Upload-Post/upload-post-npm tiene un índice de salud de 55 sobre 100, lo que lo sitúa en la banda Moderado. Su puntuación más alta es Vitality (78/100) y la más baja, AI Readiness (35/100). Se actualizó por última vez hace 6 días. Una sola persona concentra la mayor parte del trabajo reciente.
55
global / 100
Moderado
Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
55
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
Dependencias directas libres de avisos conocidos — ninguna dependencia directa tiene un aviso conocido
25/25
Dependencias indirectas libres de avisos conocidos — ninguna dependencia indirecta tiene un aviso conocido
0/40
Sin avisos pendientes — ningún aviso tiene fecha de publicación
Datos de entrada utilizados
source
osv
advisories
0
affected_packages
0
assessed_packages
30
unassessed_packages
0
affected_by_severity
none
direct_affected_packages
0
Excluidos de la puntuación (sin datos o no aplicable): Sin avisos pendientes. Los pesos restantes se han renormalizado. Se cotejó el cierre de dependencias en tiempo de ejecución de npm:upload-post@2.8.1 —lo que arrastra la instalación del paquete publicado—: 30 paquetes. No se analiza la alcanzabilidad.
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
Código verificable por tipos — JavaScript sin configuración de verificación de tipos
55/55
Tamaños de archivo manejables — 0/2 archivos fuente de más de 60 KB
Datos de entrada utilizados
primary_language
JavaScript
largest_source_bytes
58.134
source_files_sampled
2
oversized_source_files
0
Datos clave
6estrellas de GitHub
1contribuidores
48commits en los últimos 12 meses
6días desde el último push
4versiones publicadas
1factor bus
0issues abiertas
npmecosistemas de paquetes
Advertencias de recopilación de datos
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Más detalle
Historial de estrellas y forks 0 ★ / 2 ⇿
0Estrellas
2Forks
Cuándo se añadió cada estrella y fork, recopilado de GitHub y agrupado por día. El crecimiento acumulado se sitúa justo encima de las adiciones diarias que lo componen, de modo que ambos se leen en conjunto: la acumulación orgánica sostenida no se parece en nada a un pico abrupto y efímero. Cuando esa diferencia es medible, se informa como autenticidad del crecimiento.
OpenSSF Scorecard 4.5 / 10
4.5agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).Scorecard v5.5.0 · 2026-07-27 12:35 UTC
Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 2 paquetes directos y 24 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.
Registro
Paquete
Versión
Relación
npm
axios
1.13.4
directa
npm
form-data
4.0.5
directa
npm
@types/node
20.17.19
indirecta
npm
asynckit
0.4.0
indirecta
npm
call-bind-apply-helpers
1.0.2
indirecta
npm
combined-stream
1.0.8
indirecta
npm
delayed-stream
1.0.0
indirecta
npm
dunder-proto
1.0.1
indirecta
npm
es-define-property
1.0.1
indirecta
npm
es-errors
1.3.0
indirecta
npm
es-object-atoms
1.1.1
indirecta
npm
es-set-tostringtag
2.1.0
indirecta
npm
follow-redirects
1.15.9
indirecta
npm
function-bind
1.1.2
indirecta
npm
get-intrinsic
1.3.0
indirecta
npm
get-proto
1.0.1
indirecta
npm
gopd
1.2.0
indirecta
npm
has-symbols
1.1.0
indirecta
npm
has-tostringtag
1.0.2
indirecta
npm
hasown
2.0.2
indirecta
npm
math-intrinsics
1.1.0
indirecta
npm
mime-db
1.52.0
indirecta
npm
mime-types
2.1.35
indirecta
npm
proxy-from-env
1.1.0
indirecta
npm
typescript
5.7.3
indirecta
npm
undici-types
6.19.8
indirecta
Avisos de dependencias 0
Instalar npm:upload-post@2.8.1 arrastra 30 paquetes, directos y transitivos: 0 tienen avisos conocidos, de los cuales 0 son dependencias directas.
Ningún aviso conocido afecta a las dependencias evaluadas.
Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [
"instagram-api",
"javascript",
"nodejs",
"sdk",
"social-media-api",
"tiktok-api",
"typescript",
"upload-post",
"youtube-api"
],
"is_fork": false,
"size_kb": 228,
"has_wiki": true,
"homepage": "https://upload-post.com",
"languages": {
"JavaScript": 58134
},
"pushed_at": "2026-07-20T20:15:07Z",
"created_at": "2025-04-03T16:36:19Z",
"owner_type": "Organization",
"updated_at": "2026-07-20T20:15:40Z",
"description": "📦 Official Node.js/JavaScript SDK for Upload-Post API. Programmatically publish videos & images to TikTok, Instagram, YouTube, LinkedIn, X, Facebook, Pinterest, Threads, Reddit & Bluesky.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "JavaScript",
"significant_languages": [
"JavaScript"
]
},
"owner": {
"blog": "https://upload-post.com",
"name": "Upload-post",
"type": "Organization",
"login": "Upload-Post",
"company": null,
"location": null,
"followers": 40,
"avatar_url": "https://avatars.githubusercontent.com/u/206099361?v=4",
"created_at": "2025-04-03T15:05:01Z",
"is_verified": null,
"public_repos": 13,
"account_age_days": 479
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2026-02-04T07:23:24Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2026-02-04T00:42:45Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2026-02-04T00:41:20Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2026-02-04T00:39:48Z"
}
],
"recent_commits": [
{
"oid": "850ea21fcb05530f83de78f964bd8bd09a87f62a",
"body": null,
"is_bot": false,
"headline": "chore: remove autogenerate AI caption options (v2.8.1)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-20T20:15:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57940a92e07bcee9f51aee414348edc0071e3d15",
"body": "Same is_video-gating bug as the pip SDK: privacy_level and post_mode were only\nsent for TikTok video, so photo carousels always published as PUBLIC_TO_EVERYONE\n/ DIRECT_POST. The backend reads both for photos (uploadphotos.py). Move them out\nof the isVideo gate and add tiktokPrivacyLevel/tiktokPostMode to TikTokPhotoOptions.",
"is_bot": false,
"headline": "fix(tiktok): send privacy_level & post_mode for photo uploads (v2.8.0)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-18T02:23:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9bb98bb72ae951d8ad732e7f18e898825ed06223",
"body": "- getPostComments: accept platform (instagram|facebook|youtube|linkedin) + limit/after; keep legacy (user, options) positional form\n- createComment: POST /uploadposts/comments/create\n- deleteComment: DELETE /uploadposts/comments/delete\n- retryPost: POST /uploadposts/posts/retry (request_id/job_id)\n- unpublishPost: POST /uploadposts/posts/unpublish",
"is_bot": false,
"headline": "feat: comment CRUD + post retry/unpublish endpoints (v2.7.0)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-18T01:50:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6fce219cd4f387f48f05b5667075656700ae613e",
"body": "…rg/company pages\n\nLinkedIn's API does not expose member-level analytics to standard apps.\nVerified live against production tokens (2026-07-18): personal post/share stats\nrequire r_member_social (we only hold w_member_social) -> HTTP 400, and the\nfirst-degree connection count requires the partner-only r_1st_connections_size\n-> HTTP 403. Personal profiles therefore return no analytics. Stop implying\notherwise; only organization/company pages the member administers are supported.",
"is_bot": false,
"headline": "fix(linkedin-analytics): personal profiles have no analytics — only o…",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-18T00:30:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "db9721fe841440049e12d20f46e37f7827f39946",
"body": "Optional buttons?: Array<{title,url}> (max 3) sent to the IG comment private-reply\nendpoint. Backward compatible.",
"is_bot": false,
"headline": "feat: buttons (web_url templates) on replyToComment (v2.6.0)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-18T00:21:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15249ad85d62d6cf051a80faef1e56ac99ab7717",
"body": "…→ main)\n\n- TextPlatform/PhotoPlatform/VideoPlatform unions updated per the\n backend capability matrix; 9 new *Title override fields.\n- Google Business post options; validateJwt + notification fixes;\n idempotency support; CI via npm trusted publishing (OIDC).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: 2.6.0 — 9 new platforms in types + title overrides (staging …",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-16T10:31:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "5e32616cc41ed6694828b538f31d7e951dc52872",
"body": "Google Business was an accepted platform with no options at all, so any\naccount with more than one location got 'gbp_location_id is required' and\nCTA/event/offer posts were unreachable. Adds gbpLocationId plus the topic,\nmedia, CTA, event and offer fields the backend reads.\n\nselectGoogleBusinessLoca\n[…]\ntions/test.\n\nTypes: UploadVideoOptions was missing RedditOptions even though 2.4.0\nstarted sending reddit params on video uploads.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: Google Business post options; complete notification config",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-09T09:53:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "09116eb11ba97502e7538dbc43ebc25d0425e77c",
"body": "`npm install -g npm@latest` leaves the global npm missing 'sigstore', so\n`npm publish --provenance` dies with MODULE_NOT_FOUND. Node 24 already\nships npm 11, which is new enough for trusted publishing.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: use Node 24's bundled npm instead of upgrading in place",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-09T09:09:20Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9b1bf53cddc8124f2ffc109a6275c30b9ad8b5c4",
