Total Findings
49
All detected issues
KEV Findings
0
Known exploited
High EPSS
3
Likely to be exploited
Auto-merge ready
0
Remediation candidates
Affected pkgs
17
with remediation paths
KEV catalog
CISA's Known Exploited Vulnerabilities catalog. Documented active exploitation in the wild; the strongest 'this is happening now' signal.
Click for more →
0
actively exploited CVEs
Highest EPSS
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
69.1%
CVE-2020-7774
Active vetos
34
lens blocks on candidates
Findings
1 package with no automated fix
These advisories have no fix version Arguss can apply automatically. Review and remediate manually.
babel-traverse@6.24.1
-
babel-traverse@6.24.1EPSS 0.5% CVSS 9.9 critical
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
### Impact Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are: - `@babel/plugin-transform-runtime` - `@babel/preset-env` when using its [`useBuiltIns`](https://babeljs.io/docs/babel-preset-env#usebuiltins) option - Any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator` No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. **Users that only compile trusted code are not impacted.** ### Patches The vulnerability has been fixed in `@babel/traverse@7.23.2`. Babel 6 does not receive security fixes anymore (see [Babel's security policy](https://github.com/babel/babel/security/policy)), hence there is no patch planned for `babel-traverse@6`. ### Workarounds - Upgrade `@babel/traverse` to v7.23.2 or higher. You can do this by deleting it from your package manager's lockfile and re-installing the dependencies. `@babel/core` >=7.23.2 will automatically pull in a non-vulnerable version. - If you cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above, upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: - `@babel/plugin-transform-runtime` v7.23.2 - `@babel/preset-env` v7.23.2 - `@babel/helper-define-polyfill-provider` v0.4.3 - `babel-plugin-polyfill-corejs2` v0.4.6 - `babel-plugin-polyfill-corejs3` v0.8.5 - `babel-plugin-polyfill-es-shims` v0.10.0 - `babel-plugin-polyfill-regenerator` v0.5.3
Dependency path: root → nyc → istanbul-lib-instrument → babel-template → babel-traverse
y18n
@ 3.2.1
1 finding
high
Trust 0/100
EPSS 69.1% ↑
⚠ new maintainer
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
y18n
@ 3.2.1
3.2.1 → 3.2.2
patch
Max CVSS 7.3 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 69.1%
· 99th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
GHSA-c4w7-xm78-47vh: Prototype Pollution in y18n
Upgrade y18n from 3.2.1 to 3.2.2 or later
View advisory
root →
nyc →
yargs →
y18n
Blast radius
Paths from project root to y18n - which dependencies pulled this package in?
lodash
@ 4.17.4
10 findings
critical–medium
Trust 0/100
EPSS 22.4% ↑
⚠ new maintainer
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
lodash
@ 4.17.4
Prototype Pollution in lodash
lodash vulnerable to Code Injection via `_.template` imports key names
Prototype Pollution in lodash
Prototype Pollution in lodash
Command Injection in lodash
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Prototype Pollution in lodash
Regular Expression Denial of Service (ReDoS) in lodash
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
Regular Expression Denial of Service (ReDoS) in lodash
4.17.4 → 4.18.0
minor
Max CVSS 9.1 · 10 findings
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 22.4%
· 97th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
GHSA-jf85-cpcp-j695: Prototype Pollution in lodash
Upgrade lodash from 4.17.4 to 4.17.12 or later
View advisory
root →
nyc →
istanbul-lib-instrument →
babel-generator →
lodash
Blast radius
Paths from project root to lodash - which dependencies pulled this package in?
