Project Risk Score Project Risk Score: weighted blend of vulnerability (40%), trust (30%), and pipeline (30%) subscores. Useful for at-a-glance triage. Click for more →
67 /100
Review required

17 findings across 9 packages · 777 packages clean

Candidates: 8 auto-merge · 1 review · 0 decline · 0 no fix

Scanned npm/node-semver @ main Scan · Completed 215 hrs ago Download SBOM
Total Findings
17
All detected issues
KEV Findings
0
Known exploited
High EPSS
1
Likely to be exploited
Auto-merge ready
8
Remediation candidates
Affected pkgs
9
with remediation paths
KEV catalog CISA's Known Exploited Vulnerabilities catalog. Documented active exploitation in the wild; the strongest 'this is happening now' signal. Click for more →
0
actively exploited CVEs
Highest EPSS Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
22.4%
CVE-2021-23337
Active vetos
1
lens blocks on candidates

Findings

lodash @ 4.17.21
root → tap → ink → lodash
3 findings high–medium
Trust 0/100 EPSS 22.4% ↑
AUTO-MERGE Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more →
GHSA-r5fr-rjxr-66jc high CVSS 8.1 EPSS 22.4%
lodash vulnerable to Code Injection via `_.template` imports key names
GHSA-f23m-r3pf-42rh medium CVSS 6.5 EPSS 1.5%
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
GHSA-xxjr-mmjv-4gpg medium CVSS 6.5 EPSS 1.5%
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
4.17.21 → 4.18.0 minor
auto-merge Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more → Score 100
Max CVSS 8.1 · 3 findings Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency. Click for more → Max EPSS 22.4% · 97th percentile Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
  • minor-level upgrade; trust signals unchanged; CI verifies tests
GHSA-r5fr-rjxr-66jc: lodash vulnerable to Code Injection via `_.template` imports key names

Upgrade lodash from 4.17.21 to 4.18.0 or later

View advisory
root → tap → ink → lodash

Blast radius

Paths from project root to lodash - which dependencies pulled this package in?

ws @ 7.5.9
root → tap → ink → ws
2 findings high
Trust 0/100 EPSS 1.4%
AUTO-MERGE Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more →
GHSA-3h5v-q93c-6h6q high CVSS 7.5 EPSS 1.4%
ws affected by a DoS when handling a request with many HTTP headers
GHSA-96hv-2xvq-fx4p high CVSS 7.5 EPSS 0.8%
ws: Memory exhaustion DoS from tiny fragments and data chunks
7.5.9 → 7.5.11 patch
auto-merge Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more → Score 100
Max CVSS 7.5 · 2 findings Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency. Click for more → Max EPSS 1.4% · 68th percentile Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
  • patch-level upgrade; trust signals unchanged; CI verifies tests
GHSA-3h5v-q93c-6h6q: ws affected by a DoS when handling a request with many HTTP headers

Upgrade ws from 7.5.9 to 7.5.10 or later

View advisory
root → tap → ink → ws

Blast radius

Paths from project root to ws - which dependencies pulled this package in?

shell-quote @ 1.8.1
root → tap → ink → react-devtools-core → shell-quote
2 findings high
Trust 0/100 EPSS 0.8%
AUTO-MERGE Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more →
GHSA-w7jw-789q-3m8p high CVSS 8.1 EPSS 0.8%
shell-quote quote() does not escape newlines in object .op values
GHSA-395f-4hp3-45gv high CVSS 7.5 EPSS 0.4%
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
1.8.1 → 1.9.0 minor
auto-merge Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more → Score 100
Max CVSS 8.1 · 2 findings Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency. Click for more → Max EPSS 0.8% · 54th percentile Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
  • minor-level upgrade; trust signals unchanged; CI verifies tests
GHSA-w7jw-789q-3m8p: shell-quote quote() does not escape newlines in object .op values

Upgrade shell-quote from 1.8.1 to 1.8.4 or later

View advisory
root → tap → ink → react-devtools-core → shell-quote

Blast radius

Paths from project root to shell-quote - which dependencies pulled this package in?

minimatch @ 3.1.2
root → @npmcli/template-oss → glob → minimatch
3 findings high
Trust 30/100 EPSS 0.5%
AUTO-MERGE Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more →
GHSA-23c5-xmqv-rm74 high CVSS 7.5 EPSS 0.5%
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
GHSA-3ppc-4f35-3m26 high CVSS 7.5 EPSS 0.5%
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
GHSA-7r86-cg39-jmmj high CVSS 7.5 EPSS 0.5%
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
3.1.2 → 3.1.4 patch
auto-merge Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more → Score 100
Max CVSS 7.5 · 3 findings Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency. Click for more → Max EPSS 0.5% · 40th percentile Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
  • patch-level upgrade; trust signals unchanged; CI verifies tests
GHSA-23c5-xmqv-rm74: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Upgrade minimatch from 3.1.2 to 3.1.4 or later

View advisory
root → @npmcli/template-oss → glob → minimatch

Blast radius

Paths from project root to minimatch - which dependencies pulled this package in?