"body": "Probing production confirmed three client bugs:\n POST /uploadposts/users/validate-jwt -> 405 (route is GET, JWT goes in Authorization: Bearer)\n GET /uploadposts/notification-config -> 404 (real route is /uploadposts/users/notifications)\nBoth methods could never have succeeded.\n\nU\n[…]\nitDetailedPosts; syncs index.d.ts, which was missing\ngetPostAnalyticsByPlatformId, getGoogleBusinessLocations and threadsTopicTag.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: repair validateJwt and notification config; add idempotency support",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-09T08:28:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e2a007757f2c1a4a173a46065e1108e62cce88b5",
"body": "npm returns a masked 404 on the publish PUT when NODE_AUTH_TOKEN is\ninvalid, which made the last three release failures hard to read.\nFail on `npm whoami` instead.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: verify npm auth before publish",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-09T08:06:56Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bdb6e11b06b9c983b81ef17964a2214c49491f13",
"body": null,
"is_bot": false,
"headline": "feat(youtube): map youtubePlaylistId to youtube_playlist_id form field",
"author_name": "juancarlos.cavero",
"author_login": null,
"committed_at": "2026-07-04T15:12:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b424757ecb34cc70aa8c0b934f6403d51ea6e1e9",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #33 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-06-14T11:32:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "98c41f692441ba3d6dc164d97b82039e5c578d68",
"body": "… -> 2.3.0\n\nNew upload options: autogenerate (+ autogenerateTitle/Description/Language). When set,\nthe server generates native per-platform copy from the media and fills blank fields.\nAdded to both video and photo form builders, .d.ts types, and README.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: support autogenerate (AI per-platform copy) options; bump 2.2.2…",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-12T21:47:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "60dc3650b0f4e1e671a0c8a4b38f98e30d556fa5",
"body": "Append discord and telegram to the stale JSDoc @param platforms lists\nin upload(), uploadPhotos(), uploadText() and the class-level\n\"Supports uploading to:\" docstring, matching the index.d.ts type unions.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add discord, telegram to JSDoc supported-platforms lists",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-10T18:25:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9eac55ee3665a3c308d3ff612a6283362789ce5d",
"body": "Add 'discord' and 'telegram' to the VideoPlatform, PhotoPlatform and\nTextPlatform type unions in index.d.ts, since both platforms support\ntext, photo and video uploads. Update the README supported-platform\nlists (intro line and Video/Photo/Text feature bullets) and the\nUploadPost class doc comment to include Discord and Telegram.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: add Discord and Telegram platform types",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-10T15:35:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c106a5d4532273adb723a6f571ff841e5d2e0676",
"body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(release): 2.2.2 — language option in generateJwt",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-02T21:12:26Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "60739df8a02adf316a7b64017fc3ce7080b3d9d9",
"body": "Optional `language` (en/es/de/fr/pt) forwarded to generate-jwt to force\nthe white-label connect page language. Omitting it keeps browser\nauto-detection. Adds types and README example.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: add language option to generateJwt",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-02T20:33:10Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "568ef81c7e2c6a28a15c35e58a57c3e3aaeacb80",
"body": "The server route at /api/uploadposts/schedule/<job_id> only accepts PATCH\nfor edits (and DELETE for cancel). editScheduled was sending POST, getting\n405 Method Not Allowed for every caller.\n\nBumps version to 2.2.1.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(schedule): use PATCH for editScheduled (server returns 405 on POST)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-05-26T11:02:34Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0661cb5d8541ce9c6918e1ec4605099ea4cb1475",
"body": "Cuts a release that bundles the latest staging features:\n- feat(youtube): add subtitle upload support to SDK (#28)\n- feat(media): add getMedia() with LinkedIn page_urn support (#30)\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: bump version to 2.2.0",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-05-18T14:21:40Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b9253dc40cf3516447ea1837fdc643b4caddf163",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #32 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-05-18T14:16:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd9195e74c88723ecdac551bec1ed94fafee1d9a",
"body": "Add youtubeSubtitles option for uploading subtitle/caption files to YouTube videos.\nSupports multiple tracks with language codes, display names, and file paths or URLs.\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\nCo-authored-by: Claude <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(youtube): add subtitle upload support to SDK (#28)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-05-18T12:25:07Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f80ec1f8259b0081735ddff229df1328035b388f",
"body": "* feat(media): add getMedia() SDK method with LinkedIn page_urn support\n\nSurface the /uploadposts/media endpoint as a first-class SDK method.\nAccepts a pageUrn option for LinkedIn that maps to the backend's\nnew auto-resolve / \"me\" override behavior so callers can pick the\npersonal profile or a speci\n[…]\noc comments in index.js and\nindex.d.ts to the load-bearing parameter info. No behavior change.\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\n---------\n\nCo-authored-by: Claude <claude@anthropic.com>",
"is_bot": false,