handlebars
@ 4.0.8
17 findings
critical–low
Trust 0/100
EPSS 7.1%
⚠ new maintainer
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
handlebars
@ 4.0.8
Handlebars.js has JavaScript Injection via AST Type Confusion
Prototype Pollution in handlebars
Remote code execution in handlebars when compiling templates
Prototype Pollution in handlebars
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Arbitrary Code Execution in Handlebars
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
Regular Expression Denial of Service in Handlebars
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Prototype Pollution in handlebars
Arbitrary Code Execution in handlebars
Arbitrary Code Execution in handlebars
Prototype Pollution in handlebars
Denial of Service in handlebars
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Handlebars.js has a Property Access Validation Bypass in container.lookup
4.0.8 → 4.7.9
minor
Max CVSS 9.8 · 17 findings
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 7.1%
· 93rd percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
GHSA-2w6w-674q-4c4q: Handlebars.js has JavaScript Injection via AST Type Confusion
Upgrade handlebars from 4.0.8 to 4.7.9 or later
View advisory
root →
nyc →
istanbul-reports →
handlebars
Blast radius
Paths from project root to handlebars - which dependencies pulled this package in?
2 findings
critical–medium
Trust 30/100
EPSS 4.6%
⚠ ownership transferred
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
Prototype Pollution in minimist
Prototype Pollution in minimist
0.0.8 → 0.2.4
minor
Max CVSS 9.8 · 2 findings
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 4.6%
· 90th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
trust.ownership_transferred
Veto: the package's primary maintainer changed during the upgrade window. Combined with new-maintainer, this is the highest-risk trust combination.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
- trust veto: package ownership transferred between versions
GHSA-xvch-5gv4-984h: Prototype Pollution in minimist
Upgrade minimist from 0.0.8 to 0.2.4 or later
View advisory
root →
nyc →
mkdirp →
minimist
Blast radius
Paths from project root to minimist - which dependencies pulled this package in?
1 finding
medium
Trust 0/100
EPSS 3.6%
⚠ ownership transferred
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
Regular Expression Denial of Service in hosted-git-info
2.4.2 → 2.8.9
minor
Max CVSS 5.3 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 3.6%
· 88th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
trust.ownership_transferred
Veto: the package's primary maintainer changed during the upgrade window. Combined with new-maintainer, this is the highest-risk trust combination.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
- trust veto: package ownership transferred between versions
GHSA-43f8-2h32-f4cj: Regular Expression Denial of Service in hosted-git-info
Upgrade hosted-git-info from 2.4.2 to 2.8.9 or later
View advisory
root →
nyc →
test-exclude →
read-pkg-up →
read-pkg →
normalize-package-data →
hosted-git-info
Blast radius
Paths from project root to hosted-git-info - which dependencies pulled this package in?
debug
@ 2.6.6
2 findings
high–low
Trust 30/100
EPSS 2.8%
⚠ new maintainer
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
debug
@ 2.6.6
debug Inefficient Regular Expression Complexity vulnerability
Regular Expression Denial of Service in debug
2.6.6 → 2.6.9
patch
Max CVSS 7.5 · 2 findings
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 2.8%
· 84th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
GHSA-9vvw-cc9w-f27h: debug Inefficient Regular Expression Complexity vulnerability
Upgrade debug from 2.6.6 to 2.6.9 or later
View advisory
root →
nyc →
istanbul-lib-instrument →
babel-traverse →
debug
Blast radius
Paths from project root to debug - which dependencies pulled this package in?
1 finding
high
Trust 0/100
EPSS 2.8%
⚠ ownership transferred
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
semver vulnerable to Regular Expression Denial of Service
5.3.0 → 5.7.2
minor
Max CVSS 7.5 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 2.8%
· 84th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
trust.ownership_transferred
Veto: the package's primary maintainer changed during the upgrade window. Combined with new-maintainer, this is the highest-risk trust combination.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
- trust veto: package ownership transferred between versions
GHSA-c2qf-rxjj-qqgw: semver vulnerable to Regular Expression Denial of Service
Upgrade semver from 5.3.0 to 5.7.2 or later
View advisory
root →
nyc →
istanbul-lib-instrument →
semver
Blast radius
Paths from project root to semver - which dependencies pulled this package in?
