Popper.js Project Due Diligence

Run due diligence on Popper.js Project: check compliance and get alerts when suppliers change.

Open Source · popper.js.org · 5 vendors

Popper.js is an open-source JavaScript library that provides a robust positioning engine for UI elements like tooltips, popovers, and dropdowns. It helps developers accurately place these "popper" elements relative to a reference element, handling complex layout scenarios and offering a modular, extensible architecture. It is now part of the Floating UI project.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 5 sub-vendors.

Insights

Last updated 2026-07-29 · revision 6

5 direct vendors, 76 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

3 in-scope frameworks identified; showing 3.

Open Source License Compliance — Evidence found

Evidence: https://github.com/popperjs/popper-core/blob/master/LICENSE.md, https://www.npmjs.com/package/@popperjs/core, https://opensource.org/licenses/MIT

Cyber Resilience Act (source) — No public evidence

Evidence: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402847, https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act, https://openssf.org/blog/2024/10/23/the-eu-cyber-resilience-act-and-open-source-software/

npm Registry — No public evidence

Evidence: https://www.npmjs.com/package/@popperjs/core, https://docs.npmjs.com/about-two-factor-authentication, https://openssf.org/, https://securityscorecards.dev/

Financials

Financial Resilience Score: 6/10

Popper.js is not a company but an open-source JavaScript library distributed under the MIT license, so traditional financial resilience analysis is not applicable. However, assessed as a project's sustainability and dependency risk, it demonstrates moderate resilience. Its massive adoption footprint—tens of millions of weekly npm downloads across the Popper/Floating UI family, and integration into major frameworks like Bootstrap 4/5 and Material UI—provides strong ecosystem stability and low abandonment risk. The successful transition to the successor project Floating UI, led by the same core maintainers, further mitigates continuity risk. On the risk side, the project has no revenue model, no formal governance entity, no treasury, and no board. Sustainability depends on volunteer time and ad-hoc sponsorships (GitHub Sponsors, Open Collective, or maintainer employers). Key-person risk is elevated since a small number of core maintainers historically carry most of the work. Popper v1 and v2 are effectively in maintenance mode, meaning existing users will eventually need to migrate to Floating UI. For counterparty/supply-chain purposes, existing deployments are reasonably safe given ubiquity and permissive licensing, but new projects should adopt Floating UI instead.

Key strengths: Massive adoption with tens of millions of weekly npm downloads across Popper/Floating UI family, Dependency of major frameworks including Bootstrap 4/5 and Material UI, Active successor project (Floating UI) led by same core maintainers reduces abandonment risk, Permissive MIT license eliminates vendor lock-in and licensing revenue risk, Global community contributions via GitHub reduce single-maintainer risk

Risk factors: No revenue model; sustainability depends on volunteer time and sponsorships, Key-person risk from small number of core maintainers, Popper v1 and v2 in maintenance mode, requiring eventual user migration to Floating UI, No formal governance entity, treasury, board, or legal protection (unlike OpenJS Foundation projects), No legal entity registered in any national company register

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report