"headline": "feat(media): add getMedia() with LinkedIn page_urn support (#30)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-05-18T12:24:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "be4e2206a9a3f67a6da19f8dfa55cf6ea2bf8e00",
"body": "Restored NODE_AUTH_TOKEN auth since npm requires it for publishing.\n\nCo-Authored-By: Harry (noreply@anthropic.com)",
"is_bot": false,
"headline": "fix(ci): add NPM_TOKEN auth to publish workflow",
"author_name": "root",
"author_login": null,
"committed_at": "2026-05-04T08:20:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac696aabf2822d36407668f0d9db4bcd2705a1c6",
"body": null,
"is_bot": false,
"headline": "fix: remove provenance flag + bump to 2.1.2",
"author_name": "root",
"author_login": null,
"committed_at": "2026-04-14T16:19:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e8c0e3c09358c9e3ff377ee95d12638eaf13602",
"body": null,
"is_bot": false,
"headline": "fix: remove broken npm update step from CI workflow",
"author_name": "root",
"author_login": null,
"committed_at": "2026-04-14T16:16:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e11e94f4f81d8c4eebe678c5c66f286664a428d9",
"body": "…v2.1.1",
"is_bot": false,
"headline": "feat: add user preferences and notification config methods + bump to …",
"author_name": "root",
"author_login": null,
"committed_at": "2026-04-14T15:56:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32013852df5dd5d6e587091ed0242e0f6d5ea661",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #29 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-04-14T14:56:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "242ad092615fd16224f3a002531436c1ba84812c",
"body": "Add getPostComments(), replyToComment(), and publicReplyToComment()\nmethods to the npm SDK with full TypeScript type definitions.\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\nCo-authored-by: Claude <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(instagram): add comment interaction methods (#27)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-04-14T00:38:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "4b1bbdd51dce95d255741b740ef74f496fa8bebb",
"body": "* feat(instagram): support binary cover image for Instagram Reels\n\nUpdate instagramCoverUrl to accept file paths and Buffers in addition to\nURLs. When a non-URL value is provided, the image is sent as a binary\ncover_image field in the multipart form data, matching the YouTube\nthumbnail binary patter\n[…]\n(noreply@anthropic.com)\n\n* fix(instagram): clean up cover image comments and type annotations\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\n---------\n\nCo-authored-by: Claude <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(instagram): support binary cover image for Reels (#25)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-04-14T00:38:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e94fd7a0e4706ad2114f93fc9dc310a7bc644e13",
"body": "* feat(sdk): add getPostAnalyticsByPlatformId method\n\nAdd SDK method to query post analytics by native platform ID (e.g., Instagram media ID)\ninstead of requestId, enabling analytics for organically published posts.\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\n* refactor(analytics): use shorthand properties in getPostAnalyticsByPlatformId\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\n---------\n\nCo-authored-by: Claude <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(sdk): add getPostAnalyticsByPlatformId method (#24)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-04-14T00:34:58Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e25ab6072f5927c1cca694d50811d8ff494b8ef7",
"body": "New features since 2.0.4:\n- Reddit link posts and first comment media support\n- Binary toLowerCase crash fix\n- Analytics endpoints (total impressions, post analytics, platform metrics)\n- Title optional for platforms that don't require it\n- Link preview support for LinkedIn and Bluesky\n- Queue maxPostsPerSlot option\n- Tracking source header\n- LinkedIn first_comment support\n- getJobStatus method\n- Google Business Profile location selection\n- Topic tag support",
"is_bot": false,
"headline": "chore: bump version to 2.1.0",
"author_name": "root",
"author_login": null,
"committed_at": "2026-03-31T15:22:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "23edfbf7d90ab15e0c31321070dc1de4fc1a33f7",
"body": null,
"is_bot": false,
"headline": "chore: trigger redeploy",
"author_name": "root",
"author_login": null,
"committed_at": "2026-03-16T17:49:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf9881b0967f479d9876275a27b8126e3f2f56cc",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #23 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-16T17:23:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2bed45caa127a03bab9a48542c2ffc2375e0ab6b",
"body": "Add threadsTopicTag option to allow users to attach a topic tag\nto Threads posts for improved discoverability. The tag supports\n1-50 characters with no periods or ampersands, limited to one\nper post.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(threads): add topic tag support to API and SDK (#22)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-13T13:19:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70a55d64eddc3bb78930999b6a6a86a70816ce37",
"body": "Add getGoogleBusinessLocations() and selectGoogleBusinessLocation()\nmethods to support user selection of Google Business Profile locations\nduring OAuth flow, enabling multi-location account handling.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(google-business): add location selection methods to SDK (#21)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-13T13:18:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8379e484fce0107932ef194a2885b1347552d27e",
"body": "…#20)\n\nThe /api/uploadposts/status endpoint accepts both request_id and job_id\nparameters. This adds a dedicated getJobStatus method so users can check\nthe status of scheduled or queued uploads using their job_id.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(client): add getJobStatus method for checking status by job ID (…",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-13T13:16:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2d93373d4fab7d0f135e4692edd736c1fd4a480",
