Upload-Post/upload-post-npm holds a health index of 55 out of 100, placing it in the Moderate band. It scores highest on Vitality (78/100) and lowest on AI Readiness (35/100). It was last updated 6 days ago. A single contributor accounts for most of its recent work.
55
overall / 100
Moderate
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
55
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Direct dependencies free of known advisories — no direct dependency carries a known advisory
25/25
Indirect dependencies free of known advisories — no indirect dependency carries a known advisory
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
0
affected_packages
0
assessed_packages
30
unassessed_packages
0
affected_by_severity
none
direct_affected_packages
0
Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:upload-post@2.8.1 runtime dependency closure — what installing the published package pulls in — 30 packages. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Type-checkable code — JavaScript without a type-check config
55/55
Manageable file sizes — 0/2 source files over 60KB
Inputs used
primary_language
JavaScript
largest_source_bytes
58,134
source_files_sampled
2
oversized_source_files
0
Key facts
6GitHub stars
1contributors
48commits, last 12 months
6days since last push
4releases
1bus factor
0open issues
npmpackage ecosystems
Data collection warnings
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail
Star and fork history 0 ★ / 2 ⇿
0Stars
2Forks
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
OpenSSF Scorecard 4.5 / 10
4.5aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-27 12:35 UTC
Full resolved dependency set from the GitHub dependency graph: 2 direct and 24 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
npm
axios
1.13.4
direct
npm
form-data
4.0.5
direct
npm
@types/node
20.17.19
indirect
npm
asynckit
0.4.0
indirect
npm
call-bind-apply-helpers
1.0.2
indirect
npm
combined-stream
1.0.8
indirect
npm
delayed-stream
1.0.0
indirect
npm
dunder-proto
1.0.1
indirect
npm
es-define-property
1.0.1
indirect
npm
es-errors
1.3.0
indirect
npm
es-object-atoms
1.1.1
indirect
npm
es-set-tostringtag
2.1.0
indirect
npm
follow-redirects
1.15.9
indirect
npm
function-bind
1.1.2
indirect
npm
get-intrinsic
1.3.0
indirect
npm
get-proto
1.0.1
indirect
npm
gopd
1.2.0
indirect
npm
has-symbols
1.1.0
indirect
npm
has-tostringtag
1.0.2
indirect
npm
hasown
2.0.2
indirect
npm
math-intrinsics
1.1.0
indirect
npm
mime-db
1.52.0
indirect
npm
mime-types
2.1.35
indirect
npm
proxy-from-env
1.1.0
indirect
npm
typescript
5.7.3
indirect
npm
undici-types
6.19.8
indirect
Dependency advisories 0
Installing npm:upload-post@2.8.1 pulls in 30 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.
No known advisories affect the assessed dependencies.
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"instagram-api",
"javascript",
"nodejs",
"sdk",
"social-media-api",
"tiktok-api",
"typescript",
"upload-post",
"youtube-api"
],
"is_fork": false,
"size_kb": 228,
"has_wiki": true,
"homepage": "https://upload-post.com",
"languages": {
"JavaScript": 58134
},
"pushed_at": "2026-07-20T20:15:07Z",
"created_at": "2025-04-03T16:36:19Z",
"owner_type": "Organization",
"updated_at": "2026-07-20T20:15:40Z",
"description": "📦 Official Node.js/JavaScript SDK for Upload-Post API. Programmatically publish videos & images to TikTok, Instagram, YouTube, LinkedIn, X, Facebook, Pinterest, Threads, Reddit & Bluesky.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "JavaScript",
"significant_languages": [
"JavaScript"
]
},
"owner": {
"blog": "https://upload-post.com",
"name": "Upload-post",
"type": "Organization",
"login": "Upload-Post",
"company": null,
"location": null,
"followers": 40,
"avatar_url": "https://avatars.githubusercontent.com/u/206099361?v=4",
"created_at": "2025-04-03T15:05:01Z",
"is_verified": null,
"public_repos": 13,
"account_age_days": 479
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2026-02-04T07:23:24Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2026-02-04T00:42:45Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2026-02-04T00:41:20Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2026-02-04T00:39:48Z"
}
],
"recent_commits": [
{
"oid": "850ea21fcb05530f83de78f964bd8bd09a87f62a",
"body": null,
"is_bot": false,
"headline": "chore: remove autogenerate AI caption options (v2.8.1)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-20T20:15:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57940a92e07bcee9f51aee414348edc0071e3d15",
"body": "Same is_video-gating bug as the pip SDK: privacy_level and post_mode were only\nsent for TikTok video, so photo carousels always published as PUBLIC_TO_EVERYONE\n/ DIRECT_POST. The backend reads both for photos (uploadphotos.py). Move them out\nof the isVideo gate and add tiktokPrivacyLevel/tiktokPostMode to TikTokPhotoOptions.",
"is_bot": false,
"headline": "fix(tiktok): send privacy_level & post_mode for photo uploads (v2.8.0)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-18T02:23:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9bb98bb72ae951d8ad732e7f18e898825ed06223",
"body": "- getPostComments: accept platform (instagram|facebook|youtube|linkedin) + limit/after; keep legacy (user, options) positional form\n- createComment: POST /uploadposts/comments/create\n- deleteComment: DELETE /uploadposts/comments/delete\n- retryPost: POST /uploadposts/posts/retry (request_id/job_id)\n- unpublishPost: POST /uploadposts/posts/unpublish",
"is_bot": false,
"headline": "feat: comment CRUD + post retry/unpublish endpoints (v2.7.0)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-18T01:50:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6fce219cd4f387f48f05b5667075656700ae613e",