path-parse
@ 1.0.5
1 finding
medium
Trust 30/100
EPSS 2.2%
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
path-parse
@ 1.0.5
Regular Expression Denial of Service in path-parse
1.0.5 → 1.0.7
patch
Max CVSS 5.3 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 2.2%
· 80th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
GHSA-hj48-42vr-x3v9: Regular Expression Denial of Service in path-parse
Upgrade path-parse from 1.0.5 to 1.0.7 or later
View advisory
root →
nyc →
istanbul-lib-report →
path-parse
Blast radius
Paths from project root to path-parse - which dependencies pulled this package in?
minimatch
@ 3.0.3
4 findings
high
Trust 30/100
EPSS 1.7%
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
minimatch
@ 3.0.3
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
minimatch ReDoS vulnerability
3.0.3 → 3.1.4
minor
Max CVSS 7.5 · 4 findings
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 1.7%
· 74th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
GHSA-23c5-xmqv-rm74: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Upgrade minimatch from 3.0.3 to 3.1.4 or later
View advisory
root →
nyc →
glob →
minimatch
Blast radius
Paths from project root to minimatch - which dependencies pulled this package in?
braces
@ 1.8.5
1 finding
high
Trust 0/100
EPSS 1.5%
⚠ new maintainer
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
braces
@ 1.8.5
Uncontrolled resource consumption in braces
1.8.5 → 3.0.3
major
Max CVSS 7.5 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 1.5%
· 70th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
fix_kind.major
Veto: the available fix requires a major version bump (1.x → 2.x), which implies potential breaking changes outside the auto-merge envelope.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
- major version bump requires human review (never auto-merge)
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
GHSA-grv7-fg5c-xmjg: Uncontrolled resource consumption in braces
Upgrade braces from 1.8.5 to 3.0.3 or later
View advisory
root →
nyc →
micromatch →
braces
Blast radius
Paths from project root to braces - which dependencies pulled this package in?
micromatch
@ 2.3.11
1 finding
medium
Trust 0/100
EPSS 1.4%
⚠ new maintainer
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
micromatch
@ 2.3.11
Regular Expression Denial of Service (ReDoS) in micromatch
2.3.11 → 4.0.8
major
Max CVSS 5.3 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 1.4%
· 70th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
fix_kind.major
Veto: the available fix requires a major version bump (1.x → 2.x), which implies potential breaking changes outside the auto-merge envelope.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
- major version bump requires human review (never auto-merge)
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
GHSA-952p-6rrq-rcjv: Regular Expression Denial of Service (ReDoS) in micromatch
Upgrade micromatch from 2.3.11 to 4.0.8 or later
View advisory
root →
nyc →
micromatch
Blast radius
Paths from project root to micromatch - which dependencies pulled this package in?
randomatic
@ 1.1.6
1 finding
medium
Trust 0/100
EPSS 1.4%
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
randomatic
@ 1.1.6
Cryptographically Weak PRNG in randomatic
1.1.6 → 3.0.0
major
Max CVSS 5.3 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 1.4%
· 68th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
fix_kind.major
Veto: the available fix requires a major version bump (1.x → 2.x), which implies potential breaking changes outside the auto-merge envelope.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
- major version bump requires human review (never auto-merge)
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
GHSA-6g33-f262-xjp4: Cryptographically Weak PRNG in randomatic
Upgrade randomatic from 1.1.6 to 3.0.0 or later
View advisory
root →
nyc →
micromatch →
braces →
expand-range →
fill-range →
randomatic
Blast radius
Paths from project root to randomatic - which dependencies pulled this package in?
