-
- GitHub
- GitLab
- Bitbucket
-
By logging in you accept
our terms of service
and privacy policy
Libraries.io is a free service that collects publicly available open source package information scraped from the internet. With it you can search 9.96M packages by license, language, or explore new, trending, or popular packages.
Data available via Libraries.io is scraped from the internet and not validated, corrected, or curated for accuracy. If you are looking to make important decisions about open source usage and management, consider our paid offering: The Tidelift Subscription.
The Tidelift Subscription provides a curated source of open source package data backed by Tidelift and our maintainer partners, who are paid to ensure their projects follow enterprise-grade secure software development practices, now and into the future.
The Tidelift Subscription provides deeper, more meaningful insights that allow you to evaluate latent risk indicators such as package maintenance and end-of-life status, evaluating code contributors and security measures such as two-factor-authentication to eliminate malicious code injections, and more.
The table below provides a deeper comparison of the differences between Libraries.io and the Tidelift Subscription.
| Libraries.io | Tidelift | |
|---|---|---|
| Package metadata | Read from package and source repository metadata, not validated for accuracy | Extensive and human-validated for accuracy |
| Paying maintainers to implement secure development practices and provide attestations (examples: 2FA status, security policy, and more) | Not included | Extensive data about practices and attestations made available only to customers |
| License data | Read from package metadata, not validated for accuracy | Analyzed, and manually validated for accuracy, also including normalized SPDX expression |
| Dependency insights | Limited insights only, not validated for accuracy | Extensive and human-validated for accuracy, and including dependency graph relationships |
| Vulnerability insights | Not included | CVE data ingested from multiple sources and mapped to specific versions, plus maintainer CVE reviews for impact, workarounds, and false positive identification |
| Maintenance status, including deprecation, end-of-life, and package rename insights | Not included | Extensive and human-validated for accuracy |
| Release and usage recommendations | Not included | Extensive and human-validated for accuracy |
| API access | Limited and rate restricted | Robust set of APIs, enterprise support and SLA, and rate customizable |
| New package(s) assessment SLA | Not included | Package assessment SLAs included with Tidelift Subscription |
Package manager not listed above? Consider adding support for it.