"body": "…rg/company pages\n\nLinkedIn's API does not expose member-level analytics to standard apps.\nVerified live against production tokens (2026-07-18): personal post/share stats\nrequire r_member_social (we only hold w_member_social) -> HTTP 400, and the\nfirst-degree connection count requires the partner-only r_1st_connections_size\n-> HTTP 403. Personal profiles therefore return no analytics. Stop implying\notherwise; only organization/company pages the member administers are supported.",
"is_bot": false,
"headline": "fix(linkedin-analytics): personal profiles have no analytics — only o…",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-18T00:30:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "db9721fe841440049e12d20f46e37f7827f39946",
"body": "Optional buttons?: Array<{title,url}> (max 3) sent to the IG comment private-reply\nendpoint. Backward compatible.",
"is_bot": false,
"headline": "feat: buttons (web_url templates) on replyToComment (v2.6.0)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-18T00:21:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15249ad85d62d6cf051a80faef1e56ac99ab7717",
"body": "…→ main)\n\n- TextPlatform/PhotoPlatform/VideoPlatform unions updated per the\n backend capability matrix; 9 new *Title override fields.\n- Google Business post options; validateJwt + notification fixes;\n idempotency support; CI via npm trusted publishing (OIDC).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: 2.6.0 — 9 new platforms in types + title overrides (staging …",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-16T10:31:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "5e32616cc41ed6694828b538f31d7e951dc52872",
"body": "Google Business was an accepted platform with no options at all, so any\naccount with more than one location got 'gbp_location_id is required' and\nCTA/event/offer posts were unreachable. Adds gbpLocationId plus the topic,\nmedia, CTA, event and offer fields the backend reads.\n\nselectGoogleBusinessLoca\n[…]\ntions/test.\n\nTypes: UploadVideoOptions was missing RedditOptions even though 2.4.0\nstarted sending reddit params on video uploads.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: Google Business post options; complete notification config",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-09T09:53:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "09116eb11ba97502e7538dbc43ebc25d0425e77c",
"body": "`npm install -g npm@latest` leaves the global npm missing 'sigstore', so\n`npm publish --provenance` dies with MODULE_NOT_FOUND. Node 24 already\nships npm 11, which is new enough for trusted publishing.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: use Node 24's bundled npm instead of upgrading in place",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-09T09:09:20Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9b1bf53cddc8124f2ffc109a6275c30b9ad8b5c4",
"body": "Probing production confirmed three client bugs:\n POST /uploadposts/users/validate-jwt -> 405 (route is GET, JWT goes in Authorization: Bearer)\n GET /uploadposts/notification-config -> 404 (real route is /uploadposts/users/notifications)\nBoth methods could never have succeeded.\n\nU\n[…]\nitDetailedPosts; syncs index.d.ts, which was missing\ngetPostAnalyticsByPlatformId, getGoogleBusinessLocations and threadsTopicTag.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: repair validateJwt and notification config; add idempotency support",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-09T08:28:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e2a007757f2c1a4a173a46065e1108e62cce88b5",
"body": "npm returns a masked 404 on the publish PUT when NODE_AUTH_TOKEN is\ninvalid, which made the last three release failures hard to read.\nFail on `npm whoami` instead.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: verify npm auth before publish",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-07-09T08:06:56Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bdb6e11b06b9c983b81ef17964a2214c49491f13",
"body": null,
"is_bot": false,
"headline": "feat(youtube): map youtubePlaylistId to youtube_playlist_id form field",
"author_name": "juancarlos.cavero",
"author_login": null,
"committed_at": "2026-07-04T15:12:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b424757ecb34cc70aa8c0b934f6403d51ea6e1e9",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #33 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-06-14T11:32:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "98c41f692441ba3d6dc164d97b82039e5c578d68",
"body": "… -> 2.3.0\n\nNew upload options: autogenerate (+ autogenerateTitle/Description/Language). When set,\nthe server generates native per-platform copy from the media and fills blank fields.\nAdded to both video and photo form builders, .d.ts types, and README.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: support autogenerate (AI per-platform copy) options; bump 2.2.2…",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-12T21:47:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "60dc3650b0f4e1e671a0c8a4b38f98e30d556fa5",
"body": "Append discord and telegram to the stale JSDoc @param platforms lists\nin upload(), uploadPhotos(), uploadText() and the class-level\n\"Supports uploading to:\" docstring, matching the index.d.ts type unions.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add discord, telegram to JSDoc supported-platforms lists",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-10T18:25:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9eac55ee3665a3c308d3ff612a6283362789ce5d",
