https://github.com/ericcornelissen/shescape
command-line escape-library security shell shell-injection shell-scripting
Score: 22.56846273127002
Last synced: about 16 hours ago
JSON representation
Repository metadata:
Simple shell escape library for JavaScript
- Host: GitHub
- URL: https://github.com/ericcornelissen/shescape
- Owner: ericcornelissen
- License: mpl-2.0
- Created: 2020-11-02T20:23:47.000Z (almost 6 years ago)
- Default Branch: main
- Last Pushed: 2026-08-21T05:55:33.000Z (5 days ago)
- Last Synced: 2026-08-21T16:36:54.655Z (5 days ago)
- Topics: command-line, escape-library, security, shell, shell-injection, shell-scripting
- Language: JavaScript
- Homepage:
- Size: 6.33 MB
- Stars: 9
- Watchers: 1
- Forks: 12
- Open Issues: 17
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Security: SECURITY.md
Owner metadata:
- Name: Eric Cornelissen
- Login: ericcornelissen
- Email:
- Kind: user
- Description:
- Website: https://www.ericcornelissen.dev/
- Location: Sweden
- Twitter:
- Company:
- Icon url: https://avatars.githubusercontent.com/u/3742559?v=4
- Repositories: 61
- Last Synced at: 2025-09-15T01:22:45.996Z
- Profile URL: https://github.com/ericcornelissen
GitHub Events
Total
- Create event: 532
- Delete event: 503
- Fork event: 2
- Issue comment event: 505
- Issues event: 35
- Pull request event: 912
- Pull request review comment event: 146
- Pull request review event: 147
- Push event: 728
- Release event: 6
- Watch event: 4
- Total: 3520
Last Year
- Create event: 227
- Delete event: 209
- Issue comment event: 257
- Issues event: 13
- Pull request event: 331
- Pull request review comment event: 55
- Pull request review event: 48
- Push event: 359
- Release event: 2
- Watch event: 2
- Total: 1503
Committers metadata
Last synced: 6 days ago
Total Commits: 2,003
Total Committers: 10
Avg Commits per committer: 200.3
Development Distribution Score (DDS): 0.445
Commits in past year: 370
Committers in past year: 5
Avg Commits per committer in past year: 74.0
Development Distribution Score (DDS) in past year: 0.535
| Name | Commits | |
|---|---|---|
| dependabot[bot] | 4****] | 1112 |
| Eric Cornelissen | e****n@g****m | 774 |
| ec-automation-bot[bot] | 1****] | 92 |
| github-actions[bot] | 4****] | 15 |
| ericcornelissen-release-bot[bot] | 1****] | 4 |
| Step Security Bot | b****t@s****o | 2 |
| Samantha Crespo | 1****o | 1 |
| Pol Rivero | 6****o | 1 |
| Oluwatosin Joseph Durodola | o****a@g****m | 1 |
| Nico Jansen | j****o@g****m | 1 |
Issue and Pull Request metadata
Last synced: 1 day ago
Total issues: 66
Total pull requests: 1,899
Average time to close issues: 7 months
Average time to close pull requests: 2 days
Total issue authors: 4
Total pull request authors: 7
Average comments per issue: 1.32
Average comments per pull request: 0.47
Merged pull request: 1,103
Bot issues: 8
Bot pull requests: 1,482
Past year issues: 12
Past year pull requests: 201
Past year average time to close issues: 13 days
Past year average time to close pull requests: 1 day
Past year issue authors: 2
Past year pull request authors: 3
Past year average comments per issue: 1.92
Past year average comments per pull request: 0.77
Past year merged pull request: 115
Past year bot issues: 0
Past year bot pull requests: 155
Top Issue Authors
- ericcornelissen (55)
- dependabot[bot] (8)
- dotkas (2)
- hamidb80 (1)
Top Pull Request Authors
- dependabot[bot] (1,413)
- ericcornelissen (411)
- ec-automation-bot[bot] (69)
- dotkas (2)
- Tosin-JD (2)
- nicojs (1)
- samkcrespo (1)
Top Issue Labels
- breaking change (16)
- enhancement (14)
- dependencies (12)
- meta (11)
- ci/cd (6)
- refactor (6)
- pending (6)
- documentation (5)
- question (5)
- test (4)
- help wanted (4)
- bug (3)
- security (3)
- fuzz (3)
- good first issue (2)
- performance (1)
- invalid (1)
- benchmark (1)
- out of scope (1)
Top Pull Request Labels
- dependencies (1,598)
- ci/cd (552)
