Arguss Package Intelligence

Top npm packages

Vulnerability status for the most-downloaded npm packages, refreshed by the top-1000 sweep job.

1000 packages tracked · updated Jul 30, 2026 · 03:00 UTC

Currently vulnerable

Latest published version affected

Malware (12 mo)

2 linked incidents

Clear

1000

No known vulnerabilities

Unknown

Status not yet resolved

Rank	Package	Latest	Peak affected	Status	Last advisory	History	Severity
#1	semver	7.8.5	-	Clear	Jun 21, 2023	2	2 high
AI-generated context The semver package has a history of two high-severity Regular Expression Denial of Service (ReDoS) vulnerabilities (GHSA-x6fg-f45m-jf5q and GHSA-c2qf-rxjj-qqgw), meaning malicious input could cause excessive backtracking in regex processing and degrade performance. Both were conventional vulnerabilities with no malware involvement. The current release is clear, so developers using the latest version are not exposed to these issues. Advisory history (2) GHSA-c2qf-rxjj-qqgw high Jun 21, 2023 semver vulnerable to Regular Expression Denial of Service GHSA-x6fg-f45m-jf5q high Oct 24, 2017 Regular Expression Denial of Service in semver
#2	minimatch	10.2.6	-	Clear	Feb 26, 2026	5	5 high
AI-generated context The minimatch package has an exclusively conventional vulnerability history, with all five advisories centered on Regular Expression Denial of Service (ReDoS) flaws — including GHSA-hxm2-r34f-qmc5 dating back to 2018 and more recent issues such as GHSA-23c5-xmqv-rm74 and GHSA-7r86-cg39-jmmj involving catastrophic backtracking from nested extglobs and multiple GLOBSTAR segments. No malware has ever been associated with the package. The current release is clear, so developers depending on minimatch today should simply ensure they are on the latest version to benefit from the fixes to these historical issues. Advisory history (5) GHSA-7r86-cg39-jmmj high Feb 26, 2026 minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments GHSA-23c5-xmqv-rm74 high Feb 26, 2026 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions GHSA-3ppc-4f35-3m26 high Feb 18, 2026 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern GHSA-f8q6-p94x-37v3 high Oct 18, 2022 minimatch ReDoS vulnerability GHSA-hxm2-r34f-qmc5 high Oct 09, 2018 Regular Expression Denial of Service in minimatch
#3	debug	4.4.3	4.4.2	Clear	Sep 15, 2025 Malware incident · Sep 2025	4	2 high 1 low 1 malware
AI-generated context The `debug` package has a notable history that includes two ReDoS (Regular Expression Denial of Service) vulnerabilities across older versions (GHSA-gxpj-cx7g-858c and GHSA-9vvw-cc9w-f27h), as well as a serious incident in which version 4.4.2 was compromised via an npm account takeover and contained malicious code (MAL-2025-46974). The malicious version has since been addressed, and the current release, 4.4.3, is clear. Advisory history (4) GHSA-4x49-vf9v-38px high peak affected Sep 15, 2025 debug@4.4.2 contains malware after npm account takeover MAL-2025-46974 malware peak affected Sep 08, 2025 Malicious code in debug (npm) GHSA-9vvw-cc9w-f27h high Jan 09, 2023 debug Inefficient Regular Expression Complexity vulnerability GHSA-gxpj-cx7g-858c low Aug 09, 2018 Regular Expression Denial of Service in debug
#4	ansi-styles	7.0.0	6.2.2	Clear	Sep 08, 2025 Malware incident · Sep 2025	1	1 malware
AI-generated context Advisory MAL-2025-46967 flagged a malicious version of ansi-styles on npm, indicating that a compromised release was published at some point in the package's history. This was a malware incident rather than a conventional vulnerability in the package's own code. The current latest release, version 6.2.3, is clear, so developers depending on that version are not affected by this historical incident. Advisory history (1) MAL-2025-46967 malware peak affected Sep 08, 2025 Malicious code in ansi-styles (npm)
#5	brace-expansion	5.0.8	4.0.0	Clear	Jul 24, 2026	6	3 high 2 moderate 1 low
Advisory history (6) GHSA-mh99-v99m-4gvg high Jul 24, 2026 brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash GHSA-3jxr-9vmj-r5cp high Jul 20, 2026 brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups GHSA-jxxr-4gwj-5jf2 moderate May 18, 2026 brace-expansion: Large numeric range defeats documented `max` DoS protection GHSA-f886-m6hf-6m8v moderate Mar 26, 2026 brace-expansion: Zero-step sequence causes process hang and memory exhaustion GHSA-v6h2-p8h4-qcjw low peak affected Jun 09, 2025 brace-expansion Regular Expression Denial of Service vulnerability GHSA-832h-xg76-4gv6 high Jan 29, 2018 ReDoS in brace-expansion
#6	strip-ansi	7.2.0	7.1.1	Clear	Sep 08, 2025 Malware incident · Sep 2025	1	1 malware
AI-generated context Advisory MAL-2025-46980 flagged a malicious version of strip-ansi on npm, marking the only advisory in this package's history as a malware incident rather than a conventional vulnerability. The current release, version 7.2.0, has since been cleared, meaning the malicious code is no longer present in the latest published version. Developers depending on this package should ensure they are pinned to the latest clean release and not inadvertently pulling in the compromised version. Advisory history (1) MAL-2025-46980 malware peak affected Sep 08, 2025 Malicious code in strip-ansi (npm)
#7	ansi-regex	6.2.2	6.2.1	Clear	Sep 08, 2025 Malware incident · Sep 2025	2	1 high 1 malware
AI-generated context The package has two historical advisories: GHSA-93q8-gq69-wqmw, a high-severity vulnerability involving inefficient regular expression complexity that could be exploited for denial-of-service attacks, and MAL-2025-46966, which flagged malicious code in a version of the package on npm. The current release, 6.2.2, is clear of both issues, but the malware incident in particular is worth noting as part of the package's history when assessing supply chain risk. Advisory history (2) MAL-2025-46966 malware peak affected Sep 08, 2025 Malicious code in ansi-regex (npm) GHSA-93q8-gq69-wqmw high Sep 20, 2021 Inefficient Regular Expression Complexity in chalk/ansi-regex
#8	ms	2.1.3	-	Clear	Jan 05, 2023	2	1 high 1 moderate
AI-generated context The `ms` package has two historical advisories, both related to Regular Expression Denial of Service (ReDoS) vulnerabilities (GHSA-3fx5-fwvr-xrjg and GHSA-w9mr-4mfr-499f), where inefficient regular expression complexity could be exploited to cause performance degradation. These were conventional security issues, not malware, and both have since been addressed. The current release (2.1.3) is clear, so developers depending on an up-to-date version of this package are not affected by either of these past vulnerabilities. Advisory history (2) GHSA-w9mr-4mfr-499f moderate Jan 05, 2023 Vercel ms Inefficient Regular Expression Complexity vulnerability GHSA-3fx5-fwvr-xrjg high Oct 24, 2017 Regular Expression Denial of Service in ms
#9	supports-color	11.0.0	10.2.1	Clear	Sep 08, 2025 Malware incident · Sep 2025	1	1 malware
AI-generated context Advisory MAL-2025-46981 flagged a malicious version of the supports-color npm package, indicating that a compromised release containing malware was published at some point in the package's history. The current latest release, version 10.2.2, has since been cleared, so developers depending on that version are not affected by the earlier incident. Advisory history (1) MAL-2025-46981 malware peak affected Sep 08, 2025 Malicious code in supports-color (npm)
#10	chalk	6.0.0	5.6.1	Clear	Sep 08, 2025 Malware incident · Sep 2025	1	1 malware
AI-generated context Chalk has one malware advisory in its history, MAL-2025-46969, which identified malicious code published under the chalk package name on npm. This type of incident typically involves a compromised or typosquatted version rather than the legitimate package's entire release history, and the current latest release at version 5.6.2 is clear of any such concerns. Advisory history (1) MAL-2025-46969 malware peak affected Sep 08, 2025 Malicious code in chalk (npm)
#11	commander	15.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#12	lru-cache	11.5.2	-	Clear	-	0	-
No advisories for the latest published version.
#13	string-width	8.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#14	wrap-ansi	10.0.0	9.0.1	Clear	Sep 08, 2025 Malware incident · Sep 2025	1	1 malware
AI-generated context Advisory MAL-2025-46983 flagged a malicious version of wrap-ansi on npm, indicating that at some point a compromised release was published to the registry. This was a malware incident rather than a conventional vulnerability in the package's own code. The current latest release, version 10.0.0, is clear, so developers using that version are not affected by this history. Advisory history (1) MAL-2025-46983 malware peak affected Sep 08, 2025 Malicious code in wrap-ansi (npm)
#15	tslib	2.8.1	-	Clear	-	0	-
No advisories for the latest published version.
#16	picomatch	4.0.5	-	Clear	Mar 25, 2026	2	1 high 1 moderate
AI-generated context Picomatch has two historical security advisories, both conventional vulnerabilities rather than malware: GHSA-3v7f-55p6-f55p identified a method injection issue in POSIX character classes that caused incorrect glob matching, and GHSA-c2c7-rcm5-vvqj flagged a high-severity ReDoS vulnerability via extglob quantifiers. Both issues have been addressed, and the package's current release at version 4.0.5 is clear, meaning developers depending on it today can do so without concern from these past findings. Advisory history (2) GHSA-3v7f-55p6-f55p moderate Mar 25, 2026 Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching GHSA-c2c7-rcm5-vvqj high Mar 25, 2026 Picomatch has a ReDoS vulnerability via extglob quantifiers
#17	emoji-regex	10.6.0	-	Clear	-	0	-
No advisories for the latest published version.
#18	glob	13.0.6	-	Clear	Nov 17, 2025	1	1 high
AI-generated context The `glob` package has one historical advisory (GHSA-5j98-mcp5-4vw2), a high-severity conventional vulnerability in which the CLI's `-c`/`--cmd` flag could allow command injection by executing matched filenames with `shell: true`. This was not a malware issue. The latest release, version 13.0.6, is clear, so developers depending on it today should simply ensure they are on an up-to-date version. Advisory history (1) GHSA-5j98-mcp5-4vw2 high Nov 17, 2025 glob CLI: Command injection via -c/--cmd executes matches with shell:true
#19	type-fest	5.8.0	-	Clear	-	0	-
No advisories for the latest published version.
#20	color-name	2.1.1	2.0.1	Clear	Sep 15, 2025 Malware incident · Sep 2025	2	1 high 1 malware
AI-generated context The package color-name has a notable security history: version 2.0.1 was compromised via an npm account takeover that introduced malicious code, documented in both GHSA-5fvm-p68v-5wmh and MAL-2025-46972. This was a supply chain incident involving actual malware rather than a conventional vulnerability. The latest release, 2.1.0, is clear, indicating the maintainers have regained control and resolved the issue. Advisory history (2) GHSA-5fvm-p68v-5wmh high peak affected Sep 15, 2025 color-name@2.0.1 contains malware after npm account takeover MAL-2025-46972 malware peak affected Sep 08, 2025 Malicious code in color-name (npm)
#21	eslint-visitor-keys	5.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#22	color-convert	3.1.3	3.1.1	Clear	Sep 15, 2025 Malware incident · Sep 2025	2	1 high 1 malware
AI-generated context color-convert has a notable security incident in its history: version 3.1.1 was compromised with malicious code following an npm account takeover, as documented in GHSA-pxx3-g568-hxr4 and MAL-2025-46971. This was a supply chain attack involving actual malware injected into a published release, not a conventional vulnerability. The package has since been remediated and the current release (3.1.3) is clear, so developers on the latest version are not affected. Advisory history (2) GHSA-pxx3-g568-hxr4 high peak affected Sep 15, 2025 color-convert@3.1.1 contains malware after npm account takeover MAL-2025-46971 malware peak affected Sep 08, 2025 Malicious code in color-convert (npm)
#23	ajv	8.20.0	-	Clear	Feb 11, 2026	2	2 moderate
AI-generated context Ajv has two moderate-severity vulnerability advisories in its history: a prototype pollution issue (GHSA-v88g-cgmw-v5xw) and a ReDoS vulnerability triggered when using the `$data` option (GHSA-2g4f-4pwh-qvx6), both conventional security flaws with no malware involvement. Neither advisory involved supply chain compromise or malicious code. The latest release of ajv is currently clear, so developers depending on an up-to-date version are not affected by these past issues. Advisory history (2) GHSA-2g4f-4pwh-qvx6 moderate Feb 11, 2026 ajv has ReDoS when using `$data` option GHSA-v88g-cgmw-v5xw moderate Feb 10, 2022 Prototype Pollution in Ajv
#24	minipass	7.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#25	source-map	0.8.0	-	Clear	-	0	-
No advisories for the latest published version.
#26	balanced-match	4.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#27	readable-stream	4.7.0	-	Clear	-	0	-
No advisories for the latest published version.
#28	which	7.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#29	glob-parent	6.0.2	6.0.0	Clear	Jul 18, 2022	2	2 high
AI-generated context The glob-parent package has two historical high-severity advisories in its past, both involving Regular Expression Denial of Service (ReDoS) vulnerabilities — one in the enclosure regex (GHSA-ww39-953v-wcq6) and one affecting version 6.0.0 specifically (GHSA-cj88-88mr-972w). Neither advisory involved malware; both were conventional algorithmic complexity issues that could allow an attacker to cause excessive processing through crafted input. These vulnerabilities have since been addressed, and the current release (6.0.2) is clear. Advisory history (2) GHSA-cj88-88mr-972w high peak affected Jul 18, 2022 glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service GHSA-ww39-953v-wcq6 high Jun 07, 2021 glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex
#30	escape-string-regexp	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#31	has-flag	5.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#32	find-up	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#33	locate-path	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#34	json-schema-traverse	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#35	p-limit	7.3.1	-	Clear	-	0	-
No advisories for the latest published version.
#36	yallist	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#37	safe-buffer	5.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#38	uuid	14.0.1	-	Clear	Apr 22, 2026	1	1 moderate
AI-generated context The `uuid` package has one moderate-severity advisory in its history, GHSA-w5hq-g745-h8pq, which described a missing buffer bounds check affecting v3, v5, and v6 UUID generation when a `buf` argument was provided — a conventional vulnerability with no malware involvement. This issue has since been addressed, and the package's current release (14.0.1) is clear. Advisory history (1) GHSA-w5hq-g745-h8pq moderate Apr 22, 2026 uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
#39	p-locate	7.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#40	undici-types	8.9.0	-	Clear	-	0	-
No advisories for the latest published version.
#41	ignore	7.0.6	-	Clear	-	0	-
No advisories for the latest published version.
#42	iconv-lite	0.7.3	-	Clear	-	0	-
No advisories for the latest published version.
#43	signal-exit	4.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#44	esbuild	0.28.1	-	Clear	Jun 12, 2026	2	1 moderate 1 low
AI-generated context Esbuild has two historical vulnerability advisories, both conventional security issues rather than malware. GHSA-67mh-4wv8-2f99 flagged a moderate-severity flaw allowing arbitrary websites to send requests to the development server and read responses, while GHSA-g7r4-m6w7-qqqr identified a low-severity arbitrary file read issue on Windows when running the dev server. Both issues have since been addressed, and the package's current release at version 0.28.1 is clear. Advisory history (2) GHSA-g7r4-m6w7-qqqr low Jun 12, 2026 esbuild allows arbitrary file read when running the development server on Windows GHSA-67mh-4wv8-2f99 moderate Feb 10, 2025 esbuild enables any website to send any requests to the development server and read the response
#45	is-fullwidth-code-point	5.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#46	js-yaml	5.2.2	-	Clear	Jul 24, 2026	9	1 critical 3 high 5 moderate
Advisory history (9) GHSA-pm4m-ph32-ghv5 high Jul 24, 2026 js-yaml: Exponential parsing time in flow collections leads to denial of service GHSA-g796-fgmg-93mv moderate Jul 20, 2026 js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml GHSA-52cp-r559-cp3m high Jul 20, 2026 js-yaml: YAML merge-key chains can force quadratic CPU consumption GHSA-724g-mxrg-4qvm moderate Jul 20, 2026 js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA GHSA-h67p-54hq-rp68 moderate Jun 15, 2026 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases GHSA-mh29-5h37-fv8m moderate Nov 14, 2025 js-yaml has prototype pollution in merge (<<) GHSA-2pr6-76vf-7546 moderate Jun 05, 2019 Denial of Service in js-yaml GHSA-8j8c-7jfh-h6hx high Jun 04, 2019 Code Injection in js-yaml GHSA-xxvw-45rp-3mj2 critical Oct 24, 2017 Deserialization Code Execution in js-yaml
#47	entities	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#48	globals	17.8.0	-	Clear	-	0	-
No advisories for the latest published version.
#49	postcss	8.5.24	-	Clear	Jul 24, 2026	6	2 high 4 moderate
Advisory history (6) GHSA-r28c-9q8g-f849 high Jul 24, 2026 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure GHSA-6g55-p6wh-862q high Jul 23, 2026 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments GHSA-qx2v-qp2m-jg93 moderate Apr 24, 2026 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output GHSA-7fh5-64p2-3v2j moderate Sep 30, 2023 PostCSS line return parsing error GHSA-566m-qj78-rww5 moderate Jan 07, 2022 Regular Expression Denial of Service in postcss GHSA-hwj9-h5mp-3pm3 moderate May 10, 2021 Regular Expression Denial of Service in postcss
#50	isexe	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#51	isarray	2.0.5	-	Clear	-	0	-
No advisories for the latest published version.