"body": "Add 'discord' and 'telegram' to the VideoPlatform, PhotoPlatform and\nTextPlatform type unions in index.d.ts, since both platforms support\ntext, photo and video uploads. Update the README supported-platform\nlists (intro line and Video/Photo/Text feature bullets) and the\nUploadPost class doc comment to include Discord and Telegram.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: add Discord and Telegram platform types",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-10T15:35:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c106a5d4532273adb723a6f571ff841e5d2e0676",
"body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(release): 2.2.2 — language option in generateJwt",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-02T21:12:26Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "60739df8a02adf316a7b64017fc3ce7080b3d9d9",
"body": "Optional `language` (en/es/de/fr/pt) forwarded to generate-jwt to force\nthe white-label connect page language. Omitting it keeps browser\nauto-detection. Adds types and README example.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: add language option to generateJwt",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-06-02T20:33:10Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "568ef81c7e2c6a28a15c35e58a57c3e3aaeacb80",
"body": "The server route at /api/uploadposts/schedule/<job_id> only accepts PATCH\nfor edits (and DELETE for cancel). editScheduled was sending POST, getting\n405 Method Not Allowed for every caller.\n\nBumps version to 2.2.1.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(schedule): use PATCH for editScheduled (server returns 405 on POST)",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-05-26T11:02:34Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0661cb5d8541ce9c6918e1ec4605099ea4cb1475",
"body": "Cuts a release that bundles the latest staging features:\n- feat(youtube): add subtitle upload support to SDK (#28)\n- feat(media): add getMedia() with LinkedIn page_urn support (#30)\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: bump version to 2.2.0",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-05-18T14:21:40Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b9253dc40cf3516447ea1837fdc643b4caddf163",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #32 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-05-18T14:16:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd9195e74c88723ecdac551bec1ed94fafee1d9a",
"body": "Add youtubeSubtitles option for uploading subtitle/caption files to YouTube videos.\nSupports multiple tracks with language codes, display names, and file paths or URLs.\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\nCo-authored-by: Claude <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(youtube): add subtitle upload support to SDK (#28)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-05-18T12:25:07Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f80ec1f8259b0081735ddff229df1328035b388f",
"body": "* feat(media): add getMedia() SDK method with LinkedIn page_urn support\n\nSurface the /uploadposts/media endpoint as a first-class SDK method.\nAccepts a pageUrn option for LinkedIn that maps to the backend's\nnew auto-resolve / \"me\" override behavior so callers can pick the\npersonal profile or a speci\n[…]\noc comments in index.js and\nindex.d.ts to the load-bearing parameter info. No behavior change.\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\n---------\n\nCo-authored-by: Claude <claude@anthropic.com>",
"is_bot": false,
"headline": "feat(media): add getMedia() with LinkedIn page_urn support (#30)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-05-18T12:24:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "be4e2206a9a3f67a6da19f8dfa55cf6ea2bf8e00",
"body": "Restored NODE_AUTH_TOKEN auth since npm requires it for publishing.\n\nCo-Authored-By: Harry (noreply@anthropic.com)",
"is_bot": false,
"headline": "fix(ci): add NPM_TOKEN auth to publish workflow",
"author_name": "root",
"author_login": null,
"committed_at": "2026-05-04T08:20:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac696aabf2822d36407668f0d9db4bcd2705a1c6",
"body": null,
"is_bot": false,
"headline": "fix: remove provenance flag + bump to 2.1.2",
"author_name": "root",
"author_login": null,
"committed_at": "2026-04-14T16:19:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e8c0e3c09358c9e3ff377ee95d12638eaf13602",
"body": null,
"is_bot": false,
"headline": "fix: remove broken npm update step from CI workflow",
"author_name": "root",
"author_login": null,
"committed_at": "2026-04-14T16:16:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e11e94f4f81d8c4eebe678c5c66f286664a428d9",
"body": "…v2.1.1",
"is_bot": false,
"headline": "feat: add user preferences and notification config methods + bump to …",
"author_name": "root",
"author_login": null,
"committed_at": "2026-04-14T15:56:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32013852df5dd5d6e587091ed0242e0f6d5ea661",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #29 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-04-14T14:56:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "242ad092615fd16224f3a002531436c1ba84812c",
"body": "Add getPostComments(), replyToComment(), and publicReplyToComment()\nmethods to the npm SDK with full TypeScript type definitions.\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\nCo-authored-by: Claude <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(instagram): add comment interaction methods (#27)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-04-14T00:38:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "4b1bbdd51dce95d255741b740ef74f496fa8bebb",