- meta (170)
- test (87)
- fuzz (41)
- documentation (38)
- security (36)
- refactor (28)
- enhancement (20)
- bug (11)
- reverted (9)
- breaking change (8)
- benchmark (7)
- invalid (6)
- pending (4)
- performance (3)
- out of scope (1)
Package metadata
- Total packages: 2
-
Total downloads:
- npm: 60,965 last-month
- Total docker downloads: 24,282,626
- Total dependent packages: 15 (may contain duplicates)
- Total dependent repositories: 28 (may contain duplicates)
- Total versions: 133
- Total maintainers: 1
- Total advisories: 14
proxy.golang.org: github.com/ericcornelissen/shescape
- Homepage:
- Documentation: https://pkg.go.dev/github.com/ericcornelissen/shescape#section-documentation
- Licenses: mpl-2.0
- Latest release: v3.0.2+incompatible (published 25 days ago)
- Last Synced: 2026-08-24T18:07:45.477Z (1 day ago)
- Versions: 65
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.498%
- Average: 4.649%
- Dependent repos count: 4.8%
npmjs.org: shescape
simple shell escape library
- Homepage: https://github.com/ericcornelissen/shescape#readme
- Licenses: MPL-2.0
- Latest release: 3.0.2 (published 25 days ago)
- Last Synced: 2026-08-24T19:21:41.757Z (1 day ago)
- Versions: 68
- Dependent Packages: 15
- Dependent Repositories: 28
- Downloads: 60,965 Last month
- Docker Downloads: 24,282,626
-
Rankings:
- Docker downloads count: 0.269%
- Downloads: 0.982%
- Dependent packages count: 1.85%
- Dependent repos count: 2.459%
- Average: 5.056%
- Forks count: 7.528%
- Stargazers count: 17.251%
- Maintainers (1)
-
Advisories:
- Shescape: Quadratic-time denial of service in the flag-protection
- Shescape: Home-directory disclosure in assignment context on Unix with Dash
- Shescape: Shell injection via unescaped parentheses on Windows with CMD
- Shescape: Path disclosure on Unix with Zsh
- Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash
- Withdrawn Advisory: Shescape has possible misidentification of shell due to link chains
- Shescape has potential environment variable exposure on Windows with CMD
- Shescape on Windows escaping may be bypassed in threaded context
- Shescape potential environment variable exposure on Windows with CMD
- Inefficient Regular Expression Complexity in shescape
- Shescape vulnerable to insufficient escaping of whitespace
- Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD
- Exposure of home directory through shescape on Unix with Bash
- Null characters not escaped
Dependencies
.github/workflows/checks.yml
actions
- actions/cache 6998d139ddd3e68c71e9e398d8e40b71a2f39812 composite
- actions/checkout ac593985615ec2ede58e132d2e21d2b1cbd6127c composite
- actions/download-artifact 9bc31d5ccc31df68ecc42ccf4149144866c47d8a composite
- actions/setup-node 64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c composite
- actions/upload-artifact 0b7f8abb1508181956e8e162db84b466c27e18ce composite
- asdf-vm/actions/install 707e84f3ee349548310aeabdad0dd3bfcb9b69fa composite
- benchmark-action/github-action-benchmark c3efd4d54319dbc90622069cc273cba59b46abbf composite
- codecov/codecov-action d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 composite
- dorny/paths-filter 4512585405083f25c027a35db413c2b3b9006d50 composite
- github/codeql-action/analyze 8775e868027fa230df8586bdf502bbd9b618a477 composite
- github/codeql-action/init 8775e868027fa230df8586bdf502bbd9b618a477 composite
- step-security/harden-runner 18bf8ad2ca49c14cbb28b91346d626ccfb00c518 composite
.github/workflows/nightly.yml
actions
- actions/checkout ac593985615ec2ede58e132d2e21d2b1cbd6127c composite
- asdf-vm/actions/install 707e84f3ee349548310aeabdad0dd3bfcb9b69fa composite
- nick-fields/retry 943e742917ac94714d2f408a0e8320f2d1fcafcd composite
- peter-evans/create-pull-request d7db273d6c7206ba99224e659c982ae34a1025e3 composite
- step-security/harden-runner 18bf8ad2ca49c14cbb28b91346d626ccfb00c518 composite
