Windows results for 599 npm packages
Every package I scanned, and what was found. Each of the 48
JavaScript findings was read by hand and classified —
because a count of findings is not a count of bugs. A further
214 findings are in package.json scripts,
which break the build for a Windows contributor rather than for anyone
installing the package. Link to any row directly.
Loading…
looks genuinely broken deliberately Linux-only my checker was wrong hostile npm script
How to read this
A flag is not a verdict. Four fifths of what turned up is code
that is POSIX-only on purpose — pm2 writing
/etc/init.d because its startup feature is
Linux, oclif running ln -s in the script that builds a
Debian package. A checker that reads text cannot see intent, so I
read each one and said which it was. You are free to disagree; every
row names the file and line.
The script column means something different from the JS
column. npm runs a package's own scripts on your machine only
at install time, and just two of the 214 script findings are
install-time scripts. The rest are build,
test and clean — so a package flagged
here almost certainly installs and runs fine for you, and would stop a
Windows contributor at the first npm test.
A clean result means these specific patterns were absent. It is not a promise that the package runs on Windows — path lengths, file locking and antivirus only show up when code actually runs.
Scanned on 7 September 2026 against each package's then-latest published version, which is recorded per row. Full write-up: I scanned the 600 most-downloaded npm CLI packages. To check your own code, paste it into the browser checker — nothing is uploaded.