ssri
npmv14.0.0Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.
Safe to adopt
Yes — ssri scores well across adoption, maintenance, weight, supply chain, and licensing. No download data reported for this package yet. Last published 75 days ago. 5 releases in the last 2 years.
- ?Adoption: grade ?, Not reported by this registry.
No download data reported for this package yet.
- AMaintenance: grade A, Excellent.
Last published 75 days ago. 5 releases in the last 2 years.
- AWeight: grade A, Excellent.
Pulls in 1 transitive package, about 38 KB installed (at least — some of the tree is still being crawled).
- ASupply chain: grade A, Excellent.
No install scripts, 4 maintainers, and a contained dependency surface.
- ALicense: grade A, Excellent.
ISC — permissive, with no copyleft found in the dependency tree.
Grades are computed deterministically from registry metadata collected by PackageGraph — downloads, dependents, publish dates, the resolved dependency tree, maintainer count, and declared licenses. No third-party scores are used.
Install cost
What you actually take on by adding ssri to a project.
Runtime packages this one declares itself.
Distinct packages in the full runtime tree, deduplicated the way a package manager would.
Unpacked size of this package plus its entire runtime tree.
Longest resolved dependency chain below this package.
Part of this dependency tree has not been crawled yet, so these figures are a lower bound rather than a final total.
Compatibility
- Node.js
- node ^22.22.2 || ^24.15.0 || >=26.0.0
- Module format
- CommonJS only
- TypeScript
- No bundled types
- Install scripts
- None
Quick start
A usage example from the ssri README.
const ssri = require('ssri')
const integrity = 'sha512-9KhgCRIx/AmzC8xqYJTZRrnO8OW2Pxyl2DIMZSBOr0oDvtEFyht3xpp71j/r/pAe1DM+JI/A+line3jUBgzQ7A==?foo'
// Parsing and serializing
const parsed = ssri.parse(integrity)
ssri.stringify(parsed) // === integrity (works on non-Integrity objects)
parsed.toString() // === integrity
// Async stream functions
ssri.checkStream(fs.createReadStream('./my-file'), integrity).then(...)
ssri.fromStream(fs.createReadStream('./my-file')).then(sri => {
sri.toString() === integrity
})ssri vs the alternatives
Packages solving a similar problem in the npm ecosystem, compared on the signals that drive an adoption decision.
| Package | Weekly downloads | Dependents | License | Last release |
|---|---|---|---|---|
| ssrithis page | 0 | 1 | ISC | 2 months ago |
| happy-dom | 12.2M | 5 | MIT | 5 hours ago |
| cacache | 0 | 1 | ISC | 5 hours ago |
| @nodable/entities | 0 | 2 | MIT | 5 hours ago |
| is-unsafe | 0 | 1 | MIT | 5 hours ago |
| jsdom | 0 | 20 | MIT | 5 hours ago |
Dependencies
Declared by ssri v14.0.0. Runtime dependencies are installed with the package; dev dependencies are not.
Runtime (1)
Dev (3)
Used by
Popular packages that depend on ssri.
Relationship graph
Dependencies (left) and dependents (right) of ssri.
Frequently installed together
create a pipeline of streams using Minipass
the most correct and second fastest glob implementation in JavaScript
just emit 'log' events on the process object
Safer Node.js Buffer API
Fast, fault-tolerant, cross-platform, disk-based, data-agnostic, content-addressable cache.
the http/https agent used by the npm cli
Redact sensitive npm information from output
Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies
An implementation of window.fetch in Node.js using Minipass streams
HTTP content negotiation
Retries a function that returns a promise, leveraging the power of the retry module.
Release history
3 releases in the last two years, typically about 110 days apart.
| Version | Published | Size | License |
|---|---|---|---|
| 14.0.0latest | 2 months ago | 38 KB | ISC |
| 13.0.1 | 5 months ago | 38 KB | ISC |
| 13.0.0 | 9 months ago | 38 KB | ISC |
| 12.0.0 | 1 year ago | 38 KB | ISC |
| 11.0.0 | 1 year ago | 38 KB | ISC |
| 10.0.6 | 2 years ago | 38 KB | ISC |
| 10.0.5 | 2 years ago | 38 KB | ISC |
| 10.0.4 | 3 years ago | 38 KB | ISC |
| 10.0.3 | 3 years ago | 38 KB | ISC |
| 10.0.2 | 3 years ago | 37 KB | ISC |
| 10.0.1 | 3 years ago | 37 KB | ISC |
| 10.0.0 | 3 years ago | 37 KB | ISC |
| 9.0.1 | 4 years ago | 37 KB | ISC |
| 9.0.0 | 4 years ago | 36 KB | ISC |
| 7.1.1 | 5 years ago | 35 KB | ISC |
Overview
ssri is an npm package that standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec. It has 1 known dependents in the graph. The latest version is 14.0.0, released under the ISC license.
Who should use it
Teams working in the npm ecosystem who need standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec and value a focused solution.
When not to use it
Consider an alternative if you need to have first-class TypeScript types out of the box, or if a more actively-maintained option better fits your npm stack.
Pros
- Clear open-source license (ISC).
Cons
- No bundled TypeScript types (may require a separate @types package).
Auto-generated from collected registry metadata. No external claims are inferred.
Maintainers
Frequently asked questions
Should I use ssri?
Yes — ssri scores well across adoption, maintenance, weight, supply chain, and licensing. No download data reported for this package yet. Last published 75 days ago. 5 releases in the last 2 years.
How do I install ssri?
Run `npm install ssri` to add ssri to your npm project.
How many dependencies does ssri have?
ssri declares 4 direct dependencies and pulls in 1 packages in total once its runtime tree is resolved totalling about 38 KB on disk.
What license is ssri released under?
ssri is distributed under the ISC license.
How popular is ssri?
npm does not publish download counts. Within PackageGraph's crawl, 1 known packages depend on ssri.
Is ssri still maintained?
The most recent release of ssri (v14.0.0) was published 2 months ago.
Does ssri run install scripts?
No. ssri does not define preinstall, install, or postinstall scripts, so installing it does not execute publisher-supplied code.