- tibdex/github-app-token b62528385c34dbc9f38e5f4225ac829252d1ea92 composite
.github/workflows/publish.yml
actions
- actions/checkout ac593985615ec2ede58e132d2e21d2b1cbd6127c composite
- actions/github-script 98814c53be79b1d30f795b907e553d8679345975 composite
- actions/setup-node 64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c composite
- ncipollo/release-action a2e71bdd4e7dab70ca26a852f29600c98b33153e composite
- step-security/harden-runner 18bf8ad2ca49c14cbb28b91346d626ccfb00c518 composite
.github/workflows/release.yml
actions
- actions/checkout ac593985615ec2ede58e132d2e21d2b1cbd6127c composite
- actions/setup-node 64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c composite
- peter-evans/create-pull-request d7db273d6c7206ba99224e659c982ae34a1025e3 composite
- step-security/harden-runner 18bf8ad2ca49c14cbb28b91346d626ccfb00c518 composite
- tibdex/github-app-token b62528385c34dbc9f38e5f4225ac829252d1ea92 composite
.github/workflows/reusable-fuzz.yml
actions
- actions/cache 6998d139ddd3e68c71e9e398d8e40b71a2f39812 composite
- actions/checkout ac593985615ec2ede58e132d2e21d2b1cbd6127c composite
- actions/github-script 98814c53be79b1d30f795b907e553d8679345975 composite
- actions/setup-node 64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c composite
- actions/upload-artifact 0b7f8abb1508181956e8e162db84b466c27e18ce composite
- step-security/harden-runner 18bf8ad2ca49c14cbb28b91346d626ccfb00c518 composite
package-lock.json
npm
- 804 dependencies
package.json
npm
- @ericcornelissen/eslint-plugin-top 0.3.0 development
- @fast-check/ava 1.1.2 development
- @stryker-mutator/core 6.3.1 development
- ava 5.1.1 development
- benchmark 2.1.4 development
- c8 7.12.0 development
- depcheck 1.4.3 development
- dotenv 16.0.1 development
- eslint 8.33.0 development
- eslint-plugin-ava 14.0.0 development
- eslint-plugin-jsdoc 40.0.0 development
- eslint-plugin-json 3.1.0 development
- eslint-plugin-regexp 1.12.0 development
- eslint-plugin-yml 1.3.0 development
- fast-check 3.6.3 development
- husky 8.0.3 development
- is-ci 3.0.1 development
- jsfuzz 1.0.15 development
- licensee 10.0.0 development
- markdownlint-cli 0.33.0 development
- mocha 9.2.2 development
- prettier 2.8.4 development
- publint 0.1.9 development
- rollup 3.15.0 development
- sinon 15.0.1 development
- unimported 1.23.0 development
- which ^2.0.0
.github/workflows/audit-dev.yml
actions
- actions/checkout 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite
- actions/setup-node 5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d composite
- step-security/harden-runner 8ca2b8b2ece13480cda6dacd3511b49857a23c09 composite
.github/workflows/audit-release.yml
actions
- actions/checkout 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite
- actions/setup-node 5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d composite
- step-security/harden-runner 8ca2b8b2ece13480cda6dacd3511b49857a23c09 composite
.github/workflows/fuzz-bash.yml
actions
.github/workflows/fuzz-cmd.yml
actions
.github/workflows/fuzz-csh.yml
actions
.github/workflows/fuzz-dash.yml
actions
.github/workflows/fuzz-no-shell.yml
actions
.github/workflows/fuzz-powershell.yml
actions
.github/workflows/fuzz-zsh.yml
actions
.github/actions/ghasum/action.yml
actions
- main.js node24 javascript
.github/workflows/dependabot.yml
actions
- $/.github/actions/ghasum * composite
- actions/checkout 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 composite
- actions/create-github-app-token 1b10c78c7865c340bc4f6099eb2f838309f1e8c3 composite
- stefanzweifel/git-auto-commit-action 4a55954c782fc1ea30b9056cd3e7a2b40ca8887d composite
.github/workflows/weekly.yml
actions
- $/.github/actions/ghasum * composite
- actions/checkout v7.0.0 composite
- actions/create-github-app-token v3.1.1 composite
- actions/setup-node v7.0.0 composite
- peter-evans/create-pull-request v8.1.1 composite
.github/workflows/fuzz-busybox.yml
actions