#52	path-key	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#53	string_decoder	1.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#54	argparse	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#55	ws	8.21.1	-	Clear	Jun 15, 2026	7	4 high 2 moderate 1 low
AI-generated context The `ws` package has a history of conventional security vulnerabilities — no malware — spanning memory disclosure issues (GHSA-2mhh-w6q8-5hxw, GHSA-58qx-3vcg-4xpx), multiple denial-of-service vulnerabilities including those triggered by large messages, excessive HTTP headers, and memory exhaustion from fragmented data (GHSA-6663-c963-2gqg, GHSA-5v72-xg48-5rpm, GHSA-3h5v-q93c-6h6q, GHSA-96hv-2xvq-fx4p), and a ReDoS in a WebSocket protocol header (GHSA-6fc8-4gx4-v693). These vulnerabilities were addressed in successive releases over the years, and the current version 8.21.1 is clear. Developers depending on `ws` should ensure they are running the latest version to benefit from all historical fixes. Advisory history (7) GHSA-96hv-2xvq-fx4p high Jun 15, 2026 ws: Memory exhaustion DoS from tiny fragments and data chunks GHSA-58qx-3vcg-4xpx moderate May 18, 2026 ws: Uninitialized memory disclosure GHSA-3h5v-q93c-6h6q high Jun 17, 2024 ws affected by a DoS when handling a request with many HTTP headers GHSA-6fc8-4gx4-v693 moderate May 28, 2021 ReDoS in Sec-Websocket-Protocol header GHSA-5v72-xg48-5rpm high Jun 04, 2019 Denial of Service in ws GHSA-6663-c963-2gqg high Feb 18, 2019 DoS due to excessively large websocket message in ws GHSA-2mhh-w6q8-5hxw low Feb 18, 2019 Remote Memory Disclosure in ws
#56	mime-db	1.54.0	-	Clear	-	0	-
No advisories for the latest published version.
#57	resolve	1.22.12	-	Clear	-	0	-
No advisories for the latest published version.
#58	agent-base	9.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#59	@esbuild/linux-x64	0.28.1	-	Clear	-	0	-
No advisories for the latest published version.
#60	yargs-parser	22.0.0	-	Clear	Sep 04, 2020	1	1 moderate
AI-generated context yargs-parser has one advisory in its history, GHSA-p9pc-299p-vxgp, a moderate-severity prototype pollution vulnerability affecting older versions of the package. This was a conventional security flaw rather than any form of malware, and it has since been resolved. The current release is clear, so developers depending on up-to-date versions of yargs-parser are not affected by this past issue. Advisory history (1) GHSA-p9pc-299p-vxgp moderate Sep 04, 2020 yargs-parser Vulnerable to Prototype Pollution
#61	mime-types	3.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#62	acorn	8.18.0	-	Clear	Apr 03, 2020	1	1 high
AI-generated context Acorn has one advisory in its history, GHSA-6chw-6frg-f759, a high-severity Regular Expression Denial of Service vulnerability published in 2020. This was a conventional vulnerability rather than malware, affecting how the parser handled certain inputs that could cause excessive backtracking. The issue has since been resolved, and the package's current release is clear. Advisory history (1) GHSA-6chw-6frg-f759 high Apr 03, 2020 Regular Expression Denial of Service in Acorn
#63	estraverse	5.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#64	cross-spawn	7.0.6	-	Clear	Nov 08, 2024	1	1 high
AI-generated context The package has one advisory in its history, GHSA-3xgq-45jj-v275, a high-severity Regular Expression Denial of Service (ReDoS) vulnerability affecting earlier versions of cross-spawn. This was a conventional vulnerability rather than malware, where a crafted input could cause excessive backtracking in a regular expression. The issue has since been addressed, and the current release (7.0.6) is clear. Advisory history (1) GHSA-3xgq-45jj-v275 high Nov 08, 2024 Regular Expression Denial of Service (ReDoS) in cross-spawn
#65	react-is	19.2.8	-	Clear	-	0	-
No advisories for the latest published version.
#66	picocolors	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#67	fs-extra	11.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#68	hasown	2.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#69	nanoid	6.0.0	-	Clear	Dec 09, 2024	2	2 moderate
AI-generated context Nanoid has two moderate-severity advisories in its history, both involving conventional vulnerabilities rather than malware: GHSA-qrpm-p2h7-hrv2 concerned exposure of sensitive information to unauthorized actors, and GHSA-mwcw-c2x4-8c55 flagged predictable ID generation when non-integer values were passed as input. These issues have been addressed, and the package's current release at version 6.0.0 is clear. Advisory history (2) GHSA-mwcw-c2x4-8c55 moderate Dec 09, 2024 Predictable results in nanoid generation when given non-integer values GHSA-qrpm-p2h7-hrv2 moderate Jan 21, 2022 Exposure of Sensitive Information to an Unauthorized Actor in nanoid
#70	yargs	18.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#71	resolve-from	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#72	shebang-command	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#73	pretty-format	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#74	json5	2.2.3	-	Clear	Dec 29, 2022	1	1 high
AI-generated context The json5 package has one historical high-severity advisory (GHSA-9c47-m6qq-7p4h) involving a Prototype Pollution vulnerability in its parse method, which could allow attackers to manipulate JavaScript object prototypes. This was a conventional vulnerability, not malware. The package has since been patched and its latest release is clear. Advisory history (1) GHSA-9c47-m6qq-7p4h high Dec 29, 2022 Prototype Pollution in JSON5 via Parse Method
#75	https-proxy-agent	9.1.0	-	Clear	Apr 16, 2020	2	1 critical 1 moderate
AI-generated context The `https-proxy-agent` package has two historical vulnerability advisories: a critical Denial of Service issue (GHSA-8g7p-74h8-hg48) and a moderate Machine-In-The-Middle vulnerability (GHSA-pc5p-h8pf-mvwp), both involving conventional security flaws rather than malware. These issues affected older versions of the package and have since been resolved, as the current release at version 9.1.0 is clear of known advisories. Advisory history (2) GHSA-pc5p-h8pf-mvwp moderate Apr 16, 2020 Machine-In-The-Middle in https-proxy-agent GHSA-8g7p-74h8-hg48 critical Jul 27, 2018 Denial of Service in https-proxy-agent
#76	path-to-regexp	8.4.2	-	Clear	Mar 27, 2026	5	4 high 1 moderate
AI-generated context path-to-regexp has an advisory history focused exclusively on conventional Regular Expression Denial of Service (ReDoS) vulnerabilities, with no malware involvement — advisories GHSA-9wv6-86v2-598j, GHSA-rhx6-c78j-4q9w, GHSA-27v5-c462-wpq7, GHSA-37ch-88jc-xwx2, and GHSA-j3q9-mxjg-w52f all describe scenarios where crafted inputs involving backtracking patterns, multiple wildcards, route parameters, or sequential optional groups could cause excessive processing. These issues reflect an ongoing effort to harden the library's regex generation against pathological inputs. The current release at version 8.4.2 is clear, meaning developers on the latest version are not exposed to these historically identified vulnerabilities. Advisory history (5) GHSA-27v5-c462-wpq7 moderate Mar 27, 2026 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards GHSA-j3q9-mxjg-w52f high Mar 27, 2026 path-to-regexp vulnerable to Denial of Service via sequential optional groups GHSA-37ch-88jc-xwx2 high Mar 27, 2026 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters GHSA-rhx6-c78j-4q9w high Dec 05, 2024 path-to-regexp contains a ReDoS GHSA-9wv6-86v2-598j high Sep 09, 2024 path-to-regexp outputs backtracking regular expressions
#77	path-exists	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#78	punycode	2.3.1	-	Clear	-	0	-
No advisories for the latest published version.
#79	js-tokens	10.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#80	cliui	9.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#81	shebang-regex	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#82	@babel/types	8.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#83	chokidar	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#84	strip-json-comments	5.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#85	inherits	2.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#86	webidl-conversions	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#87	get-stream	9.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#88	eslint-scope	9.1.2	3.7.2	Clear	Jul 12, 2018	1	1 critical
AI-generated context In 2018, eslint-scope was the subject of a critical advisory (GHSA-hxxf-q3w9-4xgw) after a malicious actor compromised a published version of the package to include harmful code, making it one of the more notable supply chain incidents in the JavaScript ecosystem at the time. This was a one-time compromise rather than an ongoing vulnerability class, and the issue was identified and addressed by the maintainers. The package's latest release is now clear, so developers depending on a current version of eslint-scope are not at risk from that historical incident. Advisory history (1) GHSA-hxxf-q3w9-4xgw critical peak affected Jul 12, 2018 Malicious Package in eslint-scope
#89	cookie	2.0.1	-	Clear	Oct 04, 2024	1	1 low
AI-generated context The `cookie` package has one historical advisory in its record, GHSA-pxg6-pf52-xh8x, a low-severity vulnerability in which the package accepted cookie names, paths, and domains containing out-of-bounds characters. This was a conventional vulnerability with no malware involvement, and it has since been resolved. Developers depending on the package today can rely on the current release (2.0.1) being clear of known issues. Advisory history (1) GHSA-pxg6-pf52-xh8x low Oct 04, 2024 cookie accepts cookie name, path, and domain with out of bounds characters
#90	@babel/parser	8.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#91	qs	6.15.3	-	Clear	May 22, 2026	7	4 high 2 moderate 1 low
AI-generated context The `qs` package has an extensive history of conventional security vulnerabilities — no malware has ever been involved — spanning denial-of-service issues (including memory exhaustion and event loop blocking) and prototype pollution flaws across advisories such as GHSA-jjv7-qpx3-h62q, GHSA-hrpp-h998-j3pp, and several others. These issues reflect recurring challenges in safely parsing query strings, particularly around array handling and object prototype manipulation. The current release (6.15.3) is clear, so developers using the latest version are not exposed to these historical vulnerabilities. Advisory history (7) GHSA-q8mj-m7cp-5q26 moderate May 22, 2026 qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set GHSA-w7fw-mjwx-w883 low Feb 12, 2026 qs's arrayLimit bypass in comma parsing allows denial of service GHSA-6rw7-vpxm-498p moderate Dec 30, 2025 qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion GHSA-hrpp-h998-j3pp high Nov 27, 2022 qs vulnerable to Prototype Pollution GHSA-gqgv-6jq5-jjj9 high Apr 30, 2020 Prototype Pollution Protection Bypass in qs GHSA-f9cm-p3w6-xvr3 high Oct 09, 2018 Denial-of-Service Extended Event Loop Blocking in qs GHSA-jjv7-qpx3-h62q high Oct 24, 2017 Denial-of-Service Memory Exhaustion in qs
#92	is-number	7.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#93	whatwg-url	17.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#94	@types/estree	1.0.9	-	Clear	-	0	-
No advisories for the latest published version.
#95	tr46	6.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#96	convert-source-map	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#97	is-glob	4.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#98	braces	3.0.3	-	Clear	May 14, 2024	2	1 high 1 low
AI-generated context The `braces` package has two historical advisories related to Regular Expression Denial of Service and uncontrolled resource consumption (GHSA-cwfw-4gq5-mrqx and GHSA-grv7-fg5c-xmjg), both conventional vulnerabilities rather than malware. These issues, ranging from low to high severity, affected older versions of the package. The current release (3.0.3) is clear, so developers on the latest version are not exposed to these past vulnerabilities. Advisory history (2) GHSA-grv7-fg5c-xmjg high May 14, 2024 Uncontrolled resource consumption in braces GHSA-cwfw-4gq5-mrqx low Jan 06, 2022 Regular Expression Denial of Service (ReDoS) in braces
#99	fast-deep-equal	3.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#100	form-data	4.0.6	-	Clear	Jun 15, 2026	2	1 critical 1 high
AI-generated context The `form-data` package has two conventional security vulnerabilities in its history: a critical advisory (GHSA-fjxv-7rqg-78g4) concerning use of an unsafe random function when generating multipart boundaries, and a high-severity advisory (GHSA-hmw2-7cc7-3qxx) involving CRLF injection through unescaped multipart field names and filenames. Neither issue involved malware. The package is currently clear at version 4.0.6, meaning these vulnerabilities have been addressed in the latest release. Advisory history (2) GHSA-hmw2-7cc7-3qxx high Jun 15, 2026 form-data: CRLF injection in form-data via unescaped multipart field names and filenames GHSA-fjxv-7rqg-78g4 critical Jul 21, 2025 form-data uses unsafe random function in form-data for choosing boundary
#101	lodash	4.18.1	-	Clear	Apr 01, 2026	10	1 critical 4 high 5 moderate
AI-generated context Lodash has an extensive history of conventional security vulnerabilities spanning several years, with no malware involvement. The advisories cover recurring prototype pollution issues (GHSA-fvqr-27wr-82fm, GHSA-4xc9-xhrj-v574, GHSA-jf85-cpcp-j695, GHSA-p6mc-m468-83gw, and others), as well as command injection, code injection via `_.template`, and regular expression denial of service. These are resolved in the current release, but the pattern of repeated vulnerabilities in this package is worth factoring into ongoing dependency management and security monitoring. Advisory history (10) GHSA-r5fr-rjxr-66jc high Apr 01, 2026 lodash vulnerable to Code Injection via `_.template` imports key names GHSA-f23m-r3pf-42rh moderate Apr 01, 2026 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` GHSA-xxjr-mmjv-4gpg moderate Jan 21, 2026 Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions GHSA-29mw-wpgm-hmr9 moderate Jan 06, 2022 Regular Expression Denial of Service (ReDoS) in lodash GHSA-35jh-r3h4-6jhm high May 06, 2021 Command Injection in lodash GHSA-p6mc-m468-83gw high Jul 15, 2020 Prototype Pollution in lodash GHSA-x5rq-j2xg-h7qm moderate Jul 19, 2019 Regular Expression Denial of Service (ReDoS) in lodash GHSA-jf85-cpcp-j695 critical Jul 10, 2019 Prototype Pollution in lodash GHSA-4xc9-xhrj-v574 high Feb 07, 2019 Prototype Pollution in lodash GHSA-fvqr-27wr-82fm moderate Jul 26, 2018 Prototype Pollution in lodash
#102	@babel/helper-validator-identifier	8.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#103	electron-to-chromium	1.5.398	-	Clear	-	0	-
No advisories for the latest published version.
#104	fill-range	7.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#105	function-bind	1.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#106	readdirp	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#107	escalade	3.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#108	graceful-fs	4.2.11	-	Clear	-	0	-
No advisories for the latest published version.
#109	negotiator	1.0.0	-	Clear	Oct 09, 2018	1	1 high
AI-generated context The `negotiator` package has one historical advisory in its record, GHSA-7mc5-chhp-fmc3, a high-severity Regular Expression Denial of Service vulnerability published in 2018. This was a conventional vulnerability rather than malware, involving a crafted input that could cause excessive backtracking in a regex. The package is currently clear at its latest release, so developers depending on an up-to-date version are not affected by this past issue. Advisory history (1) GHSA-7mc5-chhp-fmc3 high Oct 09, 2018 Regular Expression Denial of Service in negotiator
#110	is-stream	4.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#111	camelcase	9.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#112	@babel/runtime	8.0.0	-	Clear	Mar 11, 2025	1	1 moderate
AI-generated context @babel/runtime has one historical advisory (GHSA-968p-4wvh-cqc8) involving a moderate-severity vulnerability where transpiled code using named capturing groups could produce inefficient regular expressions in `.replace` calls, potentially leading to performance issues. This was a conventional vulnerability with no malware involvement. The package's current release is clear, so developers depending on it today are not affected by this issue. Advisory history (1) GHSA-968p-4wvh-cqc8 moderate Mar 11, 2025 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
#113	yocto-queue	1.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#114	to-regex-range	5.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#115	node-fetch	3.3.2	-	Clear	Aug 02, 2022	3	1 high 1 moderate 1 low
AI-generated context node-fetch has a history of conventional security vulnerabilities — no malware was ever involved. The advisories covered a high-severity issue where secure headers were forwarded to untrusted sites (GHSA-r683-j2x4-v87g), a moderate-severity inefficient regular expression (GHSA-vp56-6g26-6827), and a low-severity bug where the `size` option was ignored after redirects (GHSA-w7rc-rwvf-8q5r). These have all been addressed in the package's history, and the current release at version 3.3.2 is clear. Advisory history (3) GHSA-vp56-6g26-6827 moderate Aug 02, 2022 node-fetch Inefficient Regular Expression Complexity GHSA-r683-j2x4-v87g high Jan 21, 2022 node-fetch forwards secure headers to untrusted sites GHSA-w7rc-rwvf-8q5r low Sep 10, 2020 The `size` option isn't honored after following a redirect in node-fetch
#116	micromatch	4.0.8	-	Clear	May 14, 2024	1	1 moderate
AI-generated context Micromatch has one advisory in its history, GHSA-952p-6rrq-rcjv, which identified a moderate-severity Regular Expression Denial of Service (ReDoS) vulnerability. This was a conventional vulnerability rather than malware, meaning a crafted input could cause excessive backtracking in the regex engine. The issue has since been addressed, and the current release (4.0.8) is clear. Advisory history (1) GHSA-952p-6rrq-rcjv moderate May 14, 2024 Regular Expression Denial of Service (ReDoS) in micromatch
#117	node-releases	2.0.51	-	Clear	-	0	-
No advisories for the latest published version.
#118	get-intrinsic	1.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#119	universalify	2.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#120	path-scurry	2.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#121	jsesc	3.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#122	browserslist	4.28.7	-	Clear	May 24, 2021	1	1 moderate
AI-generated context Browserslist has one advisory in its history, GHSA-w8qv-6jwh-64r5, a moderate-severity Regular Expression Denial of Service vulnerability published in 2021. This was a conventional vulnerability, not malware, where a crafted input could cause excessive backtracking in a regular expression. The issue has since been resolved, and the package's current release is clear. Advisory history (1) GHSA-w8qv-6jwh-64r5 moderate May 24, 2021 Regular Expression Denial of Service in browserslist
#123	es-errors	1.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#124	statuses	2.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#125	@radix-ui/react-primitive	2.1.10	-	Clear	-	0	-
No advisories for the latest published version.
#126	magic-string	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#127	rimraf	6.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#128	is-extglob	2.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#129	@jridgewell/trace-mapping	0.3.31	-	Clear	-	0	-
No advisories for the latest published version.
#130	@jridgewell/resolve-uri	3.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#131	http-errors	2.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#132	onetime	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#133	has-symbols	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#134	es-define-property	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#135	gopd	1.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#136	util-deprecate	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#137	object-assign	4.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#138	jiti	2.7.0	-	Clear	-	0	-
No advisories for the latest published version.
