deterministically from registry metadata collected by PackageGraph — downloads, dependents, publish dates, the resolved dependency tree, maintainer count, and declared licenses. No third-party scores are used.

Install cost

What you actually take on by adding is-unsafe to a project.

0
Direct dependencies

Runtime packages this one declares itself.

0
Total installed

Distinct packages in the full runtime tree, deduplicated the way a package manager would.

63 KB
Install size

Unpacked size of this package plus its entire runtime tree.

—
Tree depth

Longest resolved dependency chain below this package.

Compatibility

Node.js
No constraint declared
Module format
ESM + CommonJS
TypeScript
Types included
Install scripts
None

Quick start

A usage example from the is-unsafe README.

xmlFull README ↗
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE urlset [
  <!ENTITY xss '</script><script>alert(document.domain)</script><x y="'>
]>
<urlset>
  <url><loc>https://example.com/&xss;</loc></url>
</urlset>

is-unsafe vs the alternatives

Packages solving a similar problem in the npm ecosystem, compared on the signals that drive an adoption decision.

PackageWeekly downloadsDependentsLicenseLast release
is-unsafethis page01MIT21 days ago
@nodable/entities02MIT1 day ago
fast-xml-parser04MIT1 day ago
dom-serializer94.3M2MIT1 day ago
cheerio24.1M5MIT1 day ago
ssri02ISC1 day ago

Dependencies

Declared by is-unsafe v2.0.2. Runtime dependencies are installed with the package; dev dependencies are not.

Dev (1)

jasmine ^6.3.0

Used by

Popular packages that depend on is-unsafe.

fast-xml-parsernpm

Validate XML, Parse XML, Build XML without C/C++ based libraries

↓ 0/wk◈ 4 dependents⚖ MITTS

Relationship graph

Dependencies (left) and dependents (right) of is-unsafe.

fast-xml-parseris-unsafe
is-unsafe dependencies dependents

Frequently installed together

eslintnpm

An AST-based pattern checker for JavaScript.

↓ 138.4M/wk◈ 279 dependents⚖ MITTS
prettiernpm

Prettier is an opinionated code formatter

↓ 114.2M/wk◈ 159 dependents⚖ MITTS
webpacknpm

Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

↓ 49.8M/wk◈ 29 dependents⚖ MITTS
@nodable/entitiesnpm

Entity parser for XML, HTML, External entites with security and NCR control

↓ 0/wk◈ 2 dependents⚖ MITTS
fast-xml-buildernpm

Build XML from JSON without C/C++ based libraries

↓ 0/wk◈ 1 dependents⚖ MITTS
strnumnpm

Parse String to Number based on configuration

↓ 0/wk◈ 1 dependents⚖ MIT
xml-namingnpm

Validates XML name productions — Name, NCName, QName, NMToken, NMTokens — for XML 1.0 and 1.1

↓ 0/wk◈ 2 dependents⚖ MITTS
@types/nodenpm

TypeScript definitions for node

↓ 0/wk◈ 327 dependents⚖ MITTS
@babel/plugin-transform-runtimenpm

Externalise references to helpers and builtins, automatically polyfilling your code without polluting globals

↓ 0/wk◈ 9 dependents⚖ MIT

Release history

4 releases in the last two years, typically about 29 days apart.

Recent versions of is-unsafe
VersionPublishedSizeLicense
2.0.2latest21 days ago63 KBMIT
2.0.02 months ago63 KBMIT
1.0.13 months ago57 KBMIT
1.0.03 months ago55 KBMIT

Overview

is-unsafe is an npm package that zero-dependency, DOM-free, pure predicate for detecting unsafe strings across HTML, XML, SVG, SQL, SHELL, and REGEX contexts. It has 1 known dependents in the graph. The latest version is 2.0.2, released under the MIT license.

Who should use it

Teams working in the npm ecosystem who need zero-dependency, DOM-free, pure predicate for detecting unsafe strings across HTML, XML, SVG, SQL, SHELL, and REGEX contexts and value a focused solution.

When not to use it

Consider an alternative if you need to or if a more actively-maintained option better fits your npm stack.

Pros

  • Ships TypeScript type definitions.
  • Clear open-source license (MIT).
  • Lean dependency tree (1 direct dependencies).

Cons

  • No significant drawbacks detected from available metadata.

Auto-generated from collected registry metadata. No external claims are inferred.

Maintainers

amitgupta

Keywords

htmllognosqlpredicateredossafesanitizersecurityshell-injectionsql-injectionsvgunsafevalidatorxmlxss

Funding

Frequently asked questions

Should I use is-unsafe?

Yes — is-unsafe scores well across adoption, maintenance, weight, supply chain, and licensing. No download data reported for this package yet. Last published 21 days ago. 4 releases in the last 2 years.

How do I install is-unsafe?

Run `npm install is-unsafe` to add is-unsafe to your npm project.

What license is is-unsafe released under?

is-unsafe is distributed under the MIT license.

How popular is is-unsafe?

npm does not publish download counts. Within PackageGraph's crawl, 1 known packages depend on is-unsafe.

Is is-unsafe still maintained?

The most recent release of is-unsafe (v2.0.2) was published 21 days ago.

Does is-unsafe run install scripts?

No. is-unsafe does not define preinstall, install, or postinstall scripts, so installing it does not execute publisher-supplied code.