"body": "Add linkedin_first_comment parameter to the upload form options,\nenabling users to automatically post a first comment on LinkedIn\nposts after publishing.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(linkedin): add first_comment support for LinkedIn posts (#19)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-13T13:16:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "06fed3db09c5332422a1ccff429b46899c21a289",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #18 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-04T09:36:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7aea141ec29cb08352e42b1b72ffa7fce5a76218",
"body": "…first-comment-images-7e2c9168\n\nAdd Reddit link posts and image comments",
"is_bot": false,
"headline": "Merge pull request #17 from Upload-Post/ai-feature-reddit-link-posts-…",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-27T13:30:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a9c8a9f3471c692961b7ede850dfe679d6ea1b7c",
"body": "…-tolowercase-crash-7c9bdd10\n\nFix binary data .toLowerCase() crash in n8n node",
"is_bot": false,
"headline": "Merge pull request #15 from Upload-Post/ai-fix-n8n-upload-node-binary…",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-27T13:30:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1df90fb5fb4c75f8d0ae1b3083864958f3a633e1",
"body": "Add reddit_link_url parameter to enable Reddit link posts via text upload\nendpoint. Add firstCommentMedia option to attach images to first comments\nacross platforms, supporting URLs, file paths, and streams.\n\nCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(sdk): add Reddit link post and first comment media support",
"author_name": "AI Coder Bot",
"author_login": null,
"committed_at": "2026-02-27T11:25:08Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bda05cf4931a197355c02a6f43b48bafd2635dbe",
"body": "… binary data\n\nWhen binary data (Buffer) is passed as videoPathOrUrl or documentPathOrUrl\nfrom n8n nodes, calling .toLowerCase() on a non-string value causes a\nruntime crash. Adding typeof checks ensures .toLowerCase() is only called\non string values, allowing binary data to fall through to the file path\nhandling branch.",
"is_bot": false,
"headline": "fix(upload): add type guard before .toLowerCase() to prevent crash on…",
"author_name": "AI Coder Bot",
"author_login": null,
"committed_at": "2026-02-27T09:08:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61335267f12839baa3cf0d50df1b6f40f9762cab",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #14 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-24T10:26:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a30e977132514db54a2a14b7e8bcdc25737d127",
"body": null,
"is_bot": false,
"headline": "chore: sync changes to staging",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-02-23T19:00:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e7f4a756484913fa087912a22e2f3b0e99bd443",
"body": "…slot (#13)\n\nAdd support for the maxPostsPerSlot parameter across the npm client,\nallowing users to override the profile-level queue slot limit per\nrequest. Updates TypeScript types, form data handling, and README\ndocumentation.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(queue): add maxPostsPerSlot option to limit platforms per queue …",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-23T00:10:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ce2e4e94e48e2f80142f29f50f44675dfe802c1c",
"body": "Add X-Upload-Post-Source header with value 'npm' to all outgoing API\nrequests, enabling server-side tracking to differentiate between\nn8n workflow and direct npm package usage.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(tracking): add source header to distinguish npm API requests (#12)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-23T00:07:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d933ab00cca990f77e87c2bb5afce9faf6ecbed",
"body": "…metrics endpoints (#11)\n\nExtend the analytics SDK with three new methods (getTotalImpressions,\ngetPostAnalytics, getPlatformMetrics) and add pageId/pageUrn options\nto getAnalytics. Includes full TypeScript declarations for all new\nendpoints and updated platform list to cover YouTube, TikTok, Threads,\nPinterest, and Reddit.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(analytics): add total impressions, post analytics, and platform …",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-21T10:15:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fcd5e0cd863cf489e06029e83966c37a7f7c1a24",
"body": "…(#10)\n\nAdd linkUrl, linkedinLinkUrl, and blueskyLinkUrl options to uploadText\nso that text-only posts can include link preview cards on LinkedIn,\nBluesky, and Facebook. A generic linkUrl serves as fallback when\nplatform-specific URLs are not provided.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(upload-text): add link preview support for LinkedIn and Bluesky …",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-20T14:48:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2de55c1036be6462a06b595b546997b37688e1fc",
"body": "Update CommonUploadOptions to treat title as an optional field.\nTikTok, Instagram, Facebook, LinkedIn, X, Threads, Bluesky, and\nPinterest no longer require a title, while YouTube, Reddit, and\ntext posts still do. Title is only sent in the request when provided.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(api): make title optional for platforms that don't require it (#9)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-20T14:48:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7e68ff9e11e6534f862133435f3b84f975b8f66c",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #8 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-12T18:04:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81d1212001ef20dc373e75b5a112076292646c8a",