#139	yaml	2.9.0	-	Clear	Mar 25, 2026	2	1 high 1 moderate
AI-generated context The `yaml` package has two historical vulnerability advisories: GHSA-f9xv-q969-pqx4, a high-severity uncaught exception issue, and GHSA-48c2-rrv3-qjmp, a moderate-severity stack overflow triggered by deeply nested YAML collections. Both were conventional vulnerabilities rather than malware. The package's latest release is currently clear, so developers on an up-to-date version are not affected by either of these past issues. Advisory history (2) GHSA-48c2-rrv3-qjmp moderate Mar 25, 2026 yaml is vulnerable to Stack Overflow via deeply nested YAML collections GHSA-f9xv-q969-pqx4 high Apr 24, 2023 Uncaught Exception in yaml
#140	dotenv	17.4.2	-	Clear	-	0	-
No advisories for the latest published version.
#141	@babel/generator	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#142	@babel/template	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#143	imurmurhash	0.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#144	postcss-selector-parser	7.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#145	fast-glob	3.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#146	update-browserslist-db	1.2.3	-	Clear	-	0	-
No advisories for the latest published version.
#147	@types/node	26.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#148	@babel/compat-data	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#149	eventemitter3	5.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#150	callsites	4.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#151	http-proxy-agent	9.1.0	-	Clear	Jan 06, 2022	2	1 high 1 moderate
AI-generated context The http-proxy-agent package has two historical denial-of-service vulnerabilities in its past: a high-severity issue (GHSA-8w57-jfpm-945m) published in 2019 and a moderate-severity resource exhaustion issue (GHSA-86wf-436m-h424) published in 2022, both involving conventional vulnerabilities rather than malware. These have since been addressed, and the package's current release at version 9.1.0 is clear of known advisories. Advisory history (2) GHSA-86wf-436m-h424 moderate Jan 06, 2022 Resource Exhaustion Denial of Service in http-proxy-agent GHSA-8w57-jfpm-945m high Jun 11, 2019 Denial of Service in http-proxy-agent
#152	detect-libc	2.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#153	espree	11.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#154	execa	10.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#155	@babel/core	8.0.1	-	Clear	Jun 15, 2026	1	1 low
AI-generated context @babel/core has one low-severity advisory in its history (GHSA-4x5r-pxfx-6jf8), which described an arbitrary file read vulnerability exploitable via a sourceMappingURL comment. This was a conventional security flaw, not malware, and the package's current release at version 8.0.1 is clear of this issue. Advisory history (1) GHSA-4x5r-pxfx-6jf8 low Jun 15, 2026 @babel/core: Arbitrary File Read via sourceMappingURL Comment
#156	@babel/helpers	8.0.0	-	Clear	Mar 11, 2025	1	1 moderate
AI-generated context The package has one historical advisory (GHSA-968p-4wvh-cqc8) involving a moderate-severity vulnerability where Babel's code generation for named capturing groups produced inefficient regular expressions, creating potential ReDoS exposure. This was a conventional vulnerability, not malware-related. The latest release, version 8.0.0, is clear, so developers can depend on it without concern from that prior issue. Advisory history (1) GHSA-968p-4wvh-cqc8 moderate Mar 11, 2025 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
#157	concat-map	0.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#158	source-map-js	1.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#159	tinyglobby	0.2.17	-	Clear	-	0	-
No advisories for the latest published version.
#160	call-bind-apply-helpers	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#161	flat-cache	6.1.23	-	Clear	-	0	-
No advisories for the latest published version.
#162	fdir	6.5.0	-	Clear	-	0	-
No advisories for the latest published version.
#163	pify	6.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#164	@jest/types	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#165	normalize-path	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#166	is-core-module	2.16.2	-	Clear	-	0	-
No advisories for the latest published version.
#167	eslint	10.8.0	-	Clear	-	0	-
No advisories for the latest published version.
#168	minimist	1.2.8	-	Clear	Mar 18, 2022	2	1 critical 1 moderate
AI-generated context The minimist package has two historical advisories, both involving prototype pollution vulnerabilities — one moderate (GHSA-vh95-rmgr-6w4m) and one critical (GHSA-xvch-5gv4-984h) — neither of which involved malware. These were conventional security flaws that have since been addressed, and the package's current release at version 1.2.8 is clear. Advisory history (2) GHSA-xvch-5gv4-984h critical Mar 18, 2022 Prototype Pollution in minimist GHSA-vh95-rmgr-6w4m moderate Apr 03, 2020 Prototype Pollution in minimist
#169	estree-walker	3.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#170	file-entry-cache	11.1.5	-	Clear	-	0	-
No advisories for the latest published version.
#171	object-inspect	1.13.4	-	Clear	-	0	-
No advisories for the latest published version.
#172	buffer	6.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#173	uri-js	4.4.1	-	Clear	Jul 24, 2018	1	1 moderate
AI-generated context uri-js has one advisory in its history, GHSA-333w-rxj3-f55r, a moderate-severity Regular Expression Denial of Service vulnerability published in 2018. This was a conventional vulnerability rather than malware, affecting how the package processed certain URI inputs. The package's latest release is clear, so developers depending on the current version are not exposed to this issue. Advisory history (1) GHSA-333w-rxj3-f55r moderate Jul 24, 2018 Regular Expression Denial Of Service in uri-js
#174	import-fresh	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#175	@babel/helper-module-transforms	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#176	optionator	0.9.4	-	Clear	-	0	-
No advisories for the latest published version.
#177	flatted	3.4.3	-	Clear	Mar 19, 2026	2	2 high
AI-generated context The flatted package has two high-severity vulnerability advisories in its history: GHSA-25h7-pfq9-p65f, involving an unbounded recursion denial-of-service in the `parse()` revive phase, and GHSA-rf6f-7fwh-wjgh, involving prototype pollution also through `parse()`. Both were conventional vulnerabilities with no malware involved, and the current release (3.4.2) is clear, meaning developers on the latest version are not exposed to these issues. Advisory history (2) GHSA-rf6f-7fwh-wjgh high Mar 19, 2026 Prototype Pollution via parse() in NodeJS flatted GHSA-25h7-pfq9-p65f high Mar 13, 2026 flatted vulnerable to unbounded recursion DoS in parse() revive phase
#178	math-intrinsics	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#179	safer-buffer	2.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#180	y18n	5.0.8	4.0.0	Clear	Mar 29, 2021	1	1 high
AI-generated context The y18n package has one historical advisory in its record, GHSA-c4w7-xm78-47vh, a high-severity prototype pollution vulnerability that was disclosed in March 2021. This was a conventional security flaw, not malware, and it has since been addressed. Developers depending on y18n today can do so with confidence, as the latest release is clear of known vulnerabilities. Advisory history (1) GHSA-c4w7-xm78-47vh high peak affected Mar 29, 2021 Prototype Pollution in y18n
#181	@babel/helper-module-imports	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#182	mkdirp	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#183	dunder-proto	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#184	path-parse	1.0.7	-	Clear	Aug 10, 2021	1	1 moderate
AI-generated context path-parse has one advisory in its history, GHSA-hj48-42vr-x3v9, a moderate-severity Regular Expression Denial of Service vulnerability affecting older versions. This was a conventional ReDoS issue, not malware. The package has since been updated and its current release at version 1.0.7 is clear of known vulnerabilities. Advisory history (1) GHSA-hj48-42vr-x3v9 moderate Aug 10, 2021 Regular Expression Denial of Service in path-parse
#185	fastq	1.20.1	-	Clear	-	0	-
No advisories for the latest published version.
#186	levn	0.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#187	@babel/helper-compilation-targets	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#188	@babel/helper-string-parser	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#189	keyv	5.6.0	-	Clear	-	0	-
No advisories for the latest published version.
#190	get-proto	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#191	csstype	3.2.3	-	Clear	-	0	-
No advisories for the latest published version.
#192	npm-run-path	6.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#193	fast-json-stable-stringify	2.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#194	reusify	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#195	@babel/helper-plugin-utils	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#196	kind-of	6.0.3	-	Clear	Mar 31, 2020	1	1 high
AI-generated context The `kind-of` package has one historical advisory in its record, GHSA-6c8f-qphg-qjgp, a high-severity vulnerability involving a validation bypass that was published in 2020. This was a conventional security flaw, not malware, and it has since been resolved. The package's latest release (6.0.3) is clear, so developers depending on an up-to-date version are not affected by this past issue. Advisory history (1) GHSA-6c8f-qphg-qjgp high Mar 31, 2020 Validation Bypass in kind-of
#197	mime	4.1.0	-	Clear	Jul 20, 2018	1	1 high
AI-generated context The `mime` package has one historical advisory in its record (GHSA-wrvr-8mpx-r7pp), a high-severity Regular Expression Denial of Service vulnerability that could be triggered when performing MIME type lookups on untrusted user input. This was a conventional vulnerability, not malware. The package's current release is clear, so developers depending on an up-to-date version of `mime` are not affected by this past issue. Advisory history (1) GHSA-wrvr-8mpx-r7pp high Jul 20, 2018 mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input
#198	caniuse-lite	1.0.30001806	-	Clear	-	0	-
No advisories for the latest published version.
#199	lines-and-columns	2.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#200	fast-levenshtein	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#201	supports-preserve-symlinks-flag	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#202	make-dir	5.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#203	slash	5.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#204	prelude-ls	1.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#205	typescript	7.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#206	strip-bom	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#207	parent-module	3.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#208	esutils	2.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#209	ci-info	4.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#210	@smithy/util-utf8	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#211	type-check	0.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#212	mimic-fn	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#213	@babel/helper-validator-option	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#214	@types/json-schema	7.0.15	-	Clear	-	0	-
No advisories for the latest published version.
#215	@rolldown/pluginutils	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#216	side-channel-list	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#217	json-buffer	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#218	raw-body	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#219	has-tostringtag	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#220	wrappy	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#221	diff	9.0.0	-	Clear	Jan 14, 2026	2	1 high 1 low
AI-generated context The `diff` package has two historical advisories, both involving denial of service vulnerabilities rather than malware. GHSA-h6ch-v84p-w6p9 (high severity) identified a Regular Expression Denial of Service issue, while GHSA-73rr-hh4g-fpgx (low severity) flagged DoS risks in the `parsePatch` and `applyPatch` functions. The package's latest release (9.0.0) is currently clear, so developers depending on an up-to-date version are not affected by either of these past issues. Advisory history (2) GHSA-73rr-hh4g-fpgx low Jan 14, 2026 jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch GHSA-h6ch-v84p-w6p9 high Jun 13, 2019 Regular Expression Denial of Service (ReDoS)
#222	jackspeak	4.2.3	-	Clear	-	0	-
No advisories for the latest published version.
#223	baseline-browser-mapping	2.11.6	-	Clear	-	0	-
No advisories for the latest published version.
#224	deep-is	0.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#225	foreground-child	4.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#226	@eslint/js	10.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#227	anymatch	3.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#228	natural-compare	1.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#229	esquery	1.7.0	-	Clear	-	0	-
No advisories for the latest published version.
#230	@eslint-community/regexpp	4.12.2	-	Clear	-	0	-
No advisories for the latest published version.
#231	es-set-tostringtag	2.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#232	acorn-jsx	5.3.2	-	Clear	-	0	-
No advisories for the latest published version.
#233	parse5	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#234	finalhandler	2.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#235	parse-json	8.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#236	depd	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#237	axios	1.18.1	1.15.2	Clear	Jul 20, 2026 Malware incident · Mar 2026	44	18 high 23 moderate 2 low 1 malware
Advisory history (44) GHSA-gcfj-64vw-6mp9 high Jul 20, 2026 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning GHSA-hcpx-6fm6-wx23 moderate Jul 20, 2026 Axios form serializer maxDepth bypass via {} metatoken GHSA-7q8q-rj6j-mhjq moderate Jul 20, 2026 Axios: Nested axios option objects can consume polluted prototype values GHSA-mwf2-3pr3-8698 moderate Jul 20, 2026 Axios: HTTP/2 streamed uploads bypass `maxBodyLength` GHSA-jqh4-m9w3-8hp9 moderate Jul 20, 2026 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` GHSA-mmx7-hfxf-jppx moderate Jul 20, 2026 Axios: Prototype pollution gadgets can alter axios request construction GHSA-f4gw-2p7v-4548 moderate Jul 20, 2026 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios GHSA-42h9-826w-cgv3 moderate Jul 20, 2026 Axios: Excessive recursion in formDataToJSON can cause denial of service GHSA-xj6q-8x83-jv6g moderate Jul 20, 2026 Axios: Prototype pollution auth subfields can inject Basic auth GHSA-pmv8-rq9r-6j72 moderate Jul 20, 2026 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service GHSA-hfxv-24rg-xrqf high Jun 04, 2026 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection GHSA-777c-7fjr-54vf high Jun 04, 2026 Allocation of Resources Without Limits or Throttling in Axios GHSA-p92q-9vqr-4j8v high Jun 04, 2026 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter GHSA-j5f8-grm9-p9fc high Jun 04, 2026 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection GHSA-3g43-6gmg-66jw high May 29, 2026 axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge GHSA-35jp-ww65-95wh high May 29, 2026 axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` GHSA-pjwm-pj3p-43mv high May 29, 2026 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) GHSA-898c-q2cr-xwhg moderate May 29, 2026 axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions GHSA-654m-c8p4-x5fp low peak affected May 29, 2026 Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix GHSA-445q-vr5w-6q77 moderate May 05, 2026 Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream GHSA-m7pr-hjqh-92cm moderate May 05, 2026 Axios: no_proxy bypass via IP alias allows SSRF GHSA-62hf-57xw-28j9 moderate May 05, 2026 Axios: unbounded recursion in toFormData causes DoS via deeply nested request data GHSA-5c9x-8gcm-mpgx moderate May 05, 2026 Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 GHSA-vf2m-468p-8v99 moderate May 05, 2026 Axios: HTTP adapter streamed responses bypass maxContentLength GHSA-pf86-5x62-jrwf high May 05, 2026 Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking GHSA-6chq-wfr3-2hj9 high May 05, 2026 Axios: Header Injection via Prototype Pollution GHSA-xx6v-rp6x-q39c moderate May 05, 2026 Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion GHSA-w9j2-pvgh-6h63 moderate May 05, 2026 Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy GHSA-pmwg-cvhr-8vh7 high May 05, 2026 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 GHSA-3w6x-2g7m-8v23 moderate May 05, 2026 Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` GHSA-q8qp-cvcw-x6jj high May 05, 2026 Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking GHSA-xhjh-pmcv-23jw low May 05, 2026 Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams GHSA-fvcv-3m26-pcqx moderate Apr 10, 2026 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain GHSA-3p68-rc4w-qgx5 moderate Apr 09, 2026 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF GHSA-qj83-cq47-w5f8 moderate Apr 08, 2026 Axios HTTP/2 Session Cleanup State Corruption Vulnerability MAL-2026-2307 malware Mar 31, 2026 Malicious code in axios (npm) GHSA-43fc-jf86-j433 high Feb 09, 2026 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig GHSA-4hjh-wcwx-xvwj high Sep 11, 2025 Axios is vulnerable to DoS attack through lack of data size check GHSA-jr5f-v2jv-69x6 high Mar 07, 2025 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL GHSA-8hc4-vh64-cxmj high Aug 12, 2024 Server-Side Request Forgery in axios GHSA-wf5p-g6vw-rhxx moderate Nov 08, 2023 Axios Cross-Site Request Forgery Vulnerability GHSA-cph5-m8f7-6c5x high Sep 01, 2021 axios Inefficient Regular Expression Complexity vulnerability GHSA-4w2v-q235-vp99 moderate Jan 04, 2021 Axios vulnerable to Server-Side Request Forgery GHSA-42xw-2xvc-qx8m high May 29, 2019 Denial of Service in axios
#238	run-parallel	1.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#239	source-map-support	0.5.21	-	Clear	-	0	-
No advisories for the latest published version.
#240	esrecurse	4.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#241	call-bound	1.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#242	content-disposition	2.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#243	human-signals	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#244	ts-api-utils	2.5.0	-	Clear	-	0	-
No advisories for the latest published version.
#245	ansi-escapes	7.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#246	jest-util	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#247	send	1.2.1	-	Clear	Sep 10, 2024	3	1 moderate 2 low
AI-generated context The `send` package has a history of conventional security vulnerabilities, including two low-to-moderate severity issues disclosed in 2017 involving directory traversal and root path disclosure (GHSA-xwg4-93c6-3h42 and GHSA-jgqf-hwc5-hh37), as well as a more recent low-severity template injection flaw that could lead to XSS (GHSA-m6fv-jmcg-4jfg). None of these advisories involved malware. The current release is clear, so developers using the latest version benefit from the fixes that addressed this past vulnerability history. Advisory history (3) GHSA-m6fv-jmcg-4jfg low Sep 10, 2024 send vulnerable to template injection that can lead to XSS GHSA-jgqf-hwc5-hh37 moderate Oct 24, 2017 Root Path Disclosure in send GHSA-xwg4-93c6-3h42 low Oct 24, 2017 Directory Traversal in send
#248	@opentelemetry/core	2.10.0	-	Clear	Jun 15, 2026	1	1 moderate
AI-generated context The `@opentelemetry/core` package has one historical advisory (GHSA-8988-4f7v-96qf) involving a moderate-severity conventional vulnerability related to unbounded memory allocation in W3C Baggage propagation. This was not malware, but rather a resource-management flaw that could have allowed excessive memory consumption. The issue has since been resolved, and the current release at version 2.9.0 is clear. Advisory history (1) GHSA-8988-4f7v-96qf moderate Jun 15, 2026 OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
#249	type-is	2.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#250	encodeurl	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#251	once	1.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#252	cosmiconfig	9.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#253	lodash.merge	4.6.2	-	Clear	Sep 03, 2020	2	2 high
AI-generated context The lodash.merge package has two historical high-severity advisories (GHSA-2m96-9w4j-wgv7 and GHSA-h726-x36v-rx45), both concerning prototype pollution vulnerabilities published in September 2020. These were conventional security vulnerabilities, not malware, and no malicious code was ever involved. The package's current release at version 4.6.2 is clear, so developers depending on this version are not exposed to those historical issues. Advisory history (2) GHSA-2m96-9w4j-wgv7 high Sep 03, 2020 Prototype Pollution in lodash.merge GHSA-h726-x36v-rx45 high Sep 03, 2020 Prototype Pollution in lodash.merge
#254	json-stable-stringify-without-jsonify	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#255	open	11.0.0	-	Clear	Jun 20, 2019	1	1 critical
AI-generated context The `open` package has one historical advisory in its record, GHSA-28xh-wpgr-7fm8, a critical command injection vulnerability published in 2019. This was a conventional security flaw, not malware, affecting older versions of the package. The issue has since been resolved, and the current release at version 11.0.0 is clear. Advisory history (1) GHSA-28xh-wpgr-7fm8 critical Jun 20, 2019 Command Injection in open
#256	prettier	3.9.6	-	Clear	-	0	-
No advisories for the latest published version.
