Dependency health Workspace Pro coming soon

@ctrl/tinycolornpm

Documented supply-chain history

This package has dated incident reports relevant to its trust history. Check the affected releases and the response before drawing conclusions about its current version.

Read the incident coverage →

Vulnerabilities, end of life and next steps

Check a specific version for known advisories, documented mitigations and evidence-backed earlier-version options. Maintenance health is separate from vulnerability status.

Review remediation options →
What the project says about itself
  • Build provenance — the latest release, 4.2.1, carries a signed provenance attestation. Source: the registry.
  • Supported runtime — node >=14. Source: the registry.
  • Publishers on the registry — 1. Source: the registry.
  • OpenSSF Scorecard — 3.4 / 10 on 2026-08-24. Source: OpenSSF, via deps.dev. A third party's view of security practice, not part of the health score.

Third-party facts checked 20 days ago; registry facts on every crawl.

State history 2
WhenChange
2026-10-19 coasting → active
2026-09-12 first verdict: coasting
Supply-chain history 1

  1. malicious release 2025-09

    Compromised by the self-replicating Shai-Hulud worm, which stole developer credentials and republished itself through victims’ own packages.

    Cleaned and republished; the worm hit hundreds of packages before being contained.

    Source: Shai-Hulud npm worm reporting, September 2025. History, not a warning about today — the verdict above is about maintenance now.

Badge

maintenance: active

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/npm/@ctrl/tinycolor.svg)](https://isitdeadyet.dev/npm/@ctrl/tinycolor)

Watch it

Get told when @ctrl/tinycolor changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.