{"id":13527824,"url":"https://github.com/paypal/paypal-checkout-components","last_synced_at":"2025-12-12T02:52:07.064Z","repository":{"id":37502858,"uuid":"64877453","full_name":"paypal/paypal-checkout-components","owner":"paypal","description":"please submit Issues about the PayPal JS SDK here: https://github.com/paypal/paypal-js/issues","archived":false,"fork":false,"pushed_at":"2025-12-05T17:48:21.000Z","size":368173,"stargazers_count":1307,"open_issues_count":9,"forks_count":595,"subscribers_count":122,"default_branch":"main","last_synced_at":"2025-12-06T04:55:15.178Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/paypal.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2016-08-03T20:34:03.000Z","updated_at":"2025-12-04T22:31:56.000Z","dependencies_parsed_at":"2022-07-13T09:20:32.084Z","dependency_job_id":"3441ed7b-0bfc-49da-bab3-ce509ba76cec","html_url":"https://github.com/paypal/paypal-checkout-components","commit_stats":{"total_commits":2937,"total_committers":100,"mean_commits":29.37,"dds":0.2805583929179435,"last_synced_commit":"2bd96eaf39311c8ffa6e49b8e6af8ebd76ee208e"},"previous_names":["paypal/paypal-checkout"],"tags_count":788,"template":false,"template_full_name":null,"purl":"pkg:github/paypal/paypal-checkout-components","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paypal%2Fpaypal-checkout-components","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paypal%2Fpaypal-checkout-components/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paypal%2Fpaypal-checkout-components/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paypal%2Fpaypal-checkout-components/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/paypal","download_url":"https://codeload.github.com/paypal/paypal-checkout-components/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paypal%2Fpaypal-checkout-components/sbom","scorecard":{"id":114208,"data":{"date":"2025-08-04","repo":{"name":"github.com/paypal/paypal-checkout-components","commit":"3ea5899c0f44eae4606145da81913a50b89f2780"},"scorecard":{"version":"v5.2.1-28-gc1d103a9","commit":"c1d103a9bb9f635ec7260bf9aa0699466fa4be0e"},"score":6.8,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#maintained"}},{"name":"Code-Review","score":7,"reason":"Found 20/28 approved changesets -- score normalized to 7","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#packaging"}},{"name":"Security-Policy","score":9,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/lock.yml:1","Warn: no topLevel permission defined: .github/workflows/main.yml:1","Warn: topLevel 'contents' permission set to 'write': .github/workflows/publish.yml:7","Warn: no topLevel permission defined: .github/workflows/stale.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#cii-best-practices"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/lock.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/lock.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/main.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/main.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/main.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/main.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/publish.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/publish.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/publish.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/paypal/paypal-checkout-components/stale.yml/main?enable=pin","Warn: npmCommand not pinned by hash: scripts/preversion.sh:27","Warn: downloadThenRun not pinned by hash: test/e2e/ci.sh:8","Warn: npmCommand not pinned by hash: test/e2e/ci.sh:20","Info:   0 out of   5 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   6 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#pinned-dependencies"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#binary-artifacts"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#license"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#vulnerabilities"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#branch-protection"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#fuzzing"}},{"name":"SAST","score":9,"reason":"SAST tool is not run on all commits -- score normalized to 9","details":["Warn: 21 commits out of 22 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/c1d103a9bb9f635ec7260bf9aa0699466fa4be0e/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-15T23:35:42.233Z","repository_id":37502858,"created_at":"2025-08-15T23:35:42.233Z","updated_at":"2025-08-15T23:35:42.233Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":27675309,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-12T02:00:06.775Z","response_time":129,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T06:02:02.963Z","updated_at":"2025-12-12T02:52:07.016Z","avatar_url":"https://github.com/paypal.png","language":"JavaScript","funding_links":["https://developer.paypal.com/docs/checkout/"],"categories":["JavaScript","Payments \u0026 Integrations"],"sub_categories":[],"readme":"## PayPal Checkout\n\n[![build status][build-badge]][build]\n[![code coverage][coverage-badge]][coverage]\n[![npm version][version-badge]][package]\n[![apache license][license-badge]][license]\n\n[build-badge]: https://img.shields.io/github/actions/workflow/status/paypal/paypal-checkout-components/main.yml?branch=main\u0026logo=github\u0026style=flat-square\n[build]: https://github.com/paypal/paypal-checkout-components/actions?query=workflow%3Abuild\n[coverage-badge]: https://img.shields.io/codecov/c/github/paypal/paypal-checkout-components.svg?style=flat-square\n[coverage]: https://codecov.io/github/paypal/paypal-checkout-components/\n[version-badge]: https://img.shields.io/npm/v/@paypal/checkout-components.svg?style=flat-square\n[package]: https://www.npmjs.com/package/@paypal/checkout-components\n[license-badge]: https://img.shields.io/npm/l/@paypal/checkout-components.svg?style=flat-square\n[license]: https://github.com/paypal/paypal-checkout-components/blob/main/LICENSE\n\nA set of components allowing easy integration of PayPal Buttons and PayPal Checkout into your site, powered by\n[zoid](https://github.com/krakenjs/zoid).