#257	@eslint/eslintrc	3.3.6	-	Clear	-	0	-
No advisories for the latest published version.
#258	is-arrayish	0.3.4	0.3.3	Clear	Sep 15, 2025 Malware incident · Sep 2025	2	1 high 1 malware
AI-generated context The package has a notable security incident in its history: version 0.3.3 was compromised with malicious code following an npm account takeover, documented in both GHSA-frh7-2f84-v9mw and MAL-2025-46977. This was a supply chain attack where a legitimate package was hijacked to distribute malware, rather than a conventional vulnerability in the code itself. The issue has since been addressed, and the current release (0.3.4) is clear. Advisory history (2) GHSA-frh7-2f84-v9mw high peak affected Sep 15, 2025 is-arrayish@0.3.3 contains malware after npm account takeover MAL-2025-46977 malware peak affected Sep 08, 2025 Malicious code in is-arrayish (npm)
#259	@jridgewell/sourcemap-codec	1.5.5	-	Clear	-	0	-
No advisories for the latest published version.
#260	gensync	1.0.0-beta.2	-	Clear	-	0	-
No advisories for the latest published version.
#261	word-wrap	1.2.5	-	Clear	Jun 22, 2023	1	1 moderate
AI-generated context The word-wrap package has one historical advisory, GHSA-j8xg-fqg3-53r7, which identified a moderate-severity Regular Expression Denial of Service (ReDoS) vulnerability in older versions. This was a conventional vulnerability rather than malware. The issue has since been resolved, and the current release at version 1.2.5 is clear. Advisory history (1) GHSA-j8xg-fqg3-53r7 moderate Jun 22, 2023 word-wrap vulnerable to Regular Expression Denial of Service
#262	express	5.2.1	-	Clear	Oct 29, 2024	5	3 moderate 2 low
AI-generated context Express has a history of conventional security vulnerabilities — no malware — spanning several years, including issues with missing charset declarations in Content-Type headers (GHSA-gpvr-g6gh-9mc2), open redirect flaws in malformed URLs (GHSA-rv95-896h-c2vc, GHSA-jj78-5fmv-mv28), an XSS vector via `response.redirect()` (GHSA-qw6h-vgh9-j6wx), and a resource injection issue (GHSA-cm5g-3pgc-8rg4). These were all moderate or low severity and reflect the kind of edge-case HTTP handling bugs common in mature web frameworks. The current release is clear, so developers using the latest version of Express are not exposed to these historical issues. Advisory history (5) GHSA-cm5g-3pgc-8rg4 moderate Oct 29, 2024 Express ressource injection GHSA-jj78-5fmv-mv28 low Oct 03, 2024 Express Open Redirect vulnerability GHSA-qw6h-vgh9-j6wx low Sep 10, 2024 express vulnerable to XSS via response.redirect() GHSA-rv95-896h-c2vc moderate Mar 25, 2024 Express.js Open Redirect in malformed URLs GHSA-gpvr-g6gh-9mc2 moderate Oct 23, 2018 No Charset in Content-Type Header in express
#263	arg	5.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#264	jsonfile	6.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#265	schema-utils	4.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#266	@smithy/is-array-buffer	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#267	@typescript-eslint/types	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#268	chownr	3.0.0	-	Clear	Feb 10, 2022	1	1 low
AI-generated context The chownr package has one historical advisory in its record, GHSA-c6rq-rjc2-86v2, which described a low-severity Time-of-check Time-of-use (TOCTOU) race condition vulnerability — a conventional security flaw, not malware. This issue has since been resolved, and the package's current release at version 3.0.0 is clear. Advisory history (1) GHSA-c6rq-rjc2-86v2 low Feb 10, 2022 Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
#269	delayed-stream	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#270	@smithy/util-buffer-from	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#271	asynckit	0.5.0	-	Clear	-	0	-
No advisories for the latest published version.
#272	tapable	2.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#273	enhanced-resolve	5.24.4	-	Clear	-	0	-
No advisories for the latest published version.
#274	aria-query	5.3.2	-	Clear	-	0	-
No advisories for the latest published version.
#275	indent-string	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#276	bytes	3.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#277	binary-extensions	3.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#278	ini	7.0.0	-	Clear	Dec 10, 2020	1	1 high
AI-generated context The `ini` package has one past high-severity advisory (GHSA-qqgx-2p2h-9c37) involving a Prototype Pollution vulnerability in the `ini.parse` function, which affected versions prior to 1.3.6. This was a conventional security vulnerability, not malware. The package's current release is clear, so developers depending on an up-to-date version are not exposed to this issue. Advisory history (1) GHSA-qqgx-2p2h-9c37 high Dec 10, 2020 ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse
#279	@radix-ui/react-context	1.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#280	doctrine	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#281	queue-microtask	1.2.3	-	Clear	-	0	-
No advisories for the latest published version.
#282	accepts	1.3.8	-	Clear	-	0	-
No advisories for the latest published version.
#283	merge2	1.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#284	get-caller-file	2.0.5	-	Clear	-	0	-
No advisories for the latest published version.
#285	@humanwhocodes/retry	0.4.3	-	Clear	-	0	-
No advisories for the latest published version.
#286	@jridgewell/gen-mapping	0.3.13	-	Clear	-	0	-
No advisories for the latest published version.
#287	@typescript-eslint/typescript-estree	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#288	jest-worker	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#289	proxy-from-env	2.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#290	clsx	2.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#291	side-channel-map	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#292	@typescript-eslint/visitor-keys	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#293	fresh	0.5.2	-	Clear	Jul 24, 2018	1	1 high
AI-generated context The `fresh` package has one historical advisory in its record, GHSA-9qj9-36jm-prpv, a high-severity Regular Expression Denial of Service vulnerability published in 2018. This was a conventional vulnerability, not malware, meaning a crafted input could cause excessive backtracking in a regular expression and degrade performance. The issue has since been addressed, and the current release (0.5.2) is clear. Advisory history (1) GHSA-9qj9-36jm-prpv high Jul 24, 2018 Regular Expression Denial of Service in fresh
#294	restore-cursor	5.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#295	on-finished	2.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#296	is-plain-obj	4.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#297	ipaddr.js	2.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#298	pathe	2.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#299	@jest/schemas	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#300	base64-js	1.5.1	-	Clear	-	0	-
No advisories for the latest published version.
#301	@smithy/types	4.16.1	-	Clear	-	0	-
No advisories for the latest published version.
#302	require-directory	2.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#303	tough-cookie	6.0.2	-	Clear	Jul 01, 2023	3	1 high 2 moderate
AI-generated context tough-cookie has a history of conventional security vulnerabilities, including two Regular Expression Denial of Service (ReDoS) issues (GHSA-g7q5-pjjr-gqvp, GHSA-qhv9-728r-6jqg) reported in 2018 and a moderate Prototype Pollution vulnerability (GHSA-72xf-g2v4-qvf3) disclosed in 2023. None of these advisories involved malware. The package's current release at version 6.0.2 is clear, so developers depending on it today can do so without concern from these past issues. Advisory history (3) GHSA-72xf-g2v4-qvf3 moderate Jul 01, 2023 tough-cookie Prototype Pollution vulnerability GHSA-qhv9-728r-6jqg moderate Oct 10, 2018 ReDoS via long string of semicolons in tough-cookie GHSA-g7q5-pjjr-gqvp high Jul 24, 2018 Regular Expression Denial of Service in tough-cookie
#304	is-binary-path	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#305	body-parser	2.3.0	-	Clear	Jul 20, 2026	3	1 high 1 moderate 1 low
Advisory history (3) GHSA-v422-hmwv-36x6 low Jul 20, 2026 body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement GHSA-wqch-xfxh-vrr4 moderate Nov 25, 2025 body-parser is vulnerable to denial of service when url encoding is used GHSA-qwcr-r2fm-qrc7 high Sep 10, 2024 body-parser vulnerable to denial of service when url encoding is enabled
#306	postcss-value-parser	4.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#307	media-typer	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#308	setprototypeof	1.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#309	side-channel-weakmap	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#310	@typescript-eslint/tsconfig-utils	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#311	@isaacs/cliui	9.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#312	@rollup/rollup-linux-x64-gnu	4.62.3	-	Clear	-	0	-
No advisories for the latest published version.
#313	is-wsl	3.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#314	retry	0.13.1	-	Clear	-	0	-
No advisories for the latest published version.
#315	@aws-sdk/types	3.974.2	-	Clear	-	0	-
No advisories for the latest published version.
#316	@types/react-dom	19.2.3	-	Clear	-	0	-
No advisories for the latest published version.
#317	combined-stream	1.0.8	-	Clear	-	0	-
No advisories for the latest published version.
#318	es-object-atoms	1.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#319	@eslint/core	1.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#320	whatwg-mimetype	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#321	domutils	4.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#322	@rollup/rollup-linux-x64-musl	4.62.3	-	Clear	-	0	-
No advisories for the latest published version.
#323	core-util-is	1.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#324	@typescript-eslint/scope-manager	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#325	esprima	4.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#326	loose-envify	1.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#327	cookie-signature	1.2.2	-	Clear	Jan 06, 2020	1	1 moderate
AI-generated context The package has one advisory in its history, GHSA-92vm-wfm5-mxvv, which flagged a moderate-severity timing attack vulnerability in cookie-signature — a conventional cryptographic flaw rather than malware. This issue has since been resolved, and the package's current release at version 1.2.2 is clear. Advisory history (1) GHSA-92vm-wfm5-mxvv moderate Jan 06, 2020 cookie-signature Timing Attack
#328	follow-redirects	1.16.0	-	Clear	Apr 14, 2026	5	1 high 4 moderate
AI-generated context The follow-redirects package has accumulated several conventional security vulnerabilities over the years, none involving malware, centered primarily on the improper handling of sensitive information — including advisories GHSA-74fj-2j2h-c42q and GHSA-pw2r-vq6v-hr8c covering exposure of sensitive data, and multiple issues around authentication headers being leaked to unintended hosts during redirects. Additional advisories flagged problems with URL parsing and Proxy-Authorization headers being forwarded across different domains. The current release at version 1.16.0 is clear, so developers depending on it today should ensure they are on the latest version to benefit from the fixes addressing this history of redirect-related information disclosure issues. Advisory history (5) GHSA-r4q5-vmmm-2653 moderate Apr 14, 2026 follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets GHSA-cxjh-pqwp-8mfp moderate Mar 14, 2024 follow-redirects' Proxy-Authorization header kept across hosts GHSA-jchw-25xp-jwwc moderate Jan 02, 2024 Follow Redirects improperly handles URLs in the url.parse() function GHSA-pw2r-vq6v-hr8c moderate Feb 10, 2022 Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects GHSA-74fj-2j2h-c42q high Jan 12, 2022 Exposure of sensitive information in follow-redirects
#329	cli-cursor	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#330	strip-final-newline	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#331	@typescript-eslint/project-service	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#332	eastasianwidth	0.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#333	json-parse-even-better-errors	6.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#334	sprintf-js	1.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#335	path-type	6.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#336	content-type	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#337	es-module-lexer	2.3.1	-	Clear	-	0	-
No advisories for the latest published version.
#338	@nodelib/fs.scandir	4.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#339	write-file-atomic	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#340	@eslint/plugin-kit	0.7.2	-	Clear	Jul 18, 2025	2	2 low
AI-generated context The advisory history for `@eslint/plugin-kit` consists entirely of conventional (non-malware) vulnerabilities — specifically two low-severity Regular Expression Denial of Service (ReDoS) issues (GHSA-7q7g-4xm8-89cq and GHSA-xffm-g5w8-qvg7), one affecting general regex handling and one targeting the `ConfigCommentParser`. Both have since been addressed, and the package's current release at version 0.7.2 is clear, making it safe to depend on today. Advisory history (2) GHSA-xffm-g5w8-qvg7 low Jul 18, 2025 @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser GHSA-7q7g-4xm8-89cq low Nov 15, 2024 Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
#341	ieee754	1.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#342	prop-types	15.8.1	-	Clear	-	0	-
No advisories for the latest published version.
#343	require-from-string	2.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#344	dom-serializer	3.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#345	call-bind	1.0.9	-	Clear	-	0	-
No advisories for the latest published version.
#346	@eslint/config-array	0.23.5	-	Clear	-	0	-
No advisories for the latest published version.
#347	has-property-descriptors	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#348	@nodelib/fs.stat	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#349	merge-descriptors	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#350	slice-ansi	9.0.0	7.1.1	Clear	Sep 08, 2025 Malware incident · Sep 2025	1	1 malware
AI-generated context Advisory MAL-2025-46979 flagged a malicious version of slice-ansi on npm, indicating the package was at some point compromised with malicious code. This is a historical finding and the package's current latest release, version 9.0.0, is clear, so developers using that version are not affected. Advisory history (1) MAL-2025-46979 malware peak affected Sep 08, 2025 Malicious code in slice-ansi (npm)
#351	rxjs	7.8.2	-	Clear	-	0	-
No advisories for the latest published version.
#352	p-map	7.0.6	-	Clear	-	0	-
No advisories for the latest published version.
#353	toidentifier	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#354	globby	16.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#355	domhandler	6.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#356	async	3.2.6	-	Clear	Apr 07, 2022	1	1 high
AI-generated context The `async` package has one historical advisory in its record, GHSA-fwr7-v2mv-hh25, a high-severity prototype pollution vulnerability that was disclosed in April 2022. This was a conventional vulnerability rather than malware, affecting how the library handled certain object inputs in a way that could allow attackers to manipulate JavaScript object prototypes. The package's latest release is clear, so developers on an up-to-date version are not exposed to this issue. Advisory history (1) GHSA-fwr7-v2mv-hh25 high Apr 07, 2022 Prototype Pollution in async
#357	@babel/helper-globals	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#358	pirates	4.0.7	-	Clear	-	0	-
No advisories for the latest published version.
#359	@opentelemetry/semantic-conventions	1.43.0	-	Clear	-	0	-
No advisories for the latest published version.
#360	@typescript-eslint/utils	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#361	date-fns	4.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#362	is-docker	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#363	tar	7.5.22	7.5.1	Clear	Jul 24, 2026	21	1 critical 14 high 6 moderate
Advisory history (21) GHSA-r292-9mhp-454m moderate Jul 24, 2026 node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection GHSA-w8wr-v893-vjvp moderate Jul 20, 2026 node-tar: Process crash via PAX numeric path type confusion GHSA-23hp-3jrh-7fpw critical Jul 20, 2026 node-tar: Decompression/parse DoS via unlimited input GHSA-8x88-c5mf-7j5w high Jul 20, 2026 node-tar: Negative tar entry size causes infinite loop in archive replace GHSA-gvwx-54wh-qm9j moderate Jul 20, 2026 node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records GHSA-vmf3-w455-68vh moderate Jun 15, 2026 node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) GHSA-9ppj-qmqm-q256 high Mar 10, 2026 node-tar Symlink Path Traversal via Drive-Relative Linkpath GHSA-qffp-2rhf-9h96 high Mar 05, 2026 tar has Hardlink Path Traversal via Drive-Relative Linkpath GHSA-83g3-92jg-28cx high Feb 18, 2026 Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction GHSA-34x7-hfp2-rc4v high Jan 28, 2026 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal GHSA-r6q2-hw4h-h46w high Jan 21, 2026 Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS GHSA-8qq5-rm4j-mr97 high Jan 16, 2026 node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization GHSA-29xp-372q-xqph moderate peak affected Oct 30, 2025 node-tar has a race condition leading to uninitialized memory exposure GHSA-f5x3-32g6-xq36 moderate Mar 22, 2024 Denial of service while parsing a tar file due to lack of folders count validation GHSA-9r2w-394v-53qc high Aug 31, 2021 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links GHSA-qq89-hq3f-393p high Aug 31, 2021 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links GHSA-5955-9wpr-37jh high Aug 31, 2021 Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization GHSA-3jfq-g458-7qm9 high Aug 03, 2021 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization GHSA-r628-mhmh-qjhw high Aug 03, 2021 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning GHSA-j44m-qm6p-hp7m high May 01, 2019 Arbitrary File Overwrite in tar GHSA-gfjr-3jmm-4g9v high Oct 24, 2017 Symlink Arbitrary File Overwrite in tar
#364	which-typed-array	1.1.22	-	Clear	-	0	-
No advisories for the latest published version.
#365	ajv-formats	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#366	@opentelemetry/api-logs	0.221.0	-	Clear	-	0	-
No advisories for the latest published version.
#367	@opentelemetry/resources	2.10.0	-	Clear	-	0	-
No advisories for the latest published version.
#368	side-channel	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#369	cjs-module-lexer	2.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#370	range-parser	1.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#371	@humanfs/node	0.16.8	-	Clear	-	0	-
No advisories for the latest published version.
#372	define-data-property	1.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#373	node-addon-api	8.9.0	-	Clear	-	0	-
No advisories for the latest published version.
#374	pako	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#375	lilconfig	3.1.3	-	Clear	Oct 31, 2024	1	1 high
AI-generated context Lilconfig has one advisory in its history, GHSA-fq9m-v26v-2m4f, a high-severity code injection vulnerability published in late 2024. This was a conventional security flaw, not malware. The package is clear at its latest release, version 3.1.3, so developers on the current version are not affected by that past issue. Advisory history (1) GHSA-fq9m-v26v-2m4f high Oct 31, 2024 lilconfig Code Injection vulnerability
#376	fast-uri	4.1.1	-	Clear	Jul 21, 2026	4	4 high
Advisory history (4) GHSA-v2hh-gcrm-f6hx high Jul 21, 2026 fast-uri vulnerable to host confusion via literal backslash authority delimiter GHSA-4c8g-83qw-93j6 high Jul 21, 2026 fast-uri vulnerable to host confusion via failed IDN canonicalization GHSA-v39h-62p7-jpjc high May 08, 2026 fast-uri vulnerable to host confusion via percent-encoded authority delimiters GHSA-q3j6-qgpj-74h6 high May 08, 2026 fast-uri vulnerable to path traversal via percent-encoded dot segments
#377	ip-address	10.3.1	-	Clear	May 05, 2026	1	1 moderate
AI-generated context The `ip-address` package has one historical advisory (GHSA-v2v4-37r5-5v8g) involving a moderate-severity cross-site scripting (XSS) vulnerability in the Address6 HTML-emitting methods, a conventional security flaw rather than malware. This issue has since been resolved, and the package's current release at version 10.2.0 is clear. Advisory history (1) GHSA-v2v4-37r5-5v8g moderate May 05, 2026 ip-address has XSS in Address6 HTML-emitting methods
#378	fs.realpath	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#379	@img/sharp-libvips-linuxmusl-x64	1.3.2	-	Clear	-	0	-
No advisories for the latest published version.