"body": "Add threadsThreadMediaLayout option to control how media items are\nsplit across multiple Threads posts, following the same pattern as\nxThreadImageLayout for X (Twitter).\n\nCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(threads): add threads_thread_media_layout parameter",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-02-12T17:37:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "09efd7ff155f0e65697befe23a4f4f8e11615d08",
"body": "Add support for Facebook VIDEO media type for normal page videos without\n9:16 aspect ratio restriction. Include thumbnailUrl parameter for custom\nvideo thumbnails on Facebook pages.\n\nAdd xThreadImageLayout parameter to configure image composition in X/Twitter\nthreads using comma-separated values (e.g. \"4,4\" or \"2,3,1\").\n\nUpdate TypeScript type definitions and API documentation to reflect new\noptions.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(upload-post-npm): Add Facebook VIDEO type and X thread layout (#6)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-09T13:06:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7f47d7213c0c321f9349bf6b8f2c740a02eb9cae",
"body": "Introduce new configuration options for white-label calendar integration. Add showCalendar, readonlyCalendar, connectTitle, and connectDescription parameters to generateJwt method. This enables clients to display a read-only calendar view without account connection or editing capabilities.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(uploadpost): add read-only calendar white-label support (#4)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-06T13:40:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "274829d412520a4598377ac12bc3c220749a8098",
"body": null,
"is_bot": false,
"headline": "ci: auto-publish on push to main when version changes",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-06T12:37:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bacf12e540a7af51353bc2d1ec1e70ac3a1dd769",
"body": null,
"is_bot": false,
"headline": "chore: bump to 2.0.3",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T07:23:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "35d9eacdc4d343e92e683c0e010a171aa5833df0",
"body": null,
"is_bot": false,
"headline": "fix: update axios and form-data to fix security vulnerabilities",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T07:21:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5556a9a38dc2c48586a4ac2437498c5f2428f3ba",
"body": null,
"is_bot": false,
"headline": "chore: use OIDC trusted publishing instead of NPM_TOKEN",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T07:15:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81adb42da72637c37e3783cbf185406b7fecd161",
"body": null,
"is_bot": false,
"headline": "fix: add NODE_AUTH_TOKEN to dry-run step and bump to v2.0.2",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:42:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3cc7060772a83aa734c2d89453b965840c0a065",
"body": null,
"is_bot": false,
"headline": "chore: bump to v2.0.1",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:41:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78b62340e431dbbe08c9c99e65355b89e18f4778",
"body": null,
"is_bot": false,
"headline": "fix: disable provenance to fix npm publish",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:41:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1891a6960d212e6413e9d08b1f87698de2b3e701",
"body": null,
"is_bot": false,
"headline": "fix: use git+ prefix in repository URL",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:39:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bcdbe48cdb7abd51903423a66ecd667552e2a091",
"body": null,
"is_bot": false,
"headline": "fix: correct repository URL case",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:38:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d732dd6c8487d7e2728662179458517d543b996",
"body": "Major update with all Upload-Post API features:\n\nNEW FEATURES:\n- Upload Document endpoint (LinkedIn PDF/PPT/DOC support)\n- User management (list, create, delete, generate JWT, validate JWT)\n- Scheduled posts (list, edit, cancel)\n- Analytics endpoint\n- Upload history\n- Facebook/LinkedIn pages helpers\n[…]\n type definitions\n- Better error handling\n- Comprehensive JSDoc documentation\n- Updated README with all features and examples\n\nBREAKING CHANGES:\n- Some parameter names updated for consistency with API",
"is_bot": false,
"headline": "feat: v2.0.0 - Complete API update",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:37:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "86f7a61bbb73e5448966fe7cfe610ea10b4cccf3",
"body": null,
"is_bot": false,
"headline": "ci: fix npm version for trusted publishing (requires 11.5.1+)",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:23:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bb500568a4ff094929a052c8c5efe40beb858776",
"body": null,
"is_bot": false,
"headline": "ci: add manual trigger with dry-run for testing",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:08:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f78dbac2769135fbb567a9211669c6d206e8c1fe",
"body": null,
"is_bot": false,
"headline": "ci: switch to OIDC trusted publishing (no tokens needed)",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-03T23:54:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a309321b67ce2767c6707468ac3ee08930efd35d",
"body": null,
"is_bot": false,
"headline": "ci: add auto-publish to npm on release",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-03T23:52:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "23794d59067d031c0ff8bd070572b64c8ae7b2e6",
"body": null,
"is_bot": false,
"headline": "1.0.3",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-06-24T10:39:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a21e355e094f20b38d177c3ae78fdd919faefed",
"body": null,
"is_bot": false,
"headline": "1.0.2",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-06-24T10:38:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "118ff445781d7f992e86532f2752e46e94a1a1fd",
"body": "…oads. Introduce new interfaces for UploadPhotosOptions and UploadTextOptions in TypeScript definitions. Update README with detailed usage examples for video, photo, and text uploads, including platform-specific parameters.",