\n\n## Dev Docs\n\nSee [**developer.paypal.com/docs/checkout**](https://developer.paypal.com/docs/checkout/)\n\n## Issues\n\nPlease submit any issues about the JS SDK here: https://github.com/paypal/paypal-js/issues\n\n---\n\n## Development\n\nPlease feel free to follow the [Contribution Guidelines](./CONTRIBUTING.md) to contribute to this repository. PRs are welcome, but for major changes please raise an issue first.\n\n### Quick Setup\n\nSet up your env:\n\n```bash\nnpm install\n```\n\nRun tests:\n\n```bash\nnpm test\n```\n\nRun in dev mode:\n\n```bash\nnpm run dev\n```\n\n## Testing Tasks\n\n```bash\nnpm test\n```\n\nRuns all testing tasks `lint`, `flow`, `karma`, `jest-ssr`, `jest-screenshot`, \u0026 `check-size`.\n\n| Flags         | Description                                  |\n| ------------- | -------------------------------------------- |\n| --clear-cache | Clear Babel Loader and PhantomJS cache       |\n| --debug       | Debug mode. PhantomJS, Karma, and CheckoutJS |\n| --quick       | Fastest testing. Minimal output, no coverage |\n| --browser     | Choose Browser                               |\n\n\u0026nbsp;\n\n### lint\n\n```bash\nnpm run lint\n\nnpm run lint -- --fix\n# attempt to automatically fix any problems\n```\n\nRuns [eslint](https://eslint.org/) using [definitions](./.eslinter.js) extended from [Grumbler-Scripts](https://github.com/krakenjs/@krakenjs/grumbler-scripts/blob/main/config/.eslintrc-browser.js).\n\n### flow\n\n```\nnpm run flow\n```\n\nChecks for typing issues using [Flow](https://flow.org/). Prior to running this task, `flow-typed` should be run to [generate type interfaces](https://github.com/flow-typed/flow-typed) for the various 3rd-party libraries we use.\n\n### karma\n\n```bash\nnpm run karma\n\nnpm run karma -- --keep-open\n# keeps the test browser window open to allow debugging\nnpm run karma -- --capture-console\n# dumps the browser's console output into the terminal\n```\n\nRuns [Karma](https://mochajs.org/) tests using the [Mocha](https://mochajs.org/) framework. Responsible for running the [test/e2e](./test/e2e/) \u0026 [test/integration](./test/integration) directories.\n\n### jest-ssr\n\n```bash\nnpm run jest-ssr\n```\n\nChecks for the correct rendering of components on the server-side using [Jest](https://jestjs.io/).\n\n### jest-screenshot\n\n```bash\nnpm run jest-screenshot\n```\n\nUses [Puppeteer](https://developers.google.com/web/tools/puppeteer) \u0026 [Jest](https://jestjs.io/) to take screenshots and checks against existing views to look for discrepancies. Tests are defined in [test/screenshot/config.js](./test/screenshot/config.js).\n\n### check-size\n\n```bash\nnpm run check-size\n```\n\nChecks to make sure that the compiled \u0026 gzipped bundle doesn't exceed the recommended size limit.\n\n## Releasing\n\nThis package is published weekly, **Every Wednesday**. Please [view our Changelog](CHANGELOG.md) to stay updated with bug fixes and new features.\n\n## Logo Strategy with paypal-sdk-logos\n\nOur usage of svg logos is optimized for performance. Here's how it works for the two-phased render for the Buttons component:\n\n- First Render - Buttons are first rendered on the client-side inside an `\u003ciframe\u003e` tag using the code bundled inside the JS SDK script. This `\u003ciframe\u003e` tag has no src attribute at this point in the rendering life cycle. We leverage the `__WEB__` global variable to determine if we are rendering client-side or server-side. The `__WEB__` global variable will equal true when rendering client-side. To minimize the bundle size of the JS SDK script, we load these svg logos from the www.paypalobjects.com CDN as external images (ex: `\u003cPayPalLogoExternalImage /\u003e`).\n\n- Second Render - The second phase of rendering happens on the server-side. This `\u003ciframe\u003e` tag is fully rendered by setting the src attribute and making an http request to the server to populate the contents which are securely hosted by PayPal's servers on www.paypal.com. The same code in this repo is used to render the buttons on the server-side. To ensure there are no issues with the logos, we have decided to inline the svg code for this server-side render (ex: `\u003cPayPalLogoInlineSVG /\u003e`). The `__WEB__` global variable is set to false to control what code executes during the server render.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaypal%2Fpaypal-checkout-components","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpaypal%2Fpaypal-checkout-components","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaypal%2Fpaypal-checkout-components/lists"}