#380	cssesc	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#381	@opentelemetry/instrumentation	0.221.0	-	Clear	Aug 09, 2023	1	1 high
AI-generated context The package has one historical advisory, GHSA-f8pq-3926-8gx5, a high-severity vulnerability involving unsanitized user-controlled input in module generation, not malware. This was a conventional security flaw that has since been addressed, and the package currently ships at version 0.220.0 with a clear status. Developers depending on this package today can do so with confidence, provided they are on a sufficiently recent release. Advisory history (1) GHSA-f8pq-3926-8gx5 high Aug 09, 2023 Unsanitized user controlled input in module generation
#382	domelementtype	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#383	hosted-git-info	10.1.1	-	Clear	May 06, 2021	1	1 moderate
AI-generated context The package hosted-git-info has one historical advisory in its record, GHSA-43f8-2h32-f4cj, which described a moderate-severity Regular Expression Denial of Service vulnerability — a conventional flaw with no malware involvement. This issue has since been addressed, and the package's current release is clear, making it safe to depend on today. Advisory history (1) GHSA-43f8-2h32-f4cj moderate May 06, 2021 Regular Expression Denial of Service in hosted-git-info
#384	@eslint/object-schema	3.0.5	-	Clear	-	0	-
No advisories for the latest published version.
#385	etag	1.8.1	-	Clear	-	0	-
No advisories for the latest published version.
#386	@eslint/config-helpers	0.7.0	-	Clear	-	0	-
No advisories for the latest published version.
#387	package-json-from-dist	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#388	@humanfs/core	0.19.2	-	Clear	-	0	-
No advisories for the latest published version.
#389	htmlparser2	12.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#390	jest-message-util	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#391	for-each	0.3.5	-	Clear	-	0	-
No advisories for the latest published version.
#392	pkg-dir	9.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#393	unpipe	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#394	buffer-from	1.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#395	es-abstract	1.24.2	-	Clear	-	0	-
No advisories for the latest published version.
#396	is-unicode-supported	2.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#397	@types/yargs	17.0.35	-	Clear	-	0	-
No advisories for the latest published version.
#398	is-callable	1.2.7	-	Clear	-	0	-
No advisories for the latest published version.
#399	fast-xml-parser	5.10.1	4.2.4	Clear	Jul 21, 2026	12	1 critical 6 high 3 moderate 2 low
Advisory history (12) GHSA-8r6m-32jq-jx6q high Jul 21, 2026 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits GHSA-gh4j-gqv2-49f6 moderate Apr 22, 2026 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters GHSA-jp2q-39xq-3w4g moderate Mar 19, 2026 Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser GHSA-8gc5-j5rx-235r high Mar 17, 2026 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) GHSA-fj3w-jwp8-x2g3 low Feb 26, 2026 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder GHSA-m7jm-9gc2-mpf2 critical Feb 20, 2026 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names GHSA-jmr7-xgp7-cmfj high Feb 17, 2026 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) GHSA-37qj-frw5-hhjh high Jan 30, 2026 fast-xml-parser has RangeError DoS Numeric Entities Bug GHSA-mpg4-rc92-vx8v high Jul 29, 2024 fast-xml-parser vulnerable to ReDOS at currency parsing GHSA-gpv5-7x3g-ghjv low peak affected Jun 15, 2023 fast-xml-parser regex vulnerability patch could be improved from a safety perspective GHSA-x3cc-x39p-42qx moderate Jun 13, 2023 fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name GHSA-6w63-h3fj-q4vw high Jun 06, 2023 fast-xml-parser vulnerable to Regex Injection via Doctype Entities
#400	istanbul-lib-instrument	6.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#401	escape-html	1.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#402	is-regex	1.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#403	dom-accessibility-api	0.7.1	-	Clear	-	0	-
No advisories for the latest published version.
#404	css-tree	3.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#405	error-ex	1.3.4	1.3.3	Clear	Sep 15, 2025 Malware incident · Sep 2025	2	1 high 1 malware
AI-generated context The package experienced a serious security incident in which version 1.3.3 was compromised with malicious code following an npm account takeover, documented in both GHSA-6jp5-hh4c-8c5h and MAL-2025-46975. This was a supply chain attack involving actual malware injected into a published release, not a conventional vulnerability. The latest release, 1.3.4, is clear, but developers should ensure they are not pinned to the affected 1.3.3 version. Advisory history (2) GHSA-6jp5-hh4c-8c5h high peak affected Sep 15, 2025 error-ex@1.3.3 contains malware after npm account takeover MAL-2025-46975 malware peak affected Sep 08, 2025 Malicious code in error-ex (npm)
#406	ee-first	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#407	@types/unist	3.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#408	log-symbols	7.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#409	path-is-absolute	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#410	end-of-stream	1.4.5	-	Clear	-	0	-
No advisories for the latest published version.
#411	@vitest/utils	4.1.10	-	Clear	-	0	-
No advisories for the latest published version.
#412	object.assign	4.1.7	-	Clear	-	0	-
No advisories for the latest published version.
#413	object-keys	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#414	tinyexec	1.2.4	-	Clear	-	0	-
No advisories for the latest published version.
#415	scheduler	0.27.0	-	Clear	-	0	-
No advisories for the latest published version.
#416	p-try	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#417	process-nextick-args	2.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#418	vary	1.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#419	@babel/traverse	8.0.4	-	Clear	Oct 16, 2023	1	1 critical
AI-generated context @babel/traverse has one critical advisory in its history (GHSA-67hx-6x53-jw92), which identified an arbitrary code execution vulnerability triggered when the compiler processed specially crafted malicious input. This was a conventional vulnerability rather than malware, and it has since been resolved. The package's current release is clear, so developers on an up-to-date version are not exposed to this issue. Advisory history (1) GHSA-67hx-6x53-jw92 critical Oct 16, 2023 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
#420	@pkgjs/parseargs	0.11.0	-	Clear	-	0	-
No advisories for the latest published version.
#421	@types/babel__generator	7.27.0	-	Clear	-	0	-
No advisories for the latest published version.
#422	kleur	4.1.5	-	Clear	-	0	-
No advisories for the latest published version.
#423	zod	4.4.3	-	Clear	Sep 28, 2023	1	1 moderate
AI-generated context Zod has one advisory in its history, GHSA-m95q-7qp3-xv42, a moderate-severity denial of service vulnerability published in September 2023. This was a conventional vulnerability with no malware involvement, and it has since been resolved. Developers depending on the current release can do so with confidence, as the package is now clear. Advisory history (1) GHSA-m95q-7qp3-xv42 moderate Sep 28, 2023 Zod denial of service vulnerability
#424	merge-stream	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#425	available-typed-arrays	1.0.7	-	Clear	-	0	-
No advisories for the latest published version.
#426	mute-stream	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#427	is-typed-array	1.1.15	-	Clear	-	0	-
No advisories for the latest published version.
#428	safe-regex-test	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#429	tsconfig-paths	4.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#430	minizlib	3.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#431	tar-stream	3.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#432	@floating-ui/core	1.8.0	-	Clear	-	0	-
No advisories for the latest published version.
#433	jose	6.2.4	-	Clear	Mar 07, 2024	3	3 moderate
AI-generated context The `jose` package has a history of three moderate-severity conventional vulnerabilities, none involving malware: a padding oracle attack via observable timing discrepancy (GHSA-58f5-hfqc-jgch), and two separate resource exhaustion issues triggered by specially crafted JWE inputs (GHSA-jv3g-j58f-9mq9 and GHSA-hhhv-q57g-882q). These vulnerabilities affected earlier releases and have since been addressed, as the current latest version is clear. Advisory history (3) GHSA-hhhv-q57g-882q moderate Mar 07, 2024 jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext GHSA-jv3g-j58f-9mq9 moderate Sep 16, 2022 JOSE vulnerable to resource exhaustion via specifically crafted JWE GHSA-58f5-hfqc-jgch moderate Apr 19, 2021 Padding Oracle Attack due to Observable Timing Discrepancy in jose
#434	deepmerge	4.3.1	-	Clear	-	0	-
No advisories for the latest published version.
#435	get-tsconfig	4.14.0	-	Clear	-	0	-
No advisories for the latest published version.
#436	set-function-length	1.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#437	@vitest/spy	4.1.10	-	Clear	-	0	-
No advisories for the latest published version.
#438	css-select	7.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#439	@types/babel__core	7.20.5	-	Clear	-	0	-
No advisories for the latest published version.
#440	forwarded	0.2.0	-	Clear	Jul 24, 2018	1	1 high
AI-generated context The `forwarded` package has one historical advisory in its record, GHSA-mpcf-4gmh-23w8, a high-severity Regular Expression Denial of Service vulnerability published in 2018. This was a conventional vulnerability rather than malware, where a crafted input could cause excessive backtracking in a regular expression. The package is currently clear at its latest release, meaning this issue has since been addressed. Advisory history (1) GHSA-mpcf-4gmh-23w8 high Jul 24, 2018 Regular Expression Denial of Service in forwarded
#441	react	19.2.8	-	Clear	Sep 04, 2020	2	1 high 1 moderate
AI-generated context React has two historical cross-site scripting advisories in its past (GHSA-g53w-52xc-2j85 and GHSA-hg79-j56m-fxgv), both published in September 2020 and rated moderate and high severity respectively. These were conventional vulnerabilities, not malware, and have since been addressed. The package's current release is clear, so developers depending on an up-to-date version of react are not exposed to these issues. Advisory history (2) GHSA-g53w-52xc-2j85 moderate Sep 04, 2020 Cross-Site Scripting in react GHSA-hg79-j56m-fxgv high Sep 04, 2020 Cross-Site Scripting in react
#442	@typescript-eslint/parser	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#443	ajv-keywords	5.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#444	define-properties	1.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#445	is-generator-function	1.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#446	regexp.prototype.flags	1.5.4	-	Clear	-	0	-
No advisories for the latest published version.
#447	acorn-walk	8.3.5	-	Clear	-	0	-
No advisories for the latest published version.
#448	pump	3.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#449	data-uri-to-buffer	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#450	object-hash	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#451	jsdom	30.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#452	nopt	10.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#453	@babel/plugin-syntax-jsx	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#454	@floating-ui/dom	1.8.0	-	Clear	-	0	-
No advisories for the latest published version.
#455	tiny-invariant	1.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#456	strip-indent	4.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#457	d3-array	3.2.4	-	Clear	-	0	-
No advisories for the latest published version.
#458	chai	6.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#459	@babel/code-frame	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#460	@typescript-eslint/eslint-plugin	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#461	proxy-addr	2.0.7	-	Clear	-	0	-
No advisories for the latest published version.
#462	parseurl	1.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#463	@floating-ui/utils	0.2.12	-	Clear	-	0	-
No advisories for the latest published version.
#464	ora	9.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#465	html-encoding-sniffer	6.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#466	pnpm	11.17.0	-	Clear	Jun 27, 2026	28	14 high 14 moderate
AI-generated context pnpm has an extensive history of conventional security vulnerabilities — no malware — spanning issues such as path traversal in tarball and ZIP extraction, command injection via environment variable substitution, lockfile integrity bypasses, symlink traversal, and credential leakage to repository-controlled registries. Many of these were disclosed in coordinated batches, with a particularly large set published in June 2026 alongside earlier advisories going back to 2022. The current release (11.15.0) is clear, meaning developers who keep pnpm up to date can rely on these issues having been addressed in prior versions. Advisory history (28) GHSA-qrv3-253h-g69c high Jun 27, 2026 pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config GHSA-72r4-9c5j-mj57 high Jun 27, 2026 pnpm: `patch-remove` could delete project-selected files outside the patches directory GHSA-fr4h-3cph-29xv high Jun 27, 2026 pnpm: Hoisted install imports lockfile alias outside node_modules GHSA-v23m-ccfg-pq9h high Jun 26, 2026 pnpm: `stage download` writes outside its destination directory via manifest name/version traversal GHSA-4gxm-v5v7-fqc4 moderate Jun 26, 2026 pnpm: Reserved bin name deletes PNPM_HOME during global remove GHSA-w466-c33r-3gjp high Jun 26, 2026 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes GHSA-gj8w-mvpf-x27x high Jun 26, 2026 pnpm: Repository-controlled configDependencies can select a pacquet native install engine GHSA-5wx6-mg75-v57r high Jun 26, 2026 pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle GHSA-3qhv-2rgh-x77r moderate Jun 26, 2026 pnpm: Repository config can expand victim environment secrets into registry requests before scripts run GHSA-rxhj-4m44-96r4 high Jun 26, 2026 pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) GHSA-cjhr-43r9-cfmw moderate Jun 26, 2026 pnpm binds unscoped user-level npm auth credentials to a repository-selected registry GHSA-hwx4-2j3j-g496 high Jun 26, 2026 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement GHSA-p4xf-rf54-rj3x moderate Jun 26, 2026 pnpm: Git Fetch Argument Injection via Lockfile resolution.commit GHSA-q6j5-fjx5-2mc3 moderate Jun 26, 2026 pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field GHSA-54hh-g5mx-jqcp moderate Jun 26, 2026 pnpm: Unsafe default behavior breaks integrity check GHSA-hg3w-7f8c-63hp moderate Jun 26, 2026 pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile GHSA-v253-rj99-jwpq moderate Jan 26, 2026 pnpm has Path Traversal via arbitrary file permission modification GHSA-6pfh-p556-v868 moderate Jan 26, 2026 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) GHSA-6x96-7vc8-cm3p moderate Jan 26, 2026 pnpm has Windows-specific tarball Path Traversal GHSA-xpqm-wm3m-f34h moderate Jan 26, 2026 pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin GHSA-m733-5w8f-5ggw moderate Jan 26, 2026 pnpm has symlink traversal in file:/git dependencies GHSA-379q-355j-w6rj high Jan 07, 2026 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" GHSA-7vhp-vf5g-r2fw high Jan 07, 2026 pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies GHSA-2phv-j68v-wwqx high Jan 07, 2026 pnpm vulnerable to Command Injection via environment variable substitution GHSA-8cc4-rfj6-fhg4 moderate Apr 23, 2025 pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting GHSA-vm32-9rqf-rh3r moderate Dec 10, 2024 pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion GHSA-5r98-f33j-g8h7 high Aug 01, 2023 pnpm incorrectly parses tar archives relative to specification GHSA-9m87-6fj3-c5xh high Mar 23, 2022 Untrusted Search Path in PNPM
#467	whatwg-encoding	3.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#468	events	3.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#469	@typescript-eslint/type-utils	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#470	env-paths	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#471	internal-slot	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#472	string.prototype.trimend	1.0.10	-	Clear	-	0	-
No advisories for the latest published version.
#473	extend	3.0.2	-	Clear	Feb 07, 2019	1	1 moderate
AI-generated context The `extend` package has one advisory in its history, GHSA-qrmc-fj45-qfc2, a moderate-severity prototype pollution vulnerability, which is a conventional security flaw rather than malware. This issue has since been addressed, and the package's current release (3.0.2) is clear. Developers depending on `extend` today should simply ensure they are on an up-to-date version. Advisory history (1) GHSA-qrmc-fj45-qfc2 moderate Feb 07, 2019 Prototype Pollution in extend
#474	resolve-pkg-maps	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#475	istanbul-lib-coverage	3.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#476	react-dom	19.2.8	16.2.0	Clear	Jan 04, 2019	1	1 moderate
AI-generated context React-dom has one historical advisory in its record, GHSA-mvjj-gqq2-p4hw, a moderate-severity cross-site scripting vulnerability published in early 2019. This was a conventional security flaw, not malware, and has since been addressed. The package's current release is clear, making this a resolved piece of history rather than an ongoing concern for developers depending on it today. Advisory history (1) GHSA-mvjj-gqq2-p4hw moderate peak affected Jan 04, 2019 Cross-Site Scripting in react-dom
#477	is-number-object	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#478	@radix-ui/primitive	1.1.7	-	Clear	-	0	-
No advisories for the latest published version.
#479	is-plain-object	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#480	string.prototype.trimstart	1.0.8	-	Clear	-	0	-
No advisories for the latest published version.
#481	@babel/plugin-syntax-typescript	8.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#482	jest-diff	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#483	define-lazy-prop	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#484	globalthis	1.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#485	which-boxed-primitive	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#486	@vitest/expect	4.1.10	-	Clear	-	0	-
No advisories for the latest published version.
#487	sax	1.6.1	-	Clear	-	0	-
No advisories for the latest published version.
#488	@floating-ui/react-dom	2.1.9	-	Clear	-	0	-
No advisories for the latest published version.
#489	@vitest/pretty-format	4.1.10	-	Clear	-	0	-
No advisories for the latest published version.
#490	internmap	2.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#491	@radix-ui/react-compose-refs	1.1.5	-	Clear	-	0	-
No advisories for the latest published version.
#492	is-symbol	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#493	@eslint-community/eslint-utils	4.10.1	-	Clear	-	0	-
No advisories for the latest published version.