@babel/helpers @ 7.23.6
root → tap → @isaacs/import-jsx → @babel/core → @babel/helpers
1 finding medium
Trust 0/100 EPSS 0.5%
AUTO-MERGE Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more →
GHSA-968p-4wvh-cqc8 medium CVSS 6.2 EPSS 0.5%
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
7.23.6 → 7.26.10 minor
auto-merge Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more → Score 100
Max CVSS 6.2 · 1 finding Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency. Click for more → Max EPSS 0.5% · 38th percentile Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
  • minor-level upgrade; trust signals unchanged; CI verifies tests
GHSA-968p-4wvh-cqc8: Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

Upgrade @babel/helpers from 7.23.6 to 7.26.10 or later

View advisory
root → tap → @isaacs/import-jsx → @babel/core → @babel/helpers

Blast radius

Paths from project root to @babel/helpers - which dependencies pulled this package in?

yaml @ 1.10.2
root → tap → tap-yaml → yaml
1 finding medium
Trust 30/100 EPSS 0.5%
AUTO-MERGE Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more →
GHSA-48c2-rrv3-qjmp medium CVSS 4.3 EPSS 0.5%
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
1.10.2 → 1.10.3 patch
auto-merge Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more → Score 100
Max CVSS 4.3 · 1 finding Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency. Click for more → Max EPSS 0.5% · 37th percentile Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
  • patch-level upgrade; trust signals unchanged; CI verifies tests
GHSA-48c2-rrv3-qjmp: yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Upgrade yaml from 1.10.2 to 1.10.3 or later

View advisory
root → tap → tap-yaml → yaml

Blast radius

Paths from project root to yaml - which dependencies pulled this package in?

brace-expansion @ 1.1.11
root → @npmcli/template-oss → minimatch → brace-expansion
3 findings medium–low
Trust 0/100 EPSS 0.5%
AUTO-MERGE Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more →
GHSA-f886-m6hf-6m8v medium CVSS 6.5 EPSS 0.4%
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
GHSA-3jxr-9vmj-r5cp medium CVSS 5.3 EPSS 0.4%
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
GHSA-v6h2-p8h4-qcjw low CVSS 3.1 EPSS 0.5%
brace-expansion Regular Expression Denial of Service vulnerability
1.1.11 → 1.1.16 patch
auto-merge Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more → Score 100
Max CVSS 6.5 · 3 findings Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency. Click for more → Max EPSS 0.5% · 37th percentile Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
  • patch-level upgrade; trust signals unchanged; CI verifies tests
GHSA-f886-m6hf-6m8v: brace-expansion: Zero-step sequence causes process hang and memory exhaustion

Upgrade brace-expansion from 1.1.11 to 1.1.13 or later

View advisory
root → @npmcli/template-oss → minimatch → brace-expansion

Blast radius

Paths from project root to brace-expansion - which dependencies pulled this package in?

uuid @ 8.3.2
root → tap → istanbul-lib-processinfo → uuid
1 finding high
Trust 0/100 EPSS 0.3%
REVIEW Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk. Click for more →
GHSA-w5hq-g745-h8pq high CVSS 7.5 EPSS 0.3%
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
8.3.2 → 11.1.1 major
review-required Verdict tier: at least one veto fired. A human needs to decide whether to merge despite the flagged risk. Click for more → Score 50
Max CVSS 7.5 · 1 finding Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency. Click for more → Max EPSS 0.3% · 25th percentile Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
fix_kind.major Veto: the available fix requires a major version bump (1.x → 2.x), which implies potential breaking changes outside the auto-merge envelope. Click for more →
  • major version bump requires human review (never auto-merge)
GHSA-w5hq-g745-h8pq: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Upgrade uuid from 8.3.2 to 11.1.1 or later

View advisory
root → tap → istanbul-lib-processinfo → uuid

Blast radius

Paths from project root to uuid - which dependencies pulled this package in?