ms
@ 0.7.3
1 finding
medium
Trust 0/100
EPSS 1.0%
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
ms
@ 0.7.3
Vercel ms Inefficient Regular Expression Complexity vulnerability
0.7.3 → 2.0.0
major
Max CVSS 5.3 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 1.0%
· 58th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
fix_kind.major
Veto: the available fix requires a major version bump (1.x → 2.x), which implies potential breaking changes outside the auto-merge envelope.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
- major version bump requires human review (never auto-merge)
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
GHSA-w9mr-4mfr-499f: Vercel ms Inefficient Regular Expression Complexity vulnerability
Upgrade ms from 0.7.3 to 2.0.0 or later
View advisory
root →
eslint →
debug →
ms
Blast radius
Paths from project root to ms - which dependencies pulled this package in?
cross-spawn
@ 4.0.2
1 finding
high
Trust 30/100
EPSS 0.9%
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
cross-spawn
@ 4.0.2
Regular Expression Denial of Service (ReDoS) in cross-spawn
4.0.2 → 6.0.6
major
Max CVSS 7.5 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 0.9%
· 54th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
fix_kind.major
Veto: the available fix requires a major version bump (1.x → 2.x), which implies potential breaking changes outside the auto-merge envelope.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
- major version bump requires human review (never auto-merge)
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
GHSA-3xgq-45jj-v275: Regular Expression Denial of Service (ReDoS) in cross-spawn
Upgrade cross-spawn from 4.0.2 to 6.0.6 or later
View advisory
root →
nyc →
foreground-child →
cross-spawn
Blast radius
Paths from project root to cross-spawn - which dependencies pulled this package in?
yargs-parser
@ 5.0.0
1 finding
medium
Trust 0/100
EPSS 0.5%
⚠ new maintainer
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
yargs-parser
@ 5.0.0
yargs-parser Vulnerable to Prototype Pollution
5.0.0 → 5.0.1
patch
Max CVSS 5.3 · 1 finding
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 0.5%
· 40th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
trust.new_maintainer
Veto: a new publishing identity was added between your current version and the upgrade target. A well-documented supply chain attack vector.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
- trust veto: new maintainer added
GHSA-p9pc-299p-vxgp: yargs-parser Vulnerable to Prototype Pollution
Upgrade yargs-parser from 5.0.0 to 5.0.1 or later
View advisory
root →
nyc →
yargs-parser
Blast radius
Paths from project root to yargs-parser - which dependencies pulled this package in?
brace-expansion
@ 1.1.7
3 findings
medium–low
Trust 0/100
EPSS 0.5%
REVIEW
Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk.
Click for more →
brace-expansion
@ 1.1.7
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
brace-expansion Regular Expression Denial of Service vulnerability
1.1.7 → 1.1.16
patch
Max CVSS 6.5 · 3 findings
Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency.
Click for more →
Max EPSS 0.5%
· 37th percentile
Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity.
Click for more →
pipeline.test_reality
Veto: Arguss can't verify tests will run on upgraded code. Needs a test script in package.json, real test files, and a workflow that runs them.
Click for more →
- CI workflow doesn't run tests reliably; can't verify upgrade safety.
GHSA-f886-m6hf-6m8v: brace-expansion: Zero-step sequence causes process hang and memory exhaustion
Upgrade brace-expansion from 1.1.7 to 1.1.13 or later
View advisory
root →
eslint →
minimatch →
brace-expansion
Blast radius
Paths from project root to brace-expansion - which dependencies pulled this package in?
Package status
403 packages scanned.
- 16 Review-required candidates Arguss flagged these for a human decision - nothing merges until you review them.