#494	bl	7.0.10	3.0.0	Clear	Sep 02, 2020	2	2 moderate
AI-generated context The `bl` package has two historical moderate-severity advisories in its past — GHSA-wrw9-m778-g6mc and GHSA-pp7h-53gx-mx7r — both involving memory exposure vulnerabilities where improper handling of buffer data could leak sensitive information to remote parties. These were conventional security flaws, not malware, and both have since been addressed. The current release is clear, making `bl` safe to use for developers today. Advisory history (2) GHSA-pp7h-53gx-mx7r moderate peak affected Sep 02, 2020 Remote Memory Exposure in bl GHSA-wrw9-m778-g6mc moderate Jun 03, 2019 Memory Exposure in bl
#495	serve-static	2.2.1	-	Clear	Sep 10, 2024	2	2 low
AI-generated context The `serve-static` package has two historical low-severity vulnerability advisories in its past: an open redirect issue (GHSA-c3x7-gjmx-r2ff) and a template injection flaw that could lead to cross-site scripting (GHSA-cm22-4g7w-348p). Both were conventional vulnerabilities rather than malware, reflecting the kinds of edge-case security issues common in widely used static file serving middleware. The current release at version 2.2.1 is clear, so developers depending on the latest version are not affected by either of these historical issues. Advisory history (2) GHSA-cm22-4g7w-348p low Sep 10, 2024 serve-static vulnerable to template injection that can lead to XSS GHSA-c3x7-gjmx-r2ff low Aug 31, 2020 Open Redirect in serve-static
#496	get-symbol-description	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#497	is-shared-array-buffer	1.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#498	functions-have-names	1.2.3	-	Clear	-	0	-
No advisories for the latest published version.
#499	array-buffer-byte-length	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#500	socks-proxy-agent	10.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#501	extend-shallow	3.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#502	@radix-ui/react-use-layout-effect	1.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#503	function.prototype.name	1.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#504	is-bigint	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#505	is-string	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#506	protobufjs	8.7.1	-	Clear	Jul 20, 2026	17	2 critical 6 high 9 moderate
Advisory history (17) GHSA-jfj6-75fj-8934 moderate Jul 20, 2026 protobufjs: Text Format string map parsing can mutate returned map object prototype GHSA-j3f2-48v5-ccww moderate Jul 20, 2026 protobufjs: Denial of Service via infinite loop in .proto option parsing GHSA-94rc-8x27-4472 moderate Jun 15, 2026 protobufjs: Memory amplification from preserved unknown fields in binary decode GHSA-wcpc-wj8m-hjx6 high Jun 15, 2026 protobufjs: Denial of service through unbounded Any expansion during JSON conversion GHSA-f38q-mgvj-vph7 moderate Jun 15, 2026 protobufjs : Schema-derived names can shadow runtime-significant properties GHSA-jggg-4jg4-v7c6 moderate May 19, 2026 protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion GHSA-2pr8-phx7-x9h3 moderate May 12, 2026 protobuf.js: Denial of service from crafted field names in generated code GHSA-66ff-xgx4-vchm high May 12, 2026 protobuf.js: Code injection through bytes field defaults in generated toObject code GHSA-fx83-v9x8-x52w moderate May 12, 2026 protobuf.js: Prototype injection in generated message constructors GHSA-75px-5xx7-5xc7 high May 12, 2026 protobuf.js: Code generation gadget after prototype pollution GHSA-jvwf-75h9-cwgg high May 12, 2026 protobuf.js: Process-wide denial of service through unsafe option paths GHSA-685m-2w69-288q high May 12, 2026 protobuf.js: Denial of service through unbounded protobuf recursion GHSA-q6x5-8v7m-xcrf moderate May 12, 2026 protobufjs has overlong UTF-8 decoding GHSA-xq3m-2v4x-88gg critical Apr 16, 2026 Arbitrary code execution in protobufjs GHSA-h755-8qp9-cq85 critical Jul 05, 2023 protobufjs Prototype Pollution vulnerability GHSA-g954-5hwp-pp24 high May 28, 2022 Prototype Pollution in protobufjs GHSA-762f-c2wg-m8c8 moderate Oct 09, 2018 Denial of Service in protobufjs
#507	tmp	0.2.7	-	Clear	Jun 15, 2026	3	2 high 1 low
AI-generated context The `tmp` package has a history of conventional security vulnerabilities — no malware — covering symlink-based arbitrary file writes (GHSA-52f5-9888-hmc6) and two high-severity path traversal issues involving unsanitized prefix/postfix parameters and type-confusion bypasses (GHSA-ph9p-34f9-6g65, GHSA-7c78-jf6q-g5cm). These were vulnerabilities in how temporary file and directory paths were constructed and validated. The current release at version 0.2.7 is clear, meaning these issues have been addressed in the latest version. Advisory history (3) GHSA-7c78-jf6q-g5cm high Jun 15, 2026 tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template GHSA-ph9p-34f9-6g65 high May 27, 2026 tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape GHSA-52f5-9888-hmc6 low Aug 06, 2025 tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter
#508	is-date-object	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#509	lightningcss-linux-x64-musl	1.33.0	-	Clear	-	0	-
No advisories for the latest published version.
#510	proc-log	7.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#511	long	5.3.2	-	Clear	-	0	-
No advisories for the latest published version.
#512	@opentelemetry/sdk-trace-base	2.10.0	-	Clear	-	0	-
No advisories for the latest published version.
#513	nth-check	3.0.1	-	Clear	Sep 20, 2021	1	1 high
AI-generated context nth-check has one historical advisory in its record, GHSA-rp65-9cf3-cjxr, a high-severity vulnerability involving inefficient regular expression complexity (ReDoS) that was disclosed in 2021. This was a conventional vulnerability, not malware, affecting how the package processed certain CSS nth-check expressions. The current release, version 3.0.1, is clear of this issue, so developers on the latest version are not affected. Advisory history (1) GHSA-rp65-9cf3-cjxr high Sep 20, 2021 Inefficient Regular Expression Complexity in nth-check
#514	d3-path	3.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#515	@types/babel__template	7.4.4	-	Clear	-	0	-
No advisories for the latest published version.
#516	jest-regex-util	30.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#517	@radix-ui/react-use-controllable-state	1.2.6	-	Clear	-	0	-
No advisories for the latest published version.
#518	jest-mock	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#519	socks	2.8.9	-	Clear	-	0	-
No advisories for the latest published version.
#520	lightningcss	1.33.0	-	Clear	-	0	-
No advisories for the latest published version.
#521	assertion-error	2.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#522	es-to-primitive	1.3.4	-	Clear	-	0	-
No advisories for the latest published version.
#523	tinyrainbow	3.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#524	possible-typed-array-names	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#525	figures	6.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#526	xml-name-validator	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#527	any-promise	1.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#528	d3-shape	3.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#529	terser	5.49.0	-	Clear	Jul 16, 2022	1	1 high
AI-generated context Terser has one historical advisory in its record (GHSA-4wf5-vphf-c2xc), a high-severity conventional vulnerability involving insecure regular expression usage that could lead to a ReDoS (Regular Expression Denial of Service) attack. This was not a malware issue and has since been addressed, with the package's current release at version 5.49.0 carrying a clear status. Advisory history (1) GHSA-4wf5-vphf-c2xc high Jul 16, 2022 Terser insecure use of regular expressions leads to ReDoS
#530	std-env	4.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#531	is-array-buffer	3.0.5	-	Clear	-	0	-
No advisories for the latest published version.
#532	safe-array-concat	1.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#533	@aws-sdk/token-providers	3.1097.0	-	Clear	-	0	-
No advisories for the latest published version.
#534	data-urls	7.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#535	d3-interpolate	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#536	@radix-ui/react-dismissable-layer	1.1.19	-	Clear	-	0	-
No advisories for the latest published version.
#537	set-function-name	2.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#538	css-what	8.0.0	-	Clear	Oct 01, 2022	2	2 high
AI-generated context The css-what package has two historical high-severity advisories (GHSA-p28h-cc7q-c4fg and GHSA-q8pj-2vqx-8ggc), both involving denial-of-service vulnerabilities caused by insecure regular expressions susceptible to ReDoS attacks. These were conventional vulnerabilities with no malware involvement. The package's latest release is clear, so developers on version 8.0.0 are not affected by these past issues. Advisory history (2) GHSA-p28h-cc7q-c4fg high Oct 01, 2022 css-what vulnerable to ReDoS due to use of insecure regular expression GHSA-q8pj-2vqx-8ggc high Jun 07, 2021 Denial of service in css-what
#539	typed-array-length	1.0.8	-	Clear	-	0	-
No advisories for the latest published version.
#540	typed-array-byte-offset	1.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#541	thenify	3.3.1	-	Clear	Jul 18, 2022	1	1 critical
AI-generated context The thenify package has one historical advisory (GHSA-29xr-v42j-r956) in its record, a critical-severity issue involving unsafe calls to `eval` that affected versions before 3.3.1. This was a conventional vulnerability rather than malware, and it was resolved in version 3.3.1, which is the current release and carries a clear status. Advisory history (1) GHSA-29xr-v42j-r956 critical Jul 18, 2022 thenify before 3.3.1 made use of unsafe calls to `eval`.
#542	mz	2.7.0	-	Clear	-	0	-
No advisories for the latest published version.
#543	react-remove-scroll	2.7.2	-	Clear	-	0	-
No advisories for the latest published version.
#544	@radix-ui/react-id	1.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#545	is-weakset	2.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#546	is-boolean-object	1.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#547	@alloc/quick-lru	5.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#548	html-escaper	3.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#549	has-bigints	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#550	@aws-sdk/credential-provider-node	3.972.74	-	Clear	-	0	-
No advisories for the latest published version.
#551	lightningcss-linux-x64-gnu	1.33.0	-	Clear	-	0	-
No advisories for the latest published version.
#552	@radix-ui/react-presence	1.1.10	-	Clear	-	0	-
No advisories for the latest published version.
#553	w3c-xmlserializer	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#554	istanbul-reports	3.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#555	@babel/helper-annotate-as-pure	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#556	typed-array-buffer	1.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#557	@nodelib/fs.walk	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#558	sharp	0.35.3	-	Clear	Jul 21, 2026	3	2 high 1 moderate
Advisory history (3) GHSA-f88m-g3jw-g9cj high Jul 21, 2026 sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 GHSA-54xq-cgqr-rpm3 high Nov 16, 2023 sharp vulnerability in libwebp dependency CVE-2023-4863 GHSA-gp95-ppv5-3jc5 moderate Jun 01, 2022 sharp vulnerable to Command Injection in post-installation over build environment
#559	arraybuffer.prototype.slice	1.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#560	d3-format	3.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#561	has-proto	1.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#562	d3-timer	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#563	lodash.isplainobject	4.0.6	-	Clear	-	0	-
No advisories for the latest published version.
#564	@aws-sdk/util-endpoints	3.996.36	-	Clear	-	0	-
No advisories for the latest published version.
#565	@radix-ui/react-use-callback-ref	1.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#566	d3-time-format	4.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#567	is-weakref	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#568	autoprefixer	10.5.4	-	Clear	-	0	-
No advisories for the latest published version.
#569	istanbul-lib-report	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#570	postcss-load-config	6.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#571	strnum	2.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#572	core-js	3.49.0	-	Clear	-	0	-
No advisories for the latest published version.
#573	@vitest/snapshot	4.1.10	-	Clear	-	0	-
No advisories for the latest published version.
#574	@aws-sdk/credential-provider-env	3.972.63	-	Clear	-	0	-
No advisories for the latest published version.
#575	define-property	2.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#576	@sinonjs/fake-timers	15.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#577	@aws-sdk/credential-provider-web-identity	3.972.69	-	Clear	-	0	-
No advisories for the latest published version.
#578	clone	2.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#579	normalize-package-data	9.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#580	d3-color	3.1.0	-	Clear	Sep 29, 2022	1	1 high
AI-generated context d3-color has one advisory in its history, GHSA-36jr-mh4h-2g58, a high-severity regular expression denial-of-service (ReDoS) vulnerability affecting earlier versions of the package. This was a conventional vulnerability rather than malware, and it has since been addressed. The current release, version 3.1.0, is clear, so developers depending on an up-to-date version of d3-color are not affected by this issue. Advisory history (1) GHSA-36jr-mh4h-2g58 high Sep 29, 2022 d3-color vulnerable to ReDoS
#581	d3-time	3.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#582	colorette	2.0.20	-	Clear	-	0	-
No advisories for the latest published version.
#583	is-negative-zero	2.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#584	unbox-primitive	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#585	data-view-byte-length	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#586	data-view-buffer	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#587	regenerator-runtime	0.14.1	-	Clear	-	0	-
No advisories for the latest published version.
#588	is-set	2.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#589	saxes	6.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#590	decimal.js	10.6.0	-	Clear	-	0	-
No advisories for the latest published version.
#591	@aws-sdk/core	3.977.2	-	Clear	-	0	-
No advisories for the latest published version.
#592	@radix-ui/react-portal	1.1.17	-	Clear	-	0	-
No advisories for the latest published version.
#593	d3-scale	4.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#594	dequal	2.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#595	which-collection	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#596	cli-width	4.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#597	@radix-ui/react-use-escape-keydown	1.1.5	-	Clear	-	0	-
No advisories for the latest published version.
#598	@swc/helpers	0.5.23	-	Clear	-	0	-
No advisories for the latest published version.
#599	data-view-byte-offset	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#600	@aws-sdk/util-user-agent-node	3.973.53	-	Clear	-	0	-
No advisories for the latest published version.
#601	is-map	2.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#602	is-path-inside	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#603	xtend	4.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#604	is-finalizationregistry	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#605	import-in-the-middle	3.3.2	-	Clear	Aug 08, 2023	1	1 high
AI-generated context The package has one historical advisory in its record, GHSA-5r27-rw8r-7967, a high-severity vulnerability involving unsanitized user-controlled input during module generation. This was a conventional security flaw rather than malware. The package's latest release is currently clear, so developers depending on an up-to-date version are not affected by this past issue. Advisory history (1) GHSA-5r27-rw8r-7967 high Aug 08, 2023 import-in-the-middle has unsanitized user controlled input in module generation
#606	xmlbuilder	15.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#607	@sinclair/typebox	0.34.52	-	Clear	-	0	-
No advisories for the latest published version.
#608	is-async-function	2.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#609	tsx	4.23.1	-	Clear	-	0	-
No advisories for the latest published version.
#610	d3-ease	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#611	jwa	2.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#612	@aws-sdk/middleware-user-agent	3.972.67	-	Clear	-	0	-
No advisories for the latest published version.
#613	@types/express-serve-static-core	5.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#614	thenify-all	1.6.0	-	Clear	-	0	-
No advisories for the latest published version.
#615	@jridgewell/remapping	2.3.5	-	Clear	-	0	-
No advisories for the latest published version.
#616	@vitest/runner	4.1.10	-	Clear	-	0	-
No advisories for the latest published version.
#617	decamelize	6.0.1	-	Clear	Jul 24, 2018	1	1 high
AI-generated context The decamelize package has one historical advisory, GHSA-q5c4-39f5-m68j, which flagged a high-severity Regular Expression Denial of Service vulnerability published in 2018. This was a conventional vulnerability, not malware, where a crafted input could cause excessive backtracking in a regular expression. The issue has since been resolved, and the current release (6.0.1) is clear. Advisory history (1) GHSA-q5c4-39f5-m68j high Jul 24, 2018 Regular Expression Denial of Service in decamelize
#618	clean-stack	6.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#619	abbrev	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#620	@aws-sdk/middleware-logger	3.972.37	-	Clear	-	0	-
No advisories for the latest published version.
#621	type-detect	4.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#622	@radix-ui/react-collection	1.1.15	-	Clear	-	0	-
No advisories for the latest published version.
#623	@radix-ui/react-focus-scope	1.1.16	-	Clear	-	0	-
No advisories for the latest published version.
#624	loader-utils	3.3.1	-	Clear	Oct 14, 2022	3	1 critical 2 high
AI-generated context The loader-utils package has a history of three conventional security vulnerabilities discovered in October 2022, including two high-severity ReDoS issues (GHSA-3rfm-jhwj-7488 and GHSA-hhq3-ff78-jv3g) and a critical prototype pollution vulnerability (GHSA-76p3-8jx3-jpfq). No malware was ever involved. These issues have since been addressed, and the current release at version 3.3.1 is clear. Advisory history (3) GHSA-3rfm-jhwj-7488 high Oct 14, 2022 loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable GHSA-76p3-8jx3-jpfq critical Oct 13, 2022 Prototype pollution in webpack loader-utils GHSA-hhq3-ff78-jv3g high Oct 12, 2022 loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
#625	mimic-response	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#626	string.prototype.trim	1.2.11	-	Clear	-	0	-
No advisories for the latest published version.
#627	fraction.js	5.3.4	-	Clear	-	0	-
No advisories for the latest published version.
#628	ast-types	0.14.2	-	Clear	-	0	-
No advisories for the latest published version.
#629	which-builtin-type	1.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#630	array-includes	3.1.9	-	Clear	-	0	-
No advisories for the latest published version.
#631	@bcoe/v8-coverage	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#632	expect	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#633	@types/d3-shape	3.1.8	-	Clear	-	0	-
No advisories for the latest published version.
#634	@smithy/protocol-http	5.5.15	-	Clear	-	0	-
No advisories for the latest published version.
#635	cli-spinners	3.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#636	@types/d3-time	3.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#637	@types/d3-color	3.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#638	@radix-ui/react-focus-guards	1.1.6	-	Clear	-	0	-
No advisories for the latest published version.
#639	sucrase	3.35.1	-	Clear	-	0	-
No advisories for the latest published version.
#640	typed-array-byte-length	1.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#641	@radix-ui/react-popper	1.3.7	-	Clear	-	0	-
No advisories for the latest published version.
#642	aria-hidden	1.2.6	-	Clear	-	0	-
No advisories for the latest published version.
#643	escodegen	2.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#644	@types/d3-array	3.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#645	bn.js	5.2.5	-	Clear	Feb 20, 2026	1	1 moderate
AI-generated context bn.js has one historical advisory in its record, GHSA-378v-28hj-76wf, which described a moderate-severity infinite loop vulnerability — a conventional bug rather than any malicious code. This issue has since been resolved, and the package's current release at version 5.2.5 is clear. Advisory history (1) GHSA-378v-28hj-76wf moderate Feb 20, 2026 bn.js affected by an infinite loop
#646	split2	4.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#647	http-cache-semantics	4.2.0	-	Clear	Jan 31, 2023	1	1 high
AI-generated context The package has one historical advisory (GHSA-rc47-6667-2j5j), a high-severity Regular Expression Denial of Service vulnerability, which was a conventional security flaw rather than malware. This issue has since been resolved, and the current release at version 4.2.0 is clear, making it safe to use as a dependency today. Advisory history (1) GHSA-rc47-6667-2j5j high Jan 31, 2023 http-cache-semantics vulnerable to Regular Expression Denial of Service
#648	utils-merge	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#649	buffer-crc32	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#650	boolbase	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#651	@smithy/fetch-http-handler	5.6.12	-	Clear	-	0	-
No advisories for the latest published version.