"body": "* feat(instagram): support binary cover image for Instagram Reels\n\nUpdate instagramCoverUrl to accept file paths and Buffers in addition to\nURLs. When a non-URL value is provided, the image is sent as a binary\ncover_image field in the multipart form data, matching the YouTube\nthumbnail binary patter\n[…]\n(noreply@anthropic.com)\n\n* fix(instagram): clean up cover image comments and type annotations\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\n---------\n\nCo-authored-by: Claude <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(instagram): support binary cover image for Reels (#25)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-04-14T00:38:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e94fd7a0e4706ad2114f93fc9dc310a7bc644e13",
"body": "* feat(sdk): add getPostAnalyticsByPlatformId method\n\nAdd SDK method to query post analytics by native platform ID (e.g., Instagram media ID)\ninstead of requestId, enabling analytics for organically published posts.\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\n* refactor(analytics): use shorthand properties in getPostAnalyticsByPlatformId\n\nCo-Authored-By: Claude (noreply@anthropic.com)\n\n---------\n\nCo-authored-by: Claude <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(sdk): add getPostAnalyticsByPlatformId method (#24)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-04-14T00:34:58Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e25ab6072f5927c1cca694d50811d8ff494b8ef7",
"body": "New features since 2.0.4:\n- Reddit link posts and first comment media support\n- Binary toLowerCase crash fix\n- Analytics endpoints (total impressions, post analytics, platform metrics)\n- Title optional for platforms that don't require it\n- Link preview support for LinkedIn and Bluesky\n- Queue maxPostsPerSlot option\n- Tracking source header\n- LinkedIn first_comment support\n- getJobStatus method\n- Google Business Profile location selection\n- Topic tag support",
"is_bot": false,
"headline": "chore: bump version to 2.1.0",
"author_name": "root",
"author_login": null,
"committed_at": "2026-03-31T15:22:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "23edfbf7d90ab15e0c31321070dc1de4fc1a33f7",
"body": null,
"is_bot": false,
"headline": "chore: trigger redeploy",
"author_name": "root",
"author_login": null,
"committed_at": "2026-03-16T17:49:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf9881b0967f479d9876275a27b8126e3f2f56cc",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #23 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-16T17:23:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2bed45caa127a03bab9a48542c2ffc2375e0ab6b",
"body": "Add threadsTopicTag option to allow users to attach a topic tag\nto Threads posts for improved discoverability. The tag supports\n1-50 characters with no periods or ampersands, limited to one\nper post.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(threads): add topic tag support to API and SDK (#22)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-13T13:19:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70a55d64eddc3bb78930999b6a6a86a70816ce37",
"body": "Add getGoogleBusinessLocations() and selectGoogleBusinessLocation()\nmethods to support user selection of Google Business Profile locations\nduring OAuth flow, enabling multi-location account handling.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(google-business): add location selection methods to SDK (#21)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-13T13:18:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8379e484fce0107932ef194a2885b1347552d27e",
"body": "…#20)\n\nThe /api/uploadposts/status endpoint accepts both request_id and job_id\nparameters. This adds a dedicated getJobStatus method so users can check\nthe status of scheduled or queued uploads using their job_id.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(client): add getJobStatus method for checking status by job ID (…",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-13T13:16:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2d93373d4fab7d0f135e4692edd736c1fd4a480",
"body": "Add linkedin_first_comment parameter to the upload form options,\nenabling users to automatically post a first comment on LinkedIn\nposts after publishing.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(linkedin): add first_comment support for LinkedIn posts (#19)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-13T13:16:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "06fed3db09c5332422a1ccff429b46899c21a289",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #18 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-03-04T09:36:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7aea141ec29cb08352e42b1b72ffa7fce5a76218",
"body": "…first-comment-images-7e2c9168\n\nAdd Reddit link posts and image comments",
"is_bot": false,
"headline": "Merge pull request #17 from Upload-Post/ai-feature-reddit-link-posts-…",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-27T13:30:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a9c8a9f3471c692961b7ede850dfe679d6ea1b7c",
"body": "…-tolowercase-crash-7c9bdd10\n\nFix binary data .toLowerCase() crash in n8n node",
"is_bot": false,
"headline": "Merge pull request #15 from Upload-Post/ai-fix-n8n-upload-node-binary…",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-27T13:30:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1df90fb5fb4c75f8d0ae1b3083864958f3a633e1",
"body": "Add reddit_link_url parameter to enable Reddit link posts via text upload\nendpoint. Add firstCommentMedia option to attach images to first comments\nacross platforms, supporting URLs, file paths, and streams.\n\nCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(sdk): add Reddit link post and first comment media support",
