JavaScript is everywhere, with 98.7% of websites using it as of 2023, yet the ecosystem keeps shifting fast, from React on 40.58% of sites to npm topping 2.3M packages in 2024. At the same time, performance benchmarks still favor the engines running this code and Node.js v20 averages about 50ms startup, while security data flags 1.2M reported vulnerabilities in 2023. This mix of dominance and risk makes the details more interesting than you might expect.
Key Takeaways
- JavaScript is used by 98.7% of all websites as of 2023
- Node.js powers 1.2% of all websites directly
- JavaScript frameworks like React are used on 40.58% of sites
- 92% of devs want to continue with JS
- React retention 78%, highest framework
- Node.js used by 68% backend devs
- npm registry has 2.3M packages as of 2024
- Weekly npm downloads 30B+
- React npm downloads 50M/week
- V8 engine scores 300+ on Speedometer 3.0
- SpiderMonkey (Firefox) 280 on Speedometer 3.0
- JavaScriptCore (Safari) 250 on Speedometer 3.0
- 1.2M vulns reported in JS pkgs 2023
- 70% of npm audits find high-sev issues
- Malicious pkgs 1k+ removed 2023
JavaScript still dominates the web and npm ecosystem, with React and Node leading despite rising security concerns.
Related reading
02 · Category
Developer Preferences30 stats
01
92% of devs want to continue with JS
02
React retention 78%, highest framework
03
Node.js used by 68% backend devs
04
TypeScript preferred by 70% over JS
05
Vue.js awareness 89%, usage 40%
06
Svelte interest 62%
07
Angular usage down to 17%
08
Next.js most wanted backend 55%
09
Express.js used by 55% Node devs
10
Tailwind CSS adopted by 60%
11
Vite build tool 70% preference
12
ESLint used by 85%
13
Prettier formatting 92%
14
Webpack still 60% despite decline
15
Deno interest 45%, usage 8%
16
Bun excitement 75%
17
GraphQL used by 35% API devs
18
tRPC rising to 20%
19
Zustand state mgmt 40%
20
Remix framework 25% interest
21
75% devs use VS Code for JS
22
JetBrains IDEs 30% for JS
23
55% use macOS for JS dev
24
Remote work 40% prefer JS stacks
25
82% satisfaction with JS ecosystem
26
65% of devs learn JS first language
27
Solid.js niche but 30% interest
28
Qwik framework awareness 50%
29
70% use JS for fullstack
30
Rust-WASM interest 25% among JS devs
Interpretation
Developer Preferences Interpretation
From a developer preferences perspective, teams are overwhelmingly leaning toward JavaScript ecosystems, with 92% wanting to continue using JS and React leading framework retention at 78%, while TypeScript is increasingly preferred by 70% over plain JS.
03 · Category
Package Ecosystem29 stats
01
npm registry has 2.3M packages as of 2024
02
Weekly npm downloads 30B+
03
React npm downloads 50M/week
04
lodash 25M downloads/week
05
express 20M/week
06
typescript 15M/week
07
vite 12M/week growth 200%
08
tailwindcss 10M/week
09
next.js 8M/week
10
@tanstack/query 5M/week
11
Average package deps 15
12
40% packages have vulnerabilities
13
Scope @vercel 500+ pkgs
14
Unpublished pkgs 1% daily
15
JS package size avg 1.2MB installed
16
Top 100 pkgs 80% downloads
17
Yarn v3 used in 20% projects
18
pnpm installs 3x faster, 30% adoption
19
deno.land/x has 10k modules
20
jsr.io emerging with 5k pkgs
21
GitHub Packages JS 15% share
22
Weekly new JS pkgs 20k
23
Critical deps like axios 40M/week
24
Zustand overtakes Redux 2M/week
25
SWR data fetching 3M/week
26
Three.js 2M/week for 3D
27
Socket.io realtime 1.5M/week
28
Prisma ORM 4M/week growth
29
Drizzle ORM rising 500k/week
Interpretation
Package Ecosystem Interpretation
With npm now hosting about 2.3 million packages and serving 30 billion downloads each week, the package ecosystem is clearly dominated by a steady stream of high-traffic libraries like React at 50 million and lodash at 25 million weekly downloads.