"is_bot": false,
"headline": "Enhance upload functionality by adding support for photo and text upl…",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-06-24T10:37:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e3b79f548a850ada18ea421c97053851baa4c3c",
"body": null,
"is_bot": false,
"headline": "Add first version",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-04-03T16:40:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbf1d37914f8b947c5f800947c348850df192fd9",
"body": null,
"is_bot": false,
"headline": "first commit",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-04-03T16:40:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe426095c7acb74ee596bfb50c4bbfcaf2438f87",
"body": null,
"is_bot": false,
"headline": "Initial commit",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2025-04-03T16:36:19Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 4,
"commits_last_year": 48,
"latest_release_at": "2026-02-04T07:23:24Z",
"latest_release_tag": "v2.0.3",
"releases_from_tags": false,
"days_since_last_push": 6,
"active_weeks_last_year": 13,
"days_since_latest_release": 173,
"mean_days_between_releases": 0.1
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 50,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "upload-post",
"exists": true,
"license": "MIT",
"keywords": [
"social-media",
"video-upload",
"photo-upload",
"tiktok",
"instagram",
"youtube",
"linkedin",
"facebook",
"pinterest",
"threads",
"reddit",
"bluesky",
"twitter",
"x",
"api-client",
"social-media-api",
"upload-post"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/upload-post",
"is_deprecated": false,
"latest_version": "2.8.1",
"repository_url": "https://github.com/Upload-Post/upload-post-npm",
"versions_count": 14,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4012,
"first_published_at": "2025-02-14T18:30:04.008000Z",
"latest_published_at": "2026-07-20T20:15:21.248000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
}
]
},
"popularity": {
"forks": 2,
"stars": 6,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2025-12-12",
"count": 1
},
{
"date": "2026-01-08",
"count": 1
}
],
"complete": true,
"collected": 2,
"total_forks": 2
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 58134,
"source_files_sampled": 2,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 30,
"malicious_count": 0,
"assessed_package": "npm:upload-post@2.8.1",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "axios",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.6.2"
},
{
"name": "form-data",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^4.0.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "axios",
"direct": true,
"version": "1.13.4",
"ecosystem": "npm"
},
{
"name": "form-data",
"direct": true,
"version": "4.0.5",
"ecosystem": "npm"
},
{
"name": "@types/node",
"direct": false,
"version": "20.17.19",
"ecosystem": "npm"
},
{
"name": "asynckit",
"direct": false,
"version": "0.4.0",
"ecosystem": "npm"
},
{
"name": "call-bind-apply-helpers",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "combined-stream",
"direct": false,
"version": "1.0.8",
"ecosystem": "npm"
},
{
"name": "delayed-stream",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "dunder-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "es-define-property",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "es-errors",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "es-object-atoms",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "es-set-tostringtag",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "follow-redirects",
"direct": false,
"version": "1.15.9",
"ecosystem": "npm"
},
{
"name": "function-bind",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "get-intrinsic",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "get-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "gopd",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "has-symbols",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "has-tostringtag",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "hasown",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "math-intrinsics",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "mime-db",
"direct": false,
"version": "1.52.0",
"ecosystem": "npm"
},
{
"name": "mime-types",
"direct": false,
"version": "2.1.35",
"ecosystem": "npm"
},
{
"name": "proxy-from-env",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "typescript",
"direct": false,
"version": "5.7.3",
"ecosystem": "npm"
},
{
"name": "undici-types",
"direct": false,
"version": "6.19.8",
"ecosystem": "npm"
}
],
"collected": true,
"truncated": false,
"total_count": 26,
"direct_count": 2,
"indirect_count": 24
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 26,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 2,
"closed_unmerged_prs": 5
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "victorcavero14",
"commits": 31,
"avatar_url": "https://avatars.githubusercontent.com/u/33009505?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": false,
"ci_workflows": [
"publish.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/29 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 3,
"reason": "dependency not pinned by hash detected -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 9,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "31 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "850ea21fcb05530f83de78f964bd8bd09a87f62a",
"ran_at": "2026-07-27T12:35:48Z",
"aggregate_score": 4.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-20T20:15:24Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-05-18T12:25:07Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/Upload-Post/upload-post-npm",
"host": "github.com",
"name": "upload-post-npm",
"owner": "Upload-Post"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"security": 56,
"vitality": 78,
"community": 37,
"governance": 56,
"engineering": 44
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 78,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"commits_last_year": 48,