"author_name": "AI Coder Bot",
"author_login": null,
"committed_at": "2026-02-27T11:25:08Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bda05cf4931a197355c02a6f43b48bafd2635dbe",
"body": "… binary data\n\nWhen binary data (Buffer) is passed as videoPathOrUrl or documentPathOrUrl\nfrom n8n nodes, calling .toLowerCase() on a non-string value causes a\nruntime crash. Adding typeof checks ensures .toLowerCase() is only called\non string values, allowing binary data to fall through to the file path\nhandling branch.",
"is_bot": false,
"headline": "fix(upload): add type guard before .toLowerCase() to prevent crash on…",
"author_name": "AI Coder Bot",
"author_login": null,
"committed_at": "2026-02-27T09:08:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61335267f12839baa3cf0d50df1b6f40f9762cab",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #14 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-24T10:26:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a30e977132514db54a2a14b7e8bcdc25737d127",
"body": null,
"is_bot": false,
"headline": "chore: sync changes to staging",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-02-23T19:00:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e7f4a756484913fa087912a22e2f3b0e99bd443",
"body": "…slot (#13)\n\nAdd support for the maxPostsPerSlot parameter across the npm client,\nallowing users to override the profile-level queue slot limit per\nrequest. Updates TypeScript types, form data handling, and README\ndocumentation.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(queue): add maxPostsPerSlot option to limit platforms per queue …",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-23T00:10:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ce2e4e94e48e2f80142f29f50f44675dfe802c1c",
"body": "Add X-Upload-Post-Source header with value 'npm' to all outgoing API\nrequests, enabling server-side tracking to differentiate between\nn8n workflow and direct npm package usage.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(tracking): add source header to distinguish npm API requests (#12)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-23T00:07:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d933ab00cca990f77e87c2bb5afce9faf6ecbed",
"body": "…metrics endpoints (#11)\n\nExtend the analytics SDK with three new methods (getTotalImpressions,\ngetPostAnalytics, getPlatformMetrics) and add pageId/pageUrn options\nto getAnalytics. Includes full TypeScript declarations for all new\nendpoints and updated platform list to cover YouTube, TikTok, Threads,\nPinterest, and Reddit.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(analytics): add total impressions, post analytics, and platform …",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-21T10:15:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fcd5e0cd863cf489e06029e83966c37a7f7c1a24",
"body": "…(#10)\n\nAdd linkUrl, linkedinLinkUrl, and blueskyLinkUrl options to uploadText\nso that text-only posts can include link preview cards on LinkedIn,\nBluesky, and Facebook. A generic linkUrl serves as fallback when\nplatform-specific URLs are not provided.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(upload-text): add link preview support for LinkedIn and Bluesky …",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-20T14:48:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2de55c1036be6462a06b595b546997b37688e1fc",
"body": "Update CommonUploadOptions to treat title as an optional field.\nTikTok, Instagram, Facebook, LinkedIn, X, Threads, Bluesky, and\nPinterest no longer require a title, while YouTube, Reddit, and\ntext posts still do. Title is only sent in the request when provided.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(api): make title optional for platforms that don't require it (#9)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-20T14:48:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7e68ff9e11e6534f862133435f3b84f975b8f66c",
"body": "Release Staging to Production",
"is_bot": false,
"headline": "Merge pull request #8 from Upload-Post/staging",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-12T18:04:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81d1212001ef20dc373e75b5a112076292646c8a",
"body": "Add threadsThreadMediaLayout option to control how media items are\nsplit across multiple Threads posts, following the same pattern as\nxThreadImageLayout for X (Twitter).\n\nCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(threads): add threads_thread_media_layout parameter",
"author_name": "victormanuel.caverogracia",
"author_login": null,
"committed_at": "2026-02-12T17:37:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "09efd7ff155f0e65697befe23a4f4f8e11615d08",
"body": "Add support for Facebook VIDEO media type for normal page videos without\n9:16 aspect ratio restriction. Include thumbnailUrl parameter for custom\nvideo thumbnails on Facebook pages.\n\nAdd xThreadImageLayout parameter to configure image composition in X/Twitter\nthreads using comma-separated values (e.g. \"4,4\" or \"2,3,1\").\n\nUpdate TypeScript type definitions and API documentation to reflect new\noptions.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(upload-post-npm): Add Facebook VIDEO type and X thread layout (#6)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-09T13:06:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7f47d7213c0c321f9349bf6b8f2c740a02eb9cae",
"body": "Introduce new configuration options for white-label calendar integration. Add showCalendar, readonlyCalendar, connectTitle, and connectDescription parameters to generateJwt method. This enables clients to display a read-only calendar view without account connection or editing capabilities.\n\nCo-authored-by: AI Coder Bot <ai-coder@bot.local>",