More related reading
04 · Category
Performance Benchmarks28 stats
01
V8 engine scores 300+ on Speedometer 3.0
02
SpiderMonkey (Firefox) 280 on Speedometer 3.0
03
JavaScriptCore (Safari) 250 on Speedometer 3.0
04
Node.js v20 startup time 50ms avg
05
Deno cold start 2x slower than Bun
06
Bun v1 startup 1ms vs Node 100ms
07
React 18 renders 20% faster with concurrent
08
Svelte compiles to 30% smaller bundles
09
Vue 3 reactivity 2x faster than Vue 2
10
WebAssembly JS interop overhead 10ns/call
11
JS RegExp engine in V8 5x faster post-2021
12
Array.sort stable in Chrome 110+, 15% perf gain
13
Temporal API proposals show 40% date perf boost
14
Node.js cluster scales to 1M req/s on multi-core
15
Fastify 2x throughput vs Express
16
Nitro engine 50k req/s on edge
17
JS BigInt ops 3x faster in V8 10.7
18
Promise.allSettled 25% faster than polyfills
19
Async iterators yield 10% less memory
20
JS Proxy traps overhead <5% modern engines
21
SWC transpiler 20x faster than Babel
22
esbuild bundles 100x faster than Webpack
23
Rollup tree-shaking removes 40% dead code
24
Terser minification 15% gzip size reduction
25
Chrome DevTools CPU profiling 95% accurate
26
Node --inspect flags 2% overhead
27
Web Workers parallelism boosts 80% on multi-core
28
OffscreenCanvas JS rendering 3x FPS
Interpretation
Performance Benchmarks Interpretation
In performance benchmarks, the gap between JavaScript runtimes is stark, with Speedometer 3.0 reaching 300+ on V8 while other engines like SpiderMonkey at 280 and JavaScriptCore at 250 trail, and startup times also diverge dramatically with Bun starting in 1ms versus Node at about 100ms.
05 · Category
Vulnerabilities & Security25 stats
01
1.2M vulns reported in JS pkgs 2023
02
70% of npm audits find high-sev issues
03
Malicious pkgs 1k+ removed 2023
04
Prototype pollution vulns 500+ in lodash-like
05
XSS in 20% client-side libs
06
Node.js vulns 300 CVEs 2023
07
Supply chain attacks 40% target JS
08
85% breaches involve unpatched JS deps
09
EventStream malicious 8M downloads
10
ua-parser-js compromised 2021
11
Typosquatting pkgs 10k attempts/year
12
Snyk blocks 1B vulns/year in JS
13
OWASP Top10 A06: JS injection 15%
14
CORS misconfig in 30% Node apps
15
50% JS apps lack helmet security
16
Rate limiting missing 60% Express apps
17
CSRF vulns 25% React apps
18
90% devs ignore npm audit warnings
19
Log4Shell equiv in JS: 200+ vulns
20
Phishing pkgs target 2FA 100 cases
21
Dependabot alerts 50M for JS
22
Socket.dev scans 1M JS projects daily
23
35% vulns in transitive deps
24
JS sandbox escapes 5% sandboxed envs
25
SSRF via fetch in Node 10% apps
Interpretation
Vulnerabilities & Security Interpretation
Security concerns in JavaScript are escalating sharply, with 1.2M vulnerabilities reported in JS packages in 2023 and 70% of npm audits turning up high severity issues.
report visual · Breakdown
JavaScript’s web dominance
JavaScript is ubiquitous on the web, while key JS sub-stacks (frameworks and Node.js) remain far smaller shares.
98.7%
JavaScript is used by 98.7% of all websites as of 2023
1.2%
Node.js powers 1.2% of all websites directly
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Helena Kowalczyk. (2026, February 13). Javascript Statistics. Gitnux. https://gitnux.org/javascript-statistics
MLA
Helena Kowalczyk. "Javascript Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/javascript-statistics.
Chicago
Helena Kowalczyk. 2026. "Javascript Statistics." Gitnux. https://gitnux.org/javascript-statistics.
Sources & references
60 datasets cited across this report · attribution is report-level