#652	@types/d3-path	3.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#653	@ungap/structured-clone	1.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#654	@radix-ui/react-direction	1.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#655	react-remove-scroll-bar	2.3.8	-	Clear	-	0	-
No advisories for the latest published version.
#656	@types/send	1.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#657	mdn-data	2.29.0	-	Clear	-	0	-
No advisories for the latest published version.
#658	cors	2.8.6	-	Clear	-	0	-
No advisories for the latest published version.
#659	@types/express	5.0.6	-	Clear	-	0	-
No advisories for the latest published version.
#660	is-weakmap	2.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#661	reflect.getprototypeof	1.0.10	-	Clear	-	0	-
No advisories for the latest published version.
#662	jest-haste-map	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#663	eslint-config-prettier	10.1.8	10.1.7	Clear	Jul 21, 2025 Malware incident · Jul 2025	2	1 high 1 malware
AI-generated context The package has two advisories in its history — GHSA-f29h-pxvx-f335 and MAL-2025-6022 — both related to a malicious code incident that affected eslint-config-prettier along with several other packages. These advisories flagged embedded malware in affected versions, making it a supply-chain compromise rather than a conventional vulnerability. The current latest release (10.1.8) is clear, so developers using that version are not exposed to those issues. Advisory history (2) MAL-2025-6022 malware peak affected Jul 21, 2025 Malicious code in eslint-config-prettier (npm) GHSA-f29h-pxvx-f335 high Jul 19, 2025 eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
#664	postcss-import	16.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#665	neo-async	2.6.2	-	Clear	-	0	-
No advisories for the latest published version.
#666	array-union	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#667	ssri	14.0.0	8.0.0	Clear	Mar 19, 2021	2	1 high 1 moderate
AI-generated context The `ssri` package has two historical advisories in its past, both involving Regular Expression Denial of Service (ReDoS) vulnerabilities (GHSA-325j-24f4-qv5x and GHSA-vx3p-948g-6vhq), with the latter rated high severity. These were conventional security flaws, not malware, and both have since been addressed. The current release at version 14.0.0 is clear, so developers can depend on it without concern from these past issues. Advisory history (2) GHSA-vx3p-948g-6vhq high peak affected Mar 19, 2021 Regular Expression Denial of Service (ReDoS) GHSA-325j-24f4-qv5x moderate Mar 07, 2018 Regular Expression Denial of Service in ssri
#668	@types/d3-interpolate	3.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#669	@aws-sdk/middleware-host-header	3.972.38	-	Clear	-	0	-
No advisories for the latest published version.
#670	@radix-ui/react-visually-hidden	1.2.11	-	Clear	-	0	-
No advisories for the latest published version.
#671	@babel/helper-replace-supers	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#672	@radix-ui/react-arrow	1.1.15	-	Clear	-	0	-
No advisories for the latest published version.
#673	stop-iteration-iterator	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#674	@aws-sdk/credential-provider-process	3.972.63	-	Clear	-	0	-
No advisories for the latest published version.
#675	istanbul-lib-source-maps	5.0.6	-	Clear	-	0	-
No advisories for the latest published version.
#676	dedent	1.7.2	-	Clear	-	0	-
No advisories for the latest published version.
#677	is-data-view	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#678	@smithy/signature-v4	5.6.11	-	Clear	-	0	-
No advisories for the latest published version.
#679	redent	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#680	@aws-sdk/credential-provider-http	3.972.65	-	Clear	-	0	-
No advisories for the latest published version.
#681	is-promise	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#682	object.values	1.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#683	@istanbuljs/schema	0.1.6	-	Clear	-	0	-
No advisories for the latest published version.
#684	@sindresorhus/is	8.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#685	own-keys	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#686	@jest/fake-timers	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#687	safe-push-apply	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#688	cssstyle	6.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#689	destroy	1.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#690	@jest/transform	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#691	react-transition-group	4.4.5	-	Clear	-	0	-
No advisories for the latest published version.
#692	@babel/helper-member-expression-to-functions	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#693	ts-interface-checker	1.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#694	dom-helpers	6.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#695	@opentelemetry/api	1.9.1	-	Clear	-	0	-
No advisories for the latest published version.
#696	@img/sharp-linux-x64	0.35.3	-	Clear	-	0	-
No advisories for the latest published version.
#697	isobject	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#698	array.prototype.flatmap	1.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#699	@types/ws	8.18.1	-	Clear	-	0	-
No advisories for the latest published version.
#700	es-shim-unscopables	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#701	vitest	4.1.10	0.0.125	Clear	Jun 01, 2026	2	2 critical
AI-generated context Vitest has two critical conventional vulnerability advisories in its history: GHSA-9crc-q9x8-hgqq, involving remote code execution when a malicious website is visited while the Vitest API server is listening, and GHSA-5xrq-8626-4rwp, allowing arbitrary file reading and execution when the Vitest UI server is active. Both issues stemmed from the exposure of internal server interfaces rather than malware. These vulnerabilities have since been addressed, and the current release is clear. Advisory history (2) GHSA-5xrq-8626-4rwp critical Jun 01, 2026 When Vitest UI server is listening, arbitrary file can be read and executed GHSA-9crc-q9x8-hgqq critical peak affected Feb 04, 2025 Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
#702	array.prototype.flat	1.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#703	@babel/plugin-syntax-import-attributes	7.29.7	-	Clear	-	0	-
No advisories for the latest published version.
#704	gcp-metadata	8.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#705	@emnapi/runtime	1.11.3	-	Clear	-	0	-
No advisories for the latest published version.
#706	@types/chai	5.2.3	-	Clear	-	0	-
No advisories for the latest published version.
#707	@types/prop-types	15.7.15	-	Clear	-	0	-
No advisories for the latest published version.
#708	@types/d3-ease	3.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#709	@babel/helper-create-class-features-plugin	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#710	@radix-ui/react-roving-focus	1.1.19	-	Clear	-	0	-
No advisories for the latest published version.
#711	@jest/environment	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#712	jest-matcher-utils	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#713	symbol-tree	3.2.4	-	Clear	-	0	-
No advisories for the latest published version.
#714	detect-node-es	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#715	test-exclude	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#716	dlv	1.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#717	@vitest/mocker	4.1.10	-	Clear	-	0	-
No advisories for the latest published version.
#718	@smithy/property-provider	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#719	xmlchars	2.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#720	webpack-sources	3.5.1	-	Clear	-	0	-
No advisories for the latest published version.
#721	@smithy/util-middleware	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#722	shell-quote	1.10.0	-	Clear	Jul 20, 2026	4	3 critical 1 high
Advisory history (4) GHSA-395f-4hp3-45gv high Jul 20, 2026 shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407) GHSA-w7jw-789q-3m8p critical Jun 09, 2026 shell-quote quote() does not escape newlines in object .op values GHSA-g4rg-993r-mgx7 critical May 24, 2022 Improper Neutralization of Special Elements used in a Command in Shell-quote GHSA-qg8p-v9q4-gh34 critical Feb 18, 2019 Potential Command Injection in shell-quote
#723	smart-buffer	4.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#724	set-proto	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#725	graphemer	1.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#726	@aws-sdk/region-config-resolver	3.972.41	-	Clear	-	0	-
No advisories for the latest published version.
#727	@aws-sdk/util-user-agent-browser	3.972.38	-	Clear	-	0	-
No advisories for the latest published version.
#728	gaxios	7.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#729	is-extendable	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#730	@radix-ui/react-dialog	1.1.23	-	Clear	-	0	-
No advisories for the latest published version.
#731	vite	8.1.5	4.5.0	Clear	Jun 15, 2026	22	7 high 13 moderate 2 low
AI-generated context Vite has an extensive history of conventional (non-malware) security vulnerabilities, the large majority of which involve bypasses of the `server.fs.deny` file-access restriction in its development server, achieved through techniques like double slashes, query string manipulation, case-insensitive filesystem tricks, path traversal, and Windows-specific alternate paths (e.g., GHSA-353f-5xf4-qw67, GHSA-fx2h-pf6j-xcff). Additional advisories cover XSS issues, arbitrary file read via WebSocket, and command injection through a bundled `launch-editor` dependency. All known vulnerabilities have been addressed in prior releases, and the current version 8.1.5 is clear. Advisory history (22) GHSA-v6wh-96g9-6wx3 moderate Jun 15, 2026 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows GHSA-fx2h-pf6j-xcff high Jun 15, 2026 vite: `server.fs.deny` bypass on Windows alternate paths GHSA-c27g-q93r-2cwf high Jun 03, 2026 launch-editor vulnerable to command injection via the crafted request on Windows GHSA-4w7w-66w2-5vf9 moderate Apr 06, 2026 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling GHSA-v2wj-q39q-566r high Apr 06, 2026 Vite: `server.fs.deny` bypassed with queries GHSA-p9ff-h696-f583 high Apr 06, 2026 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket GHSA-93m4-6634-74q7 moderate Oct 20, 2025 vite allows server.fs.deny bypass via backslash on Windows GHSA-g4jq-h2w9-997c low Sep 09, 2025 Vite middleware may serve files starting with the same name with the public directory GHSA-jqfw-vq24-v9c3 low Sep 09, 2025 Vite's `server.fs` settings were not applied to HTML files GHSA-859w-5945-r5v3 moderate Apr 30, 2025 Vite's server.fs.deny bypassed with /. for files under project root GHSA-356w-63v5-8wf4 moderate Apr 11, 2025 Vite has an `server.fs.deny` bypass with an invalid `request-target` GHSA-xcj6-pq6g-qj4x moderate Apr 04, 2025 Vite allows server.fs.deny to be bypassed with .svg or relative paths GHSA-4r4m-qw57-chr8 moderate Mar 31, 2025 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query GHSA-x574-m823-4x7w moderate Mar 25, 2025 Vite bypasses server.fs.deny when using ?raw?? GHSA-vg6x-rcgg-rjx6 moderate Jan 21, 2025 Websites were able to send any requests to the development server and read the response in vite GHSA-64vr-g452-qvp3 moderate Sep 17, 2024 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS GHSA-9cwx-2883-4wfx moderate Sep 17, 2024 Vite's `server.fs.deny` is bypassed when using `?import&raw` GHSA-8jhw-289h-jh2g moderate Apr 03, 2024 Vite's `server.fs.deny` did not deny requests for patterns with directories. GHSA-c24v-8rfc-w8vw high Jan 19, 2024 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem GHSA-92r3-m2mg-pj97 moderate peak affected Dec 05, 2023 Vite XSS vulnerability in `server.transformIndexHtml` via URL payload GHSA-353f-5xf4-qw67 high Jun 06, 2023 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) GHSA-mv48-hcvh-8jj8 high Aug 19, 2022 Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service
#732	get-nonce	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#733	is-potential-custom-element-name	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#734	@types/d3-timer	3.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#735	@smithy/querystring-builder	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#736	inflight	1.0.6	-	Clear	-	0	-
No advisories for the latest published version.
#737	@radix-ui/react-use-size	1.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#738	leven	4.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#739	@tailwindcss/oxide-linux-x64-musl	4.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#740	@aws-sdk/middleware-recursion-detection	3.972.39	-	Clear	-	0	-
No advisories for the latest published version.
#741	read-cache	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#742	@types/ms	2.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#743	@aws-sdk/xml-builder	3.972.37	-	Clear	-	0	-
No advisories for the latest published version.
#744	google-auth-library	10.9.1	-	Clear	-	0	-
No advisories for the latest published version.
#745	why-is-node-running	3.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#746	aggregate-error	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#747	setimmediate	1.0.5	-	Clear	-	0	-
No advisories for the latest published version.
#748	read-pkg	10.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#749	@smithy/smithy-client	4.14.15	-	Clear	-	0	-
No advisories for the latest published version.
#750	react-hook-form	7.83.0	7.73.0	Clear	Apr 18, 2026 Malware incident · Apr 2026	1	1 malware
AI-generated context React-hook-form was flagged in advisory MAL-2026-2853 for containing malicious code in a version published to npm. This was a malware incident rather than a conventional vulnerability, meaning a compromised or tampered version of the package had been distributed. The current release, 7.82.0, is clear, so developers using the latest version are not affected by that historical incident. Advisory history (1) MAL-2026-2853 malware peak affected Apr 18, 2026 Malicious code in react-hook-form (npm)
#751	methods	1.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#752	@sinonjs/commons	4.0.0-alpha.0	-	Clear	-	0	-
No advisories for the latest published version.
#753	object.entries	1.1.9	-	Clear	-	0	-
No advisories for the latest published version.
#754	babel-jest	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#755	@types/serve-static	2.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#756	is-interactive	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#757	event-target-shim	6.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#758	jest-get-type	29.6.3	-	Clear	-	0	-
No advisories for the latest published version.
#759	postcss-js	5.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#760	@rollup/pluginutils	5.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#761	tldts-core	7.4.9	-	Clear	-	0	-
No advisories for the latest published version.
#762	class-variance-authority	0.7.1	-	Clear	-	0	-
No advisories for the latest published version.
#763	@napi-rs/wasm-runtime	1.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#764	@openai/codex	0.146.0	0.23.0	Clear	Apr 14, 2026	2	1 critical 1 high
AI-generated context The @openai/codex package has two historical security advisories involving conventional vulnerabilities rather than malware: a high-severity sandbox bypass caused by a bug in path configuration logic (GHSA-w5fx-fh39-j5rw) and a critical-severity issue allowing code execution through malicious MCP configuration files (GHSA-xrxf-jgv3-qmrm). Both advisories reflect the security-sensitive nature of an AI coding CLI tool with sandbox and execution capabilities. The current release at version 0.144.6 is clear, indicating these issues have been addressed. Advisory history (2) GHSA-xrxf-jgv3-qmrm critical peak affected Apr 14, 2026 OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files GHSA-w5fx-fh39-j5rw high Sep 19, 2025 Codex has sandbox bypass due to bug in path configuration logic
#765	@jest/console	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#766	@radix-ui/react-use-previous	1.1.4	-	Clear	-	0	-
No advisories for the latest published version.
#767	pure-rand	8.4.2	-	Clear	-	0	-
No advisories for the latest published version.
#768	object.fromentries	2.0.8	-	Clear	-	0	-
No advisories for the latest published version.
#769	babel-plugin-istanbul	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#770	dir-glob	3.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#771	siginfo	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#772	jest-validate	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#773	@smithy/middleware-endpoint	4.6.15	-	Clear	-	0	-
No advisories for the latest published version.
#774	babel-plugin-polyfill-corejs3	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#775	@types/istanbul-lib-coverage	2.0.6	-	Clear	-	0	-
No advisories for the latest published version.
#776	babel-plugin-jest-hoist	30.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#777	async-function	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#778	array-flatten	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#779	didyoumean	1.2.2	-	Clear	-	0	-
No advisories for the latest published version.
#780	tinybench	6.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#781	get-east-asian-width	1.6.0	-	Clear	-	0	-
No advisories for the latest published version.
#782	@smithy/shared-ini-file-loader	4.6.15	-	Clear	-	0	-
No advisories for the latest published version.
#783	dayjs	1.11.21	-	Clear	-	0	-
No advisories for the latest published version.
#784	recharts	3.10.1	-	Clear	-	0	-
No advisories for the latest published version.
#785	@jest/test-result	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#786	@radix-ui/rect	1.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#787	@octokit/types	16.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#788	@babel/plugin-transform-react-jsx-source	7.29.7	-	Clear	-	0	-
No advisories for the latest published version.
#789	@tootallnate/once	3.0.1	-	Clear	Mar 03, 2026	1	1 low
AI-generated context @tootallnate/once has one advisory in its history, GHSA-vpq2-c234-7xj6, a low-severity vulnerability involving Incorrect Control Flow Scoping. This was a conventional code flaw, not malware. The package's latest release (3.0.1) is clear, so developers can use it without concern from that past issue. Advisory history (1) GHSA-vpq2-c234-7xj6 low Mar 03, 2026 @tootallnate/once vulnerable to Incorrect Control Flow Scoping
#790	@protobufjs/utf8	1.1.2	-	Clear	May 12, 2026	1	1 moderate
AI-generated context @protobufjs/utf8 has one moderate advisory in its history, GHSA-q6x5-8v7m-xcrf, which concerned overlong UTF-8 decoding — a conventional vulnerability rather than malware. This issue has since been addressed, and the package's current release at version 1.1.2 is clear. Advisory history (1) GHSA-q6x5-8v7m-xcrf moderate May 12, 2026 protobufjs has overlong UTF-8 decoding
#791	@protobufjs/codegen	2.0.5	-	Clear	-	0	-
No advisories for the latest published version.
#792	rollup	4.62.3	-	Clear	Feb 25, 2026	2	2 high
AI-generated context Rollup has accumulated two high-severity conventional vulnerability advisories in its history: GHSA-gcx4-mw62-g8wm involved a DOM Clobbering gadget in bundled scripts that could lead to cross-site scripting, and GHSA-mw96-cpmx-2vgc described an arbitrary file write vulnerability via path traversal in Rollup 4. Both issues have since been addressed, and the package's current release at version 4.62.2 is clear. Advisory history (2) GHSA-mw96-cpmx-2vgc high Feb 25, 2026 Rollup 4 has Arbitrary File Write via Path Traversal GHSA-gcx4-mw62-g8wm high Sep 23, 2024 DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
#793	@radix-ui/number	1.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#794	@smithy/core	3.31.0	-	Clear	-	0	-
No advisories for the latest published version.
#795	@types/qs	6.15.1	-	Clear	-	0	-
No advisories for the latest published version.
#796	jest-environment-node	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#797	@protobufjs/inquire	1.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#798	@babel/plugin-transform-modules-commonjs	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#799	ansi-colors	4.1.3	-	Clear	-	0	-
No advisories for the latest published version.
#800	jest-resolve	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#801	@smithy/util-base64	4.5.15	-	Clear	-	0	-
No advisories for the latest published version.
