DIYgod/RSSHub
🧡 Everything is RSSible
46.5k stars · 10.3k forks · TypeScript
At risk
At risk: a high-severity security advisory affects the latest version.
Why
- The latest version of npm package rsshub has 2 high-severity security advisories (GHSA-64wp-jh9p-5cg2, GHSA-pgjj-866w-fc5c). (source 1, source 2, source 3, source 4, source 5, source 6, source 7)
- One person wrote 99% of human commits in the last year, so the project depends on them continuing. (source 1, source 2)
What would change this
- The latest version is patched or the advisory is withdrawn.
- A second person takes a substantial share of commits.
- Partly checked: maintenance (Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share.; Authors in the last 90 days are counted from the sampled commits only.)
Maintenance
PartialActive
- Human commits, 30 days
- 2.2k
- Human commits, 90 days
- 2.7k
- Human commits, 365 days
- 4.6k
- Bot share of commits, 365 days
- 0%
- Last commit
- Oct 14, 2026 (16 hours ago)
- Last human commit
- Oct 14, 2026 (16 hours ago)
- Authors, 90 days
- 2
- Last release
- Oct 14, 2026 (16 hours ago)
- Median PR merge time
- 1 hour
Responsiveness: of 30 recent issues, 73% got a maintainer reply. Median first response: 27 days.
- Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share.
- Authors in the last 90 days are counted from the sampled commits only.
Sources: Commits, Releases, Merged pull requests, Issues
People
Complete- Owner
- Personal account
- Commits sampled
- 499 since Oct 14, 2025
- Authors for half of commits
- 1
- Authors for 80% of commits
- 1
- Contributors
- 423
Top committers
- DIYgod: 99% of commits
- pseudoyu: 1% of commits
- Shares come from the newest sampled commits, since the commit sample is capped.
Sources: Commits, Contributors
Stars
CompleteOrganic, confidence high
Bursts
- May 13, 2018 to May 24, 2018: about 948 more stars than usual, peak 214 in one day, a spike that tapers off. We couldn't check for an outside explanation.
- Jul 3, 2018 to Jul 3, 2018: about 25 more stars than usual, peak 31 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- Aug 28, 2018 to Sep 7, 2018: about 653 more stars than usual, peak 262 in one day, a spike that tapers off. Outside explanation: a Hacker News post, a jump in forks, a jump in issues and pull requests.
- Jan 1, 2019 to Jan 3, 2019: about 115 more stars than usual, peak 76 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- Aug 14, 2020 to Aug 16, 2020: about 54 more stars than usual, peak 41 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- Aug 21, 2020 to Aug 26, 2020: about 627 more stars than usual, peak 368 in one day, a spike that tapers off. Outside explanation: a Hacker News post, a jump in forks.
- Nov 27, 2022 to Nov 29, 2022: about 152 more stars than usual, peak 89 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- Mar 3, 2024 to Mar 5, 2024: about 125 more stars than usual, peak 94 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
- Jul 27, 2025 to Jul 28, 2025: about 63 more stars than usual, peak 55 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
- Oct 12, 2025 to Oct 14, 2025: about 190 more stars than usual, peak 148 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
- 10 stars GitHub has since removed (tracked since Oct 13, 2026).
Anyone can buy stars for any repo; bursts alone don't prove the owner did.
- The star history looks organic.
Sources: How star history is analyzed
Risk
CompleteFlags
- High: OSV, via deps.dev, lists GHSA-64wp-jh9p-5cg2, GHSA-pgjj-866w-fc5c at HIGH severity on the latest version of rsshub. Details
- Warning: OSV, via deps.dev, lists GHSA-32gr-4cq6-5w5q, GHSA-3p3p-cgj7-vgw3, GHSA-jvxx-v45p-v5vf at MODERATE, LOW or unrated severity on the latest version of rsshub. Details
- Info: The license file changed from MIT to AGPL-3.0 within the last year (GitHub commit history). Details
License
- Now
- AGPL-3.0 (OSI-approved)
- A year ago
- MIT (OSI-approved)
The license changed in the last year.
Packages
- rsshub (NPM): latest 1.0.0-master.66411e5, published Oct 14, 2026
Advisories for the latest version: GHSA-32gr-4cq6-5w5q (moderate), GHSA-3p3p-cgj7-vgw3 (moderate), GHSA-64wp-jh9p-5cg2 (high), GHSA-jvxx-v45p-v5vf (moderate), GHSA-pgjj-866w-fc5c (high)
Package and advisory data: deps.dev and OSV.
OpenSSF Scorecard: 6.4 out of 10 (via deps.dev).
Sources: GitHub: DIYgod/RSSHub, deps.dev: npm rsshub, OSV: GHSA-32gr-4cq6-5w5q, OSV: GHSA-3p3p-cgj7-vgw3, OSV: GHSA-64wp-jh9p-5cg2, OSV: GHSA-jvxx-v45p-v5vf, OSV: GHSA-pgjj-866w-fc5c
Badge
Add this to a README to show the current verdict:
[](https://reporadar.ai/DIYgod/RSSHub)Earlier verdicts
- Oct 14, 2026: At risk
- Oct 13, 2026: At risk
- Oct 13, 2026: At risk