Is bcrypt healthy, maintained, and safe?
Maintained, but watch it — bcrypt has real signals (drift, thin maintenance, or advisories) worth tracking.
The verdict
OSPulse scores bcrypt at 47/100 (medium risk), computed deterministically from live npm release history, maintainer data, and the OSV vulnerability database. Maintained, but watch it — bcrypt has real signals (drift, thin maintenance, or advisories) worth tracking.
Nothing has shipped since 11 May 2025 — over a year ago (441 days) — which points to a dormant project. Historically it released far more frequently, so the current silence reads as a genuine collapse in velocity rather than a natural gap. 5 maintainers are listed on npm, so the project isn't hostage to any single contributor.
OSV lists 1 known advisory for bcrypt, of assorted severity. Review whether your version is in the affected range and whether a fixed release is available before depending on it. Each advisory is listed with its OSV/GHSA identifier below.
bcrypt is usable but carries real signals — pin versions, watch for new advisories, and keep a fallback in mind. This is a one-time snapshot of a single package — real projects depend on dozens or hundreds of packages, and any one of them can drift or be compromised between releases. Run your own package.json through the free health check, or have OSPulse monitor your whole dependency tree continuously.
Evidence trail — deterministic, auditable
Known vulnerabilities (1)
Integer Overflow or Wraparound and Use of a Broken or Risky Cryptographic Algorithm in bcrypt
Key facts
- Latest version
- v6.0.0
- Last release
- 11 May 2025 (441 days ago)
- Total releases
- 55
- First release
- 21 February 2011
- Package age
- 15.4 years
- Maintainers
- 5
- Known advisories
- 1
- Confidence
- High
Frequently asked
Is bcrypt still maintained?
Partly — the most recent release was 11 May 2025 (441 days ago), so maintenance has slowed but not fully stopped.
Does bcrypt have known security vulnerabilities?
Yes — OSV lists 1 advisory for bcrypt. See the advisory list on this page for the OSV/GHSA identifiers.
Is bcrypt safe to use?
Maintained, but watch it — bcrypt has real signals (drift, thin maintenance, or advisories) worth tracking. OSPulse rates it 47/100 (medium risk) based on release recency, cadence, maintainer bus factor and known vulnerabilities.
Other npm packages we've checked
bcrypt is one package. What about the other hundreds in your tree?
Paste your own package.json into the free health check for an instant snapshot — or let OSPulse monitor your whole dependency tree continuously, before your CVE scanner wakes up.
Data from the npm registry & OSV.dev · snapshot generated 2026-07-27 · scores are deterministic and recomputed on each refresh.