"is_bot": false,
"headline": "feat(uploadpost): add read-only calendar white-label support (#4)",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2026-02-06T13:40:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "274829d412520a4598377ac12bc3c220749a8098",
"body": null,
"is_bot": false,
"headline": "ci: auto-publish on push to main when version changes",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-06T12:37:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bacf12e540a7af51353bc2d1ec1e70ac3a1dd769",
"body": null,
"is_bot": false,
"headline": "chore: bump to 2.0.3",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T07:23:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "35d9eacdc4d343e92e683c0e010a171aa5833df0",
"body": null,
"is_bot": false,
"headline": "fix: update axios and form-data to fix security vulnerabilities",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T07:21:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5556a9a38dc2c48586a4ac2437498c5f2428f3ba",
"body": null,
"is_bot": false,
"headline": "chore: use OIDC trusted publishing instead of NPM_TOKEN",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T07:15:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81adb42da72637c37e3783cbf185406b7fecd161",
"body": null,
"is_bot": false,
"headline": "fix: add NODE_AUTH_TOKEN to dry-run step and bump to v2.0.2",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:42:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3cc7060772a83aa734c2d89453b965840c0a065",
"body": null,
"is_bot": false,
"headline": "chore: bump to v2.0.1",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:41:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78b62340e431dbbe08c9c99e65355b89e18f4778",
"body": null,
"is_bot": false,
"headline": "fix: disable provenance to fix npm publish",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:41:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1891a6960d212e6413e9d08b1f87698de2b3e701",
"body": null,
"is_bot": false,
"headline": "fix: use git+ prefix in repository URL",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:39:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bcdbe48cdb7abd51903423a66ecd667552e2a091",
"body": null,
"is_bot": false,
"headline": "fix: correct repository URL case",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:38:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d732dd6c8487d7e2728662179458517d543b996",
"body": "Major update with all Upload-Post API features:\n\nNEW FEATURES:\n- Upload Document endpoint (LinkedIn PDF/PPT/DOC support)\n- User management (list, create, delete, generate JWT, validate JWT)\n- Scheduled posts (list, edit, cancel)\n- Analytics endpoint\n- Upload history\n- Facebook/LinkedIn pages helpers\n[…]\n type definitions\n- Better error handling\n- Comprehensive JSDoc documentation\n- Updated README with all features and examples\n\nBREAKING CHANGES:\n- Some parameter names updated for consistency with API",
"is_bot": false,
"headline": "feat: v2.0.0 - Complete API update",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:37:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "86f7a61bbb73e5448966fe7cfe610ea10b4cccf3",
"body": null,
"is_bot": false,
"headline": "ci: fix npm version for trusted publishing (requires 11.5.1+)",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:23:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bb500568a4ff094929a052c8c5efe40beb858776",
"body": null,
"is_bot": false,
"headline": "ci: add manual trigger with dry-run for testing",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-04T00:08:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f78dbac2769135fbb567a9211669c6d206e8c1fe",
"body": null,
"is_bot": false,
"headline": "ci: switch to OIDC trusted publishing (no tokens needed)",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-03T23:54:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a309321b67ce2767c6707468ac3ee08930efd35d",
"body": null,
"is_bot": false,
"headline": "ci: add auto-publish to npm on release",
"author_name": "root",
"author_login": null,
"committed_at": "2026-02-03T23:52:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "23794d59067d031c0ff8bd070572b64c8ae7b2e6",
"body": null,
"is_bot": false,
"headline": "1.0.3",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-06-24T10:39:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a21e355e094f20b38d177c3ae78fdd919faefed",
"body": null,
"is_bot": false,
"headline": "1.0.2",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-06-24T10:38:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "118ff445781d7f992e86532f2752e46e94a1a1fd",
"body": "…oads. Introduce new interfaces for UploadPhotosOptions and UploadTextOptions in TypeScript definitions. Update README with detailed usage examples for video, photo, and text uploads, including platform-specific parameters.",
"is_bot": false,
"headline": "Enhance upload functionality by adding support for photo and text upl…",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-06-24T10:37:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e3b79f548a850ada18ea421c97053851baa4c3c",
"body": null,
"is_bot": false,
"headline": "Add first version",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-04-03T16:40:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbf1d37914f8b947c5f800947c348850df192fd9",
"body": null,
"is_bot": false,
"headline": "first commit",
"author_name": "victorcavero14",
"author_login": "victorcavero14",