- 1 Package with no automated fix
-
- @ljharb/eslint-config 21.4.0 direct
- auto-changelog 2.6.0 direct
- encoding 0.1.13 direct
- eslint 8.8.0 direct
- in-publish 2.0.1 direct
- npmignore 0.3.5 direct
- nyc 10.3.2 direct
- safe-publish-latest 2.0.0 direct
- tape 5.10.2 direct
- @eslint/eslintrc 1.4.1
- @eslint/eslintrc 2.1.4
- @humanwhocodes/config-array 0.9.5
- @humanwhocodes/object-schema 1.2.1
- @ljharb/now 1.0.1
- @ljharb/resumer 0.1.3
- @ljharb/through 2.3.14
- acorn 8.17.0
- acorn-jsx 5.3.2
- ajv 6.15.0
- align-text 0.1.4
- amdefine 1.0.1
- ansi-regex 2.1.1
- ansi-regex 5.0.1
- ansi-styles 2.2.1
- ansi-styles 4.3.0
- append-transform 0.4.0
- archy 1.0.0
- argparse 2.0.1
- arr-diff 2.0.0
- arr-flatten 1.0.3
- array-buffer-byte-length 1.0.2
- array-unique 0.2.1
- array.prototype.every 1.1.7
- array.prototype.flatmap 1.3.3
- arraybuffer.prototype.slice 1.0.4
- arrify 1.0.1
- async 1.5.2
- async-function 1.0.0
- available-typed-arrays 1.0.7
- babel-code-frame 6.22.0
- babel-generator 6.24.1
- babel-messages 6.23.0
- babel-runtime 6.23.0
- babel-template 6.24.1
- babel-types 6.24.1
- babylon 6.17.0
- balanced-match 0.4.2
- balanced-match 1.0.2
- brace-expansion 1.1.16
- builtin-modules 1.1.1
- caching-transform 1.0.1
- call-bind 1.0.9
- call-bind-apply-helpers 1.0.2
- call-bound 1.0.4
- callsites 3.1.0
- camelcase 1.2.1
- camelcase 3.0.0
- center-align 0.1.3
- chalk 1.1.3
- chalk 4.1.2
- cliui 2.1.0
- cliui 3.2.0
- cliui 8.0.1
- code-point-at 1.1.0
- color-convert 2.0.1
- color-name 1.1.4
- commander 7.2.0
- commondir 1.0.1
- concat-map 0.0.1
- convert-source-map 1.5.0
- core-js 2.4.1
- cross-spawn 7.0.6
- data-view-buffer 1.0.2
- data-view-byte-length 1.0.2
- data-view-byte-offset 1.0.1
- debug 4.4.3
- debug-log 1.0.1
- decamelize 1.2.0
- deep-equal 2.2.3
- deep-is 0.1.4
- default-require-extensions 1.0.0
- define-data-property 1.1.4
- define-properties 1.2.1
- defined 1.0.1
- detect-indent 4.0.0
- doctrine 3.0.0
- dotignore 0.1.2
- dunder-proto 1.0.1
- emoji-regex 8.0.0
- error-ex 1.3.1
- es-abstract 1.24.2
- es-abstract-get 1.0.0
- es-define-property 1.0.1
- es-errors 1.3.0
- es-get-iterator 1.1.3
- es-object-atoms 1.1.2
- es-set-tostringtag 2.1.0
- es-shim-unscopables 1.1.0
- es-to-primitive 1.3.4
- escalade 3.2.0
- escape-string-regexp 1.0.5
- escape-string-regexp 4.0.0
- eslint-scope 7.2.2
- eslint-utils 3.0.0
- eslint-visitor-keys 2.1.0
- eslint-visitor-keys 3.4.3
- espree 9.6.1
- esquery 1.7.0
- esrecurse 4.3.0
- estraverse 5.3.0
- esutils 2.0.2
- esutils 2.0.3
- expand-brackets 0.1.5
- expand-range 1.8.2
- extglob 0.3.2
- fast-deep-equal 3.1.3
- fast-json-stable-stringify 2.1.0
- fast-levenshtein 2.0.6
- file-entry-cache 6.0.1
- filename-regex 2.0.1
- fill-range 2.2.3
- find-cache-dir 0.1.1
- find-up 1.1.2
- flat-cache 3.2.0
- flatted 3.4.2
- for-each 0.3.5