#802	cssom	0.5.0	-	Clear	-	0	-
No advisories for the latest published version.
#803	@smithy/credential-provider-imds	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#804	ecdsa-sig-formatter	1.0.11	-	Clear	-	0	-
No advisories for the latest published version.
#805	eslint-import-resolver-node	0.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#806	camelcase-css	2.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#807	immer	11.1.15	-	Clear	Sep 07, 2021	3	1 critical 2 high
AI-generated context The `immer` package has a history of conventional (non-malware) prototype pollution vulnerabilities, with three advisories published in 2021 — GHSA-9qmh-276g-x5pj (high), GHSA-33f9-j839-rf8h (critical), and GHSA-c36v-fmgq-m8hx (high) — all involving the same class of attack where an adversary could manipulate JavaScript object prototypes. These issues were addressed in past releases, and the package's current latest version is considered clear with no outstanding vulnerabilities. Advisory history (3) GHSA-c36v-fmgq-m8hx high Sep 07, 2021 Prototype Pollution in immer GHSA-33f9-j839-rf8h critical Sep 02, 2021 Prototype Pollution in immer GHSA-9qmh-276g-x5pj high Jan 20, 2021 Prototype Pollution in immer
#808	victory-vendor	37.3.6	-	Clear	-	0	-
No advisories for the latest published version.
#809	@smithy/middleware-serde	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#810	@tailwindcss/node	4.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#811	@types/yargs-parser	21.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#812	@radix-ui/react-label	2.1.15	-	Clear	-	0	-
No advisories for the latest published version.
#813	@babel/helper-optimise-call-expression	8.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#814	process	0.11.10	-	Clear	-	0	-
No advisories for the latest published version.
#815	@aws-sdk/nested-clients	3.997.37	-	Clear	-	0	-
No advisories for the latest published version.
#816	@smithy/url-parser	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#817	fast-equals	6.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#818	@noble/hashes	2.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#819	jest-snapshot	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#820	@tailwindcss/oxide	4.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#821	@smithy/middleware-stack	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#822	cli-truncate	6.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#823	eslint-plugin-import	2.32.0	-	Clear	-	0	-
No advisories for the latest published version.
#824	@testing-library/dom	10.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#825	webpack	5.109.2	-	Clear	Feb 05, 2026	4	1 critical 1 moderate 2 low
AI-generated context Webpack has a history of conventional security vulnerabilities — no malware — spanning a critical cross-realm object access issue (GHSA-hc6q-2mpp-qw7j), a moderate DOM Clobbering XSS gadget in AutoPublicPathRuntimeModule (GHSA-4vvj-4cpr-p986), and two low-severity build-time SSRF vulnerabilities in the `buildHttp` HttpUriPlugin related to URL allow-list bypasses (GHSA-38r7-794h-5758, GHSA-8fgc-7cc6-rx7x). These issues have all been addressed in prior releases, and the current version 5.108.4 is clear of known advisories. Advisory history (4) GHSA-8fgc-7cc6-rx7x low Feb 05, 2026 webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior GHSA-38r7-794h-5758 low Feb 05, 2026 webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence GHSA-4vvj-4cpr-p986 moderate Aug 27, 2024 Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS GHSA-hc6q-2mpp-qw7j critical Mar 13, 2023 Cross-realm object access in Webpack 5
#826	@csstools/css-tokenizer	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#827	@smithy/util-retry	4.5.15	-	Clear	-	0	-
No advisories for the latest published version.
#828	serialize-javascript	7.0.7	-	Clear	Mar 27, 2026	5	2 high 3 moderate
AI-generated context The serialize-javascript package has a history of conventional security vulnerabilities — no malware — spanning cross-site scripting issues (GHSA-h9rv-jmmf-4pgx, GHSA-76p7-773f-r4q5), remote code execution flaws tied to insecure serialization and RegExp/Date handling (GHSA-hxcc-f52p-wc94, GHSA-5c6j-r48x-rmvq), and a denial-of-service weakness via crafted array-like objects (GHSA-qj8w-gfj5-8c6v). These vulnerabilities reflect the inherent complexity of safely serializing JavaScript for untrusted contexts and have been addressed across successive releases. The current version 7.0.7 is clear, making it safe to use as long as dependencies are kept up to date. Advisory history (5) GHSA-qj8w-gfj5-8c6v moderate Mar 27, 2026 Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects GHSA-5c6j-r48x-rmvq high Feb 28, 2026 Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() GHSA-76p7-773f-r4q5 moderate Feb 10, 2025 Cross-site Scripting (XSS) in serialize-javascript GHSA-hxcc-f52p-wc94 high Aug 11, 2020 Insecure serialization leading to RCE in serialize-javascript GHSA-h9rv-jmmf-4pgx moderate Dec 05, 2019 Cross-Site Scripting in serialize-javascript
#829	@smithy/service-error-classification	4.5.15	-	Clear	-	0	-
No advisories for the latest published version.
#830	@types/react	19.2.17	-	Clear	-	0	-
No advisories for the latest published version.
#831	@radix-ui/react-dropdown-menu	2.1.24	-	Clear	-	0	-
No advisories for the latest published version.
#832	jest-docblock	30.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#833	sisteransi	2.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#834	@aws-sdk/credential-provider-ini	3.973.8	-	Clear	-	0	-
No advisories for the latest published version.
#835	postcss-nested	7.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#836	@smithy/querystring-parser	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#837	lie	3.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#838	@smithy/util-stream	4.7.15	-	Clear	-	0	-
No advisories for the latest published version.
#839	@colors/colors	1.6.0	-	Clear	-	0	-
No advisories for the latest published version.
#840	requires-port	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#841	string-length	7.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#842	web-streams-polyfill	4.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#843	@radix-ui/react-tooltip	1.2.16	-	Clear	-	0	-
No advisories for the latest published version.
#844	@smithy/node-config-provider	4.5.15	-	Clear	-	0	-
No advisories for the latest published version.
#845	@octokit/openapi-types	27.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#846	diff-sequences	29.6.3	-	Clear	-	0	-
No advisories for the latest published version.
#847	unist-util-visit	5.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#848	@smithy/util-uri-escape	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#849	@types/istanbul-reports	3.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#850	tar-fs	3.1.3	-	Clear	Sep 24, 2025	4	4 high
AI-generated context The tar-fs package has a recurring history of high-severity path traversal and link-following vulnerabilities, with advisories spanning from 2019 through 2025 (GHSA-x2mc-8fgj-3wmr, GHSA-pq67-2wwv-3xjx, GHSA-8cj5-5rvv-wf4v, and GHSA-vj76-c3g6-qr5v), all involving crafted tarballs that could extract files outside the intended destination directory. None of these were malware; they were conventional security flaws in how the library handled archive extraction. The current latest release, 3.1.3, is clear, but the pattern of recurring issues in this area is worth keeping in mind when planning upgrade and dependency monitoring strategies. Advisory history (4) GHSA-vj76-c3g6-qr5v high Sep 24, 2025 tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball GHSA-8cj5-5rvv-wf4v high Jun 03, 2025 tar-fs can extract outside the specified dir with a specific tarball GHSA-pq67-2wwv-3xjx high Mar 27, 2025 tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File GHSA-x2mc-8fgj-3wmr high May 01, 2019 Improper Input Validation in tar-fs
#851	expect-type	1.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#852	is-buffer	2.0.5	-	Clear	-	0	-
No advisories for the latest published version.
#853	@testing-library/jest-dom	7.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#854	@types/deep-eql	4.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#855	terser-webpack-plugin	5.6.1	-	Clear	-	0	-
No advisories for the latest published version.
#856	unist-util-visit-parents	6.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#857	@tanstack/query-core	5.101.4	-	Clear	-	0	-
No advisories for the latest published version.
#858	file-type	22.0.1	-	Clear	Mar 13, 2026	3	1 high 2 moderate
AI-generated context The `file-type` package has a history of conventional denial-of-service vulnerabilities, with no malware involvement. These included an infinite loop triggered by malformed MKV files (GHSA-mhxj-85r3-2x55), a similar infinite loop in the ASF parser via zero-size sub-headers (GHSA-5v7r-6r5c-r473), and a ZIP decompression bomb attack through malformed `[Content_Types].xml` entries (GHSA-j47w-4g3g-c36v). The current release at version 22.0.1 is clear, so developers processing untrusted files can use it with confidence that these issues have been addressed. Advisory history (3) GHSA-j47w-4g3g-c36v moderate Mar 13, 2026 file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry GHSA-5v7r-6r5c-r473 moderate Mar 10, 2026 file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header GHSA-mhxj-85r3-2x55 high Jul 22, 2022 file-type vulnerable to Infinite Loop via malformed MKV file
#859	watchpack	2.5.2	-	Clear	-	0	-
No advisories for the latest published version.
#860	@radix-ui/react-separator	1.1.15	-	Clear	-	0	-
No advisories for the latest published version.
#861	synckit	0.11.13	0.11.9	Clear	Jul 21, 2025 Malware incident · Jul 2025	2	1 high 1 malware
AI-generated context The package synckit was affected by two advisories in July 2025 (GHSA-f29h-pxvx-f335 and MAL-2025-6026) confirming the presence of malicious code embedded in a published version, alongside several other packages in the same supply chain incident. These were genuine malware findings, not conventional vulnerability disclosures. The latest release (0.11.13) is currently clear, meaning the malicious code has been addressed, but the incident serves as a reminder that this package was a target of a supply chain attack. Advisory history (2) MAL-2025-6026 malware peak affected Jul 21, 2025 Malicious code in synckit (npm) GHSA-f29h-pxvx-f335 high peak affected Jul 19, 2025 eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
#862	babel-preset-jest	30.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#863	@smithy/middleware-retry	4.7.15	-	Clear	-	0	-
No advisories for the latest published version.
#864	@smithy/util-hex-encoding	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#865	@radix-ui/react-menu	2.1.24	-	Clear	-	0	-
No advisories for the latest published version.
#866	eslint-plugin-react	7.37.5	-	Clear	-	0	-
No advisories for the latest published version.
#867	prompts	2.4.2	-	Clear	-	0	-
No advisories for the latest published version.
#868	@types/body-parser	1.19.6	-	Clear	-	0	-
No advisories for the latest published version.
#869	find-cache-dir	6.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#870	unist-util-is	6.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#871	make-fetch-happen	16.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#872	chardet	2.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#873	jest-watcher	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#874	core-js-compat	3.49.0	-	Clear	-	0	-
No advisories for the latest published version.
#875	jws	4.0.1	4.0.0	Clear	Dec 04, 2025	2	2 high
AI-generated context The `jws` package has two historical high-severity vulnerabilities in its past: GHSA-gjcw-v447-2w7q involved forgeable public/private tokens, and GHSA-869p-cjfg-cm3x concerned improper verification of HMAC signatures — both representing meaningful risks around JWT integrity if left unpatched. Neither advisory involves malware; they are conventional cryptographic implementation flaws. The current release (4.0.1) is clear, so developers on the latest version are not exposed to these issues. Advisory history (2) GHSA-869p-cjfg-cm3x high peak affected Dec 04, 2025 auth0/node-jws Improperly Verifies HMAC Signature GHSA-gjcw-v447-2w7q high Sep 01, 2020 Forgeable Public/Private Tokens in jws
#876	stack-utils	2.0.6	-	Clear	-	0	-
No advisories for the latest published version.
#877	is-obj	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#878	@types/range-parser	1.2.7	-	Clear	-	0	-
No advisories for the latest published version.
#879	@radix-ui/react-select	2.3.7	-	Clear	-	0	-
No advisories for the latest published version.
#880	jest-runtime	30.4.2	-	Clear	-	0	-
No advisories for the latest published version.
#881	@smithy/util-endpoints	3.6.15	-	Clear	-	0	-
No advisories for the latest published version.
#882	inquirer	14.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#883	rfdc	1.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#884	unist-util-stringify-position	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#885	import-local	3.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#886	@radix-ui/react-collapsible	1.1.20	-	Clear	-	0	-
No advisories for the latest published version.
#887	through2	5.0.7	-	Clear	-	0	-
No advisories for the latest published version.
#888	@smithy/util-defaults-mode-node	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#889	@radix-ui/react-popover	1.1.23	-	Clear	-	0	-
No advisories for the latest published version.
#890	regjsparser	0.13.2	-	Clear	-	0	-
No advisories for the latest published version.
#891	node-gyp	13.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#892	string.prototype.matchall	4.0.12	-	Clear	-	0	-
No advisories for the latest published version.
#893	unplugin	3.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#894	micromark-util-symbol	2.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#895	color	5.0.3	5.0.1	Clear	Sep 15, 2025 Malware incident · Sep 2025	2	1 high 1 malware
AI-generated context The `color` package was compromised in September 2025 when an npm account takeover led to the publication of malicious code in version 5.0.1, documented in both GHSA-qrmh-qg46-72pp and MAL-2025-46985. This was a supply chain attack involving malware injected into a specific release, rather than a conventional vulnerability in the package's own code. The package has since been remediated and the current release, version 5.0.3, is clear. Advisory history (2) GHSA-qrmh-qg46-72pp high peak affected Sep 15, 2025 color@5.0.1 contains malware after npm account takeover MAL-2025-46985 malware peak affected Sep 08, 2025 Malicious code in color (npm)
#896	decimal.js-light	2.5.1	-	Clear	-	0	-
No advisories for the latest published version.
#897	nwsapi	2.2.24	-	Clear	-	0	-
No advisories for the latest published version.
#898	abort-controller	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#899	spdx-expression-parse	5.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#900	@radix-ui/react-tabs	1.1.21	-	Clear	-	0	-
No advisories for the latest published version.
#901	@protobufjs/eventemitter	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#902	jest	30.4.2	-	Clear	-	0	-
No advisories for the latest published version.
#903	@tanstack/react-query	5.101.4	-	Clear	-	0	-
No advisories for the latest published version.
#904	jsonwebtoken	9.0.3	-	Clear	Dec 22, 2022	4	1 critical 1 high 2 moderate
AI-generated context The jsonwebtoken package has a history of conventional security vulnerabilities — no malware — centered on JWT verification and cryptographic weaknesses, including a critical verification bypass (GHSA-c7hr-j4mj-j2w6) and a cluster of high and moderate severity issues in 2022 involving insecure default algorithms, unrestricted key types, and token forgery risks (GHSA-8cf7-32gw-wr33, GHSA-hjrf-2m68-5959, GHSA-qwph-4952-7xr6). These past vulnerabilities reflect meaningful risks that existed in older releases around authentication logic. The current latest release is clear, so developers on version 9.0.3 are not exposed to these historical issues. Advisory history (4) GHSA-hjrf-2m68-5959 moderate Dec 22, 2022 jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC GHSA-qwph-4952-7xr6 moderate Dec 22, 2022 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() GHSA-8cf7-32gw-wr33 high Dec 22, 2022 jsonwebtoken unrestricted key type could lead to legacy keys usage GHSA-c7hr-j4mj-j2w6 critical Oct 09, 2018 Verification Bypass in jsonwebtoken
#905	@jest/reporters	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#906	@protobufjs/fetch	1.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#907	tailwindcss	4.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#908	unique-filename	6.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#909	make-error	1.3.6	-	Clear	-	0	-
No advisories for the latest published version.
#910	color-string	2.1.4	2.1.1	Clear	Sep 15, 2025 Malware incident · Sep 2025	3	1 high 1 moderate 1 malware
AI-generated context The `color-string` package has had two distinct types of security issues in its history: a moderate Regular Expression Denial of Service vulnerability (GHSA-257v-vj4p-3w2h) reported in 2021, and more seriously, a temporary malware compromise in 2025 (MAL-2025-46973, GHSA-286p-vc9p-p5qv) when an npm account takeover resulted in a malicious version 2.1.1 being published. The malware-affected release has since been addressed, and the current latest version 2.1.4 is clear, so developers should ensure they are not pinned to any intermediate 2.1.x releases from that period. Advisory history (3) GHSA-286p-vc9p-p5qv high peak affected Sep 15, 2025 color-string@2.1.1 contains malware after npm account takeover MAL-2025-46973 malware peak affected Sep 08, 2025 Malicious code in color-string (npm) GHSA-257v-vj4p-3w2h moderate Jun 22, 2021 Regular Expression Denial of Service (ReDOS)
#911	@hookform/resolvers	5.5.7	-	Clear	-	0	-
No advisories for the latest published version.
#912	glob-to-regexp	0.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#913	bluebird	3.7.2	-	Clear	-	0	-
No advisories for the latest published version.
#914	@adobe/css-tools	4.5.0	-	Clear	Nov 30, 2023	2	2 moderate
AI-generated context @adobe/css-tools has two historical advisories (GHSA-hpx4-r86g-5jrg and GHSA-prr3-c3m5-p7q2), both moderate severity, related to Regular Expression Denial of Service (ReDOS) and improper input validation when parsing CSS. These were conventional vulnerabilities with no malware involvement. The package is clear at its latest release, so developers depending on an up-to-date version are not affected by these past issues. Advisory history (2) GHSA-prr3-c3m5-p7q2 moderate Nov 30, 2023 @adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity GHSA-hpx4-r86g-5jrg moderate Aug 29, 2023 @adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS
#915	@tailwindcss/oxide-linux-x64-gnu	4.3.3	-	Clear	-	0	-
No advisories for the latest published version.
#916	ts-node	10.9.2	-	Clear	-	0	-
No advisories for the latest published version.
#917	@smithy/hash-node	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#918	is-descriptor	3.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#919	@inquirer/type	4.0.7	-	Clear	-	0	-
No advisories for the latest published version.
#920	psl	1.15.0	-	Clear	-	0	-
No advisories for the latest published version.
#921	typescript-eslint	8.65.0	-	Clear	-	0	-
No advisories for the latest published version.
#922	wordwrap	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#923	jest-cli	30.4.2	-	Clear	-	0	-
No advisories for the latest published version.
#924	@csstools/css-calc	3.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#925	resolve-cwd	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#926	@types/json5	2.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#927	@csstools/css-parser-algorithms	4.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#928	@jest/globals	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#929	@protobufjs/aspromise	1.1.2	-	Clear	-	0	-
No advisories for the latest published version.
#930	@img/sharp-linuxmusl-x64