"committed_at": "2025-04-03T16:40:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe426095c7acb74ee596bfb50c4bbfcaf2438f87",
"body": null,
"is_bot": false,
"headline": "Initial commit",
"author_name": "Víctor Cavero",
"author_login": "victorcavero14",
"committed_at": "2025-04-03T16:36:19Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 4,
"commits_last_year": 48,
"latest_release_at": "2026-02-04T07:23:24Z",
"latest_release_tag": "v2.0.3",
"releases_from_tags": false,
"days_since_last_push": 6,
"active_weeks_last_year": 13,
"days_since_latest_release": 173,
"mean_days_between_releases": 0.1
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 50,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "upload-post",
"exists": true,
"license": "MIT",
"keywords": [
"social-media",
"video-upload",
"photo-upload",
"tiktok",
"instagram",
"youtube",
"linkedin",
"facebook",
"pinterest",
"threads",
"reddit",
"bluesky",
"twitter",
"x",
"api-client",
"social-media-api",
"upload-post"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/upload-post",
"is_deprecated": false,
"latest_version": "2.8.1",
"repository_url": "https://github.com/Upload-Post/upload-post-npm",
"versions_count": 14,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4012,
"first_published_at": "2025-02-14T18:30:04.008000Z",
"latest_published_at": "2026-07-20T20:15:21.248000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
}
]
},
"popularity": {
"forks": 2,
"stars": 6,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2025-12-12",
"count": 1
},
{
"date": "2026-01-08",
"count": 1
}
],
"complete": true,
"collected": 2,
"total_forks": 2
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 58134,
"source_files_sampled": 2,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 30,
"malicious_count": 0,
"assessed_package": "npm:upload-post@2.8.1",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "axios",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.6.2"
},
{
"name": "form-data",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^4.0.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "axios",
"direct": true,
"version": "1.13.4",
"ecosystem": "npm"
},
{
"name": "form-data",
"direct": true,
"version": "4.0.5",
"ecosystem": "npm"
},
{
"name": "@types/node",
"direct": false,
"version": "20.17.19",
"ecosystem": "npm"
},
{
"name": "asynckit",
"direct": false,
"version": "0.4.0",
"ecosystem": "npm"
},
{
"name": "call-bind-apply-helpers",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "combined-stream",
"direct": false,
"version": "1.0.8",
"ecosystem": "npm"
},
{
"name": "delayed-stream",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "dunder-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "es-define-property",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "es-errors",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "es-object-atoms",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "es-set-tostringtag",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "follow-redirects",
"direct": false,
"version": "1.15.9",
"ecosystem": "npm"
},
{
"name": "function-bind",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "get-intrinsic",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "get-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "gopd",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "has-symbols",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "has-tostringtag",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "hasown",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "math-intrinsics",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "mime-db",
"direct": false,
"version": "1.52.0",
"ecosystem": "npm"
},
{
"name": "mime-types",
"direct": false,
"version": "2.1.35",
"ecosystem": "npm"
},
{
"name": "proxy-from-env",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "typescript",
"direct": false,
"version": "5.7.3",
"ecosystem": "npm"
},
{
"name": "undici-types",
"direct": false,
"version": "6.19.8",
"ecosystem": "npm"
}
],
"collected": true,
"truncated": false,
"total_count": 26,
"direct_count": 2,
"indirect_count": 24
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 26,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 2,
"closed_unmerged_prs": 5
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "victorcavero14",
"commits": 31,
"avatar_url": "https://avatars.githubusercontent.com/u/33009505?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": false,
"ci_workflows": [
"publish.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/29 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 3,
"reason": "dependency not pinned by hash detected -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 9,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "31 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "850ea21fcb05530f83de78f964bd8bd09a87f62a",
"ran_at": "2026-07-27T12:35:48Z",
"aggregate_score": 4.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-20T20:15:24Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-05-18T12:25:07Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/Upload-Post/upload-post-npm",
"host": "github.com",
"name": "upload-post-npm",
"owner": "Upload-Post"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"security": 56,
"vitality": 78,
"community": 37,
"governance": 56,
"engineering": 44
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 78,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"commits_last_year": 48,
"human_commit_share": 1,
"days_since_last_push": 6,
"active_weeks_last_year": 13
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "13/52 weeks with commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 13
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "48 commits in the last year",