@babel/core @ 7.23.6
root → tap → @isaacs/import-jsx → @babel/core
1 finding low
Trust 0/100 EPSS 0.1%
AUTO-MERGE Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more →
GHSA-4x5r-pxfx-6jf8 low CVSS 3.2 EPSS 0.1%
@babel/core: Arbitrary File Read via sourceMappingURL Comment
7.23.6 → 7.29.6 minor
auto-merge Verdict tier: the fix passes all three lenses cleanly. In Mode C, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. Click for more → Score 100
Max CVSS 3.2 · 1 finding Common Vulnerability Scoring System. A 0–10 score for how damaging exploitation could be. Severity, not urgency. Click for more → Max EPSS 0.1% · 1st percentile Exploit Prediction Scoring System. Daily-updated probability that a CVE will be exploited in the next 30 days. Probability, not severity. Click for more →
  • minor-level upgrade; trust signals unchanged; CI verifies tests
GHSA-4x5r-pxfx-6jf8: @babel/core: Arbitrary File Read via sourceMappingURL Comment

Upgrade @babel/core from 7.23.6 to 7.29.6 or later

View advisory
root → tap → @isaacs/import-jsx → @babel/core

Blast radius

Paths from project root to @babel/core - which dependencies pulled this package in?

Package status

786 packages scanned.

  • 1 Review-required candidate Arguss flagged these for a human decision - nothing merges until you review them.
  • 8 Auto-merge candidates

Review auto-merge candidates and open PRs in a guided flow.

Glossary

What the labels and signals mean.
Trust Save
A package upgrade Arguss would have blocked despite the new version being available, because trust signals, like ownership transfer or a new maintainer, fired during the upgrade window. The name reflects what the agent did for the user: saved them from a potentially malicious update that a version-only auto-PR tool would have merged.
AUTO-MERGE
Verdict tier indicating the fix passes all three lenses cleanly. After you confirm action from a Scan assessment, Arguss opens a pull request for the upgrade; it does not merge PRs on GitHub. The envelope is conservative on purpose: patch or minor version bump, trust signals unchanged, blast radius bounded, real tests pass.
REVIEW
Verdict tier requiring a human decision. At least one veto fired during fix-confidence evaluation, trust signals shifted, the pipeline can't verify post-upgrade behavior, or the upgrade is a major version bump. The agent surfaces the reasons; the developer decides.
DECLINE
Verdict tier indicating no remediation is recommended. Typically applies when no fix version exists for the finding, or when multiple critical vetoes make even human review unproductive.
fix_kind.major
Veto signal that fires when the available fix requires a major version bump (1.x → 2.x). Major bumps imply potential breaking changes and fall outside the auto-merge envelope by default, even when the upgrade is the only available fix.
trust.new_maintainer
Veto signal that fires when a package added a new maintainer during the upgrade window, meaning between the user's current version and the proposed upgrade. New publishing identities are a well-documented attack vector for typosquats and supply chain takeovers.
trust.ownership_transferred
Veto signal that fires when a package's primary maintainer changed during the upgrade window. Combined with trust.new_maintainer, this is the highest-risk trust combination, typical of the xz-utils style attacks and historical npm credential theft incidents.
pipeline.test_reality
Veto signal that fires when Arguss can't verify tests will run on the upgraded code. Four conditions must hold: a test script exists in package.json, it isn't a no-op, real test files exist, and a workflow actually invokes them. If any fail, the fix cannot qualify for AUTO_MERGE because there's no way to verify the upgrade didn't break the user's project.
CVSS
Common Vulnerability Scoring System. A numeric score (0.0–10.0) representing how damaging a vulnerability could be if exploited. Sourced from NIST's National Vulnerability Database via OSV.dev. Severity, not urgency.
EPSS
Exploit Prediction Scoring System. A daily-updated probability (0.0–1.0, displayed as percent) that a CVE will be exploited in the next 30 days. Sourced from FIRST.org. Probability, not severity.
KEV
CISA's Known Exploited Vulnerabilities catalog. A federal list of CVEs with documented active exploitation in the wild. Federal agencies have a binding patching deadline; for everyone else, presence on KEV is the strongest "this is being used right now" signal available. Sourced directly from CISA.
Project Risk Score (PRS)
A weighted blend of the three lens subscores (40% vulnerability, 30% trust, 30% pipeline) producing an overall 0–100 indicator of the project's dependency health. Useful for at-a-glance triage; the per-finding fix-confidence verdicts are what drive automated decisions.

Dependency graph

Full-project map of transitive dependencies. Severity colors reflect vulnerabilities; trust rings apply only to direct dependencies analyzed by OpenSSF Scorecard (higher = riskier).