"human_commit_share": 1,
"days_since_last_push": 6,
"active_weeks_last_year": 13
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "13/52 weeks with commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 13
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "48 commits in the last year",
"points": 15.2,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 48
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 90,
"inputs": {
"releases_count": 4,
"latest_release_tag": "v2.0.3",
"releases_from_tags": false,
"days_since_latest_release": 173,
"mean_days_between_releases": 0.1
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "4 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 4
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 173 days ago",
"points": 27,
"status": "partial",
"details": [
{
"code": "release_recency",
"params": {
"days": 173
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.1 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.1
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 6,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 6 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 6
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 37,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 11,
"inputs": {
"forks": 2,
"stars": 6,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "6 stars",
"points": 11.3,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 6
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "2 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 2
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"packages": [
"upload-post"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 4012
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "4,012 downloads/month across npm",
"points": 48,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 4012,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 56,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 79,
"inputs": {
"merged_prs": 26,
"open_issues": 0,
"closed_issues": 2,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 5
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "26/31 decided PRs merged",
"points": 32.1,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 26,
"decided": 31
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/29 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"followers": 40,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "Upload-Post",
"public_repos": 13,
"account_age_days": 479
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "40 followers of Upload-Post",
"points": 11.6,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 40,
"login": "Upload-Post"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "13 public repos, account ~1 yr old",
"points": 11,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 13
}
},
{
"code": "account_age_years",
"params": {
"years": 1
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"upload-post"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 6
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 6 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 6
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "14 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 14
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 44,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "critical",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"has_ci": true,
"has_tests": false,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [
"instagram-api",
"javascript",
"nodejs",
"sdk",
"social-media-api",
"tiktok-api",
"typescript",
"upload-post",
"youtube-api"
],
"has_wiki": true,
"homepage": "https://upload-post.com",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://upload-post.com",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "9 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 9
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 56,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 45,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 4.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/29 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "31 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:upload-post@2.8.1 runtime dependency closure — what installing the published package pulls in — 30 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:upload-post@2.8.1",
"assessed": 30
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 30,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 30,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 1
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "at_risk",
"name": "AI Readiness",
"value": 35,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.932,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "68 of 73 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 68,
"sampled": 73
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "critical",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 23,
"inputs": {
"has_nix": false,
"has_tests": false,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.247,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "18 of the last 73 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 18,
"sampled": 73
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "JavaScript",
"largest_source_bytes": 58134,
"source_files_sampled": 2,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "JavaScript without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "JavaScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/2 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 2,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-27T12:35:57.658042Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/u/Upload-Post/upload-post-npm.svg",
"full_name": "Upload-Post/upload-post-npm",
"license_state": "standard",
"license_spdx": "MIT"
}
Registros relacionados
Repositorios inspeccionados que comparten etiquetas de catálogo o ecosistemas con Upload-Post/upload-post-npm. Leer en paralelo →
Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.