- for-in 1.0.2
- for-own 0.1.5
- foreground-child 1.5.6
- fs.realpath 1.0.0
- function-bind 1.1.2
- function.prototype.name 1.2.0
- functional-red-black-tree 1.0.1
- functions-have-names 1.2.3
- generator-function 2.0.1
- get-caller-file 1.0.2
- get-caller-file 2.0.5
- get-intrinsic 1.3.0
- get-package-type 0.1.0
- get-proto 1.0.1
- get-symbol-description 1.1.0
- glob 7.1.1
- glob 7.2.3
- glob-base 0.3.0
- glob-parent 2.0.0
- glob-parent 6.0.2
- globals 13.24.0
- globals 9.17.0
- globalthis 1.0.4
- gopd 1.2.0
- graceful-fs 4.1.11
- handlebars 4.7.9
- has-ansi 2.0.0
- has-bigints 1.1.0
- has-dynamic-import 2.1.1
- has-flag 1.0.0
- has-flag 4.0.0
- has-property-descriptors 1.0.2
- has-proto 1.2.0
- has-symbols 1.1.0
- has-tostringtag 1.0.2
- hasown 2.0.4
- iconv-lite 0.6.3
- ignore 5.3.2
- import-cwd 3.0.0
- import-fresh 3.3.1
- import-from 3.0.0
- imurmurhash 0.1.4
- inflight 1.0.6
- inherits 2.0.3
- inherits 2.0.4
- internal-slot 1.1.0
- invariant 2.2.2
- invert-kv 1.0.0
- is-arguments 1.2.0
- is-array-buffer 3.0.5
- is-arrayish 0.2.1
- is-async-function 2.1.1
- is-bigint 1.1.0
- is-boolean-object 1.2.2
- is-buffer 1.1.5
- is-builtin-module 1.0.0
- is-callable 1.2.7
- is-core-module 2.16.2
- is-data-view 1.0.2
- is-date-object 1.1.0
- is-document.all 1.0.0
- is-dotfile 1.0.2
- is-equal-shallow 0.1.3
- is-extendable 0.1.1
- is-extglob 1.0.0
- is-extglob 2.1.1
- is-finalizationregistry 1.1.1
- is-finite 1.0.2
- is-fullwidth-code-point 1.0.0
- is-fullwidth-code-point 3.0.0
- is-generator-function 1.1.2
- is-glob 2.0.1
- is-glob 4.0.3
- is-map 2.0.3
- is-negative-zero 2.0.3
- is-number 2.1.0
- is-number-object 1.1.1
- is-posix-bracket 0.1.1
- is-primitive 2.0.0
- is-regex 1.2.1
- is-set 2.0.3
- is-shared-array-buffer 1.0.4
- is-string 1.1.1
- is-symbol 1.1.1
- is-typed-array 1.1.15
- is-utf8 0.2.1
- is-weakmap 2.0.2
- is-weakref 1.1.1
- is-weakset 2.0.4
- isarray 1.0.0
- isarray 2.0.5
- isexe 2.0.0
- isobject 2.1.0
- istanbul-lib-coverage 1.1.0
- istanbul-lib-hook 1.0.6
- istanbul-lib-instrument 1.7.1
- istanbul-lib-report 1.1.0
- istanbul-lib-source-maps 1.2.0
- istanbul-reports 1.1.0
- js-tokens 3.0.1
- js-yaml 4.3.0
- jsesc 1.3.0
- json-buffer 3.0.1
- json-schema-traverse 0.4.1
- json-stable-stringify-without-jsonify 1.0.1
- keyv 4.5.4
- kind-of 3.2.0
- lazy-cache 1.0.4
- lcid 1.0.0
- levn 0.4.1
- load-json-file 1.1.0
- lodash.merge 4.6.2
- longest 1.0.1
- loose-envify 1.3.1
- lru-cache 4.0.2
- math-intrinsics 1.1.0
- md5-hex 1.3.0
- md5-o-matic 0.1.1
- merge-source-map 1.0.3
- minimatch 3.1.5
- minimist 1.2.8
- mkdirp 0.5.1
- mock-property 1.1.2
- ms 2.1.3
- natural-compare 1.4.0
- neo-async 2.6.2
- node-exports-info 1.6.2
- normalize-package-data 2.3.8
- normalize-path 2.1.1
- number-is-nan 1.0.1
- object-assign 4.1.1
- object-inspect 1.13.4
- object-is 1.1.6
