picomatch

v4.0.7SAFE Risk

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

A+100/100

Install Command

npm install picomatch

orpnpm add picomatch

Typosquat Defense

Authentic Name

No similarity to known typosquatting targets.

Lifecycle Scripts

Clean Execution

Zero preinstall or postinstall arbitrary execution hooks.

License Type

MIT

Permissive open-source license. Safe for enterprise & proprietary software.

Package Specifications

Unpacked Size

91.6 KB

Dependencies

Maintainers

Last Published

Aug 24, 2026

View on npmjs.com GitHub Repository

Free VS Code Extension

Detect Supply Chain Attacks Directly in Your Editor

Get instant CodeLens risk scores, typosquatting warnings, and license audits right inside your package.json file with zero configuration.

Install Dependency Risk Lens

Frequently Asked Questions

Is picomatch safe to use in production?

picomatch received a Security Grade of A+ (100/100) with a risk evaluation of SAFE. It contains zero malicious postinstall scripts.

What license does picomatch use?

picomatch is licensed under the MIT license (PERMISSIVE). This is a permissive open-source license suitable for commercial applications.

How do I install picomatch?

Install it via NPM using: npm install picomatch, or via PNPM: pnpm add picomatch, or Yarn: yarn add picomatch.