"points": 15.2,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 48
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 90,
"inputs": {
"releases_count": 4,
"latest_release_tag": "v2.0.3",
"releases_from_tags": false,
"days_since_latest_release": 173,
"mean_days_between_releases": 0.1
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "4 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 4
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 173 days ago",
"points": 27,
"status": "partial",
"details": [
{
"code": "release_recency",
"params": {
"days": 173
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.1 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.1
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 6,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 6 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 6
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 37,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 11,
"inputs": {
"forks": 2,
"stars": 6,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "6 stars",
"points": 11.3,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 6
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "2 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 2
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"packages": [
"upload-post"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 4012
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "4,012 downloads/month across npm",
"points": 48,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 4012,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 56,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 79,
"inputs": {
"merged_prs": 26,
"open_issues": 0,
"closed_issues": 2,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 5
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "26/31 decided PRs merged",
"points": 32.1,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 26,
"decided": 31
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/29 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"followers": 40,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "Upload-Post",
"public_repos": 13,
"account_age_days": 479
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "40 followers of Upload-Post",
"points": 11.6,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 40,
"login": "Upload-Post"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "13 public repos, account ~1 yr old",
"points": 11,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 13
}
},
{
"code": "account_age_years",
"params": {
"years": 1
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"upload-post"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 6
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 6 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 6
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "14 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 14
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 44,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "critical",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"has_ci": true,
"has_tests": false,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [
"instagram-api",
"javascript",
"nodejs",
"sdk",
"social-media-api",
"tiktok-api",
"typescript",
"upload-post",
"youtube-api"
],
"has_wiki": true,
"homepage": "https://upload-post.com",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://upload-post.com",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "9 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 9
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 56,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 45,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 4.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/29 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "31 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:upload-post@2.8.1 runtime dependency closure — what installing the published package pulls in — 30 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:upload-post@2.8.1",
"assessed": 30
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 30,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 30,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 1
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "at_risk",
"name": "AI Readiness",
"value": 35,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.932,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "68 of 73 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 68,
"sampled": 73
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "critical",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 23,
"inputs": {
"has_nix": false,
"has_tests": false,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.247,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "18 of the last 73 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 18,
"sampled": 73
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "JavaScript",
"largest_source_bytes": 58134,
"source_files_sampled": 2,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "JavaScript without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "JavaScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/2 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 2,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-27T12:35:57.658042Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/u/Upload-Post/upload-post-npm.svg",
"full_name": "Upload-Post/upload-post-npm",
"license_state": "standard",
"license_spdx": "MIT"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with Upload-Post/upload-post-npm. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
