nvm-sh / nvm
Repository health
Security, maintenance, dependencies and license for nvm-sh/nvm.
Security
7 dependencies checked (7 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 6.6/10
Checks sorted from strongest to weakest.
- Security policySecurity policy file detected10/10
- Recent activity30 commits and 4 issue activity found in the last 90 days10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- License fileLicense file detected10/10
- Static analysis on commitsSAST tool is run on all commits10/10
- OpenSSF best-practices badgeBadge detected: Silver7/10
- Code review before mergeFound 11/22 approved changesets5/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- Fuzz testingProject is not fuzzed0/10
- Pinned dependenciesDependency not pinned by hash detected0/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Signed releasesNo releases foundnot scored
- Branch protectionScorecard could not run this check.not scored
Maintenance
Outside contributions: 30 of 95 external pull requests merged (60% of those decided), median 22 days to merge.From the 100 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 12
- 0 stale (60+ days, no update in 30)
- Merged
- 11
- of the 30 latest
- Median time to merge
- 8 days
- From bots
- 0
- not listed below
Open
- #3966 fix: skip Windows npm shims during installationNUAAwqy · opened 2 days ago
- #3922 feat: allow npm flags (e.g. --install-links) in default-packages fileousamabenyounes · opened 42 days ago
- #3964 Add SLSA generic generator workflowKelleretoro · opened 6 days ago
- #3963 [Fix] `nvm run`: avoid an unbound `NVM_IOJS` under `set -u`jayhemnani9910 · opened 7 days ago
- #3962 [Fix] `install.sh`: only write `$HOME` when `$NVM_DIR` is inside itjayhemnani9910 · opened 7 days ago
Recently merged
- #3836 [Fix] `nvm_cd`: bypass a user-defined `cd` functionglensc · merged 10 Oct 2026
- #3927 [readme] Fix a Docker warning from using Docker installation instructionsclifennel · merged 9 Oct 2026
- #3939 [Fix] `nvm use`: handle regex-special characters in `$NVM_DIR`Saadanjum0 · merged 9 Oct 2026
- #3952 [Fix] `install.sh`: start a new line before appending to a profile that does not end with onelazerg · merged 9 Oct 2026
- #3949 [Perf] remove subprocess forks from startup and `nvm use` pathsmarble-sh · merged 8 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- ljharb63 commits · 63%
- marble-sh8 commits · 8%
- hridhinvarkeyjoseph4 commits · 4%
- jakelodwick3 commits · 3%
- lazerg2 commits · 2%
Of the 100 most recent commits.
Issues
- Open
- 387
- issues and pull requests, as GitHub counts them
- Median time to close
- 1 day
- from 37 closed of the 45 latest
- Awaiting first reply
- 1
- of 8 open among the 45 latest
- Oldest open
- 13.0 years
Most wanted
- #3416 `nvm_resolve_local_alias default` has bad performance1 reaction · 1 comment
Rates come from the 45 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Packages pulled in by these were not checked.
License compatibility
Repo license: MIT · 7 deps checked · 0 potential conflicts.