- object-keys 1.1.1
- object.assign 4.1.7
- object.entries 1.1.9
- object.omit 2.0.1
- once 1.4.0
- optimist 0.6.1
- optionator 0.9.4
- os-homedir 1.0.2
- os-locale 1.4.0
- own-keys 1.0.2
- parent-module 1.0.1
- parse-github-url 1.0.4
- parse-glob 3.0.4
- parse-json 2.2.0
- path-exists 2.1.0
- path-is-absolute 1.0.1
- path-key 3.1.1
- path-parse 1.0.7
- path-type 1.1.0
- pify 2.3.0
- pinkie 2.0.4
- pinkie-promise 2.0.1
- pkg-dir 1.0.0
- possible-typed-array-names 1.1.0
- prelude-ls 1.2.1
- preserve 0.2.0
- pseudomap 1.0.2
- punycode 2.3.1
- read-pkg 1.1.0
- read-pkg-up 1.0.1
- reflect.getprototypeof 1.0.10
- regenerator-runtime 0.10.5
- regex-cache 0.4.3
- regexp.prototype.flags 1.5.4
- regexpp 3.2.0
- remove-trailing-separator 1.0.1
- repeat-element 1.1.2
- repeat-string 1.6.1
- repeating 2.0.1
- require-directory 2.1.1
- require-main-filename 1.0.1
- resolve 2.0.0-next.7
- resolve-from 2.0.0
- resolve-from 4.0.0
- resolve-from 5.0.0
- right-align 0.1.3
- rimraf 2.6.1
- rimraf 3.0.2
- safe-array-concat 1.1.4
- safe-push-apply 1.0.0
- safe-regex-test 1.1.0
- safer-buffer 2.1.2
- semver 6.3.1
- semver 7.8.5
- set-blocking 2.0.0
- set-function-length 1.2.2
- set-function-name 2.0.2
- set-proto 1.0.0
- shebang-command 2.0.0
- shebang-regex 3.0.0
- side-channel 1.1.1
- side-channel-list 1.0.1
- side-channel-map 1.0.1
- side-channel-weakmap 1.0.2
- signal-exit 2.1.2
- signal-exit 3.0.2
- slide 1.1.6
- source-map 0.4.4
- source-map 0.5.6
- source-map 0.6.1
- spawn-wrap 1.2.4
- spdx-correct 1.0.2
- spdx-expression-parse 1.0.4
- spdx-license-ids 1.2.2
- stop-iteration-iterator 1.1.0
- string-width 1.0.2
- string-width 4.2.3
- string.prototype.trim 1.2.11
- string.prototype.trimend 1.0.10
- string.prototype.trimstart 1.0.8
- strip-ansi 3.0.1
- strip-ansi 6.0.1
- strip-bom 2.0.0
- strip-json-comments 3.1.1
- supports-color 2.0.0
- supports-color 3.2.3
- supports-color 7.2.0
- supports-preserve-symlinks-flag 1.0.0
- test-exclude 4.1.0
- text-table 0.2.0
- to-fast-properties 1.0.3
- trim-right 1.0.1
- type-check 0.4.0
- type-fest 0.20.2
- typed-array-buffer 1.0.3
- typed-array-byte-length 1.0.3
- typed-array-byte-offset 1.0.4
- typed-array-length 1.0.8
- uglify-js 2.8.22
- uglify-js 3.19.3
- uglify-to-browserify 1.0.2
- unbox-primitive 1.1.0
- uri-js 4.4.1
- v8-compile-cache 2.4.0
- validate-npm-package-license 3.0.1
- which 1.2.14
- which 2.0.2
- which-boxed-primitive 1.1.1
- which-builtin-type 1.2.1
- which-collection 1.0.2
- which-module 1.0.0
- which-typed-array 1.1.22
- window-size 0.1.0
- word-wrap 1.2.5
- wordwrap 0.0.2
- wordwrap 0.0.3
- wordwrap 1.0.0
- wrap-ansi 2.1.0
- wrap-ansi 7.0.0
- wrappy 1.0.2
- write-file-atomic 1.3.4
- y18n 5.0.8
- yallist 2.1.2
- yargs 17.7.3
- yargs 3.10.0
- yargs 7.1.0
- yargs-parser 21.1.1
Review auto-merge candidates and open PRs in a guided flow.
Glossary
What the labels and signals mean.
Glossary
What the labels and signals mean.
- Trust Save
- A package upgrade Arguss would have blocked despite the new version being available, because trust signals, like ownership transfer or a new maintainer, fired during the upgrade window. The name reflects what the agent did for the user: saved them from a potentially malicious update that a version-only auto-PR tool would have merged.
- AUTO-MERGE
- Verdict tier indicating the fix passes all three lenses cleanly. After you confirm action from a Scan assessment, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. The envelope is conservative on purpose: patch or minor version bump, trust signals unchanged, blast radius bounded, real tests pass.
- REVIEW
- Verdict tier requiring a human decision. At least one veto fired during fix-confidence evaluation, trust signals shifted, the pipeline can't verify post-upgrade behavior, or the upgrade is a major version bump. The agent surfaces the reasons; the developer decides.
- DECLINE
- Verdict tier indicating no remediation is recommended. Typically applies when no fix version exists for the finding, or when multiple critical vetoes make even human review unproductive.
fix_kind.major- Veto signal that fires when the available fix requires a major version bump (1.x → 2.x). Major bumps imply potential breaking changes and fall outside the auto-merge envelope by default, even when the upgrade is the only available fix.
trust.new_maintainer- Veto signal that fires when a package added a new maintainer during the upgrade window, meaning between the user's current version and the proposed upgrade. New publishing identities are a well-documented attack vector for typosquats and supply chain takeovers.
trust.ownership_transferred- Veto signal that fires when a package's primary maintainer changed during the upgrade window. Combined with
trust.new_maintainer, this is the highest-risk trust combination, typical of the xz-utils style attacks and historical npm credential theft incidents. pipeline.test_reality- Veto signal that fires when Arguss can't verify tests will run on the upgraded code. Four conditions must hold: a test script exists in
package.json, it isn't a no-op, real test files exist, and a workflow actually invokes them. If any fail, the fix cannot qualify for AUTO_MERGE because there's no way to verify the upgrade didn't break the user's project. - CVSS
- Common Vulnerability Scoring System. A numeric score (0.0–10.0) representing how damaging a vulnerability could be if exploited. Sourced from NIST's National Vulnerability Database via OSV.dev. Severity, not urgency.
- EPSS
- Exploit Prediction Scoring System. A daily-updated probability (0.0–1.0, displayed as percent) that a CVE will be exploited in the next 30 days. Sourced from FIRST.org. Probability, not severity.
- KEV
- CISA's Known Exploited Vulnerabilities catalog. A federal list of CVEs with documented active exploitation in the wild. Federal agencies have a binding patching deadline; for everyone else, presence on KEV is the strongest "this is being used right now" signal available. Sourced directly from CISA.
- Project Risk Score (PRS)
- A weighted blend of the three lens subscores (40% vulnerability, 30% trust, 30% pipeline) producing an overall 0–100 indicator of the project's dependency health. Useful for at-a-glance triage; the per-finding fix-confidence verdicts are what drive automated decisions.
Dependency graph
Full-project map of transitive dependencies. Severity colors reflect vulnerabilities; trust rings apply only to direct dependencies analyzed by OpenSSF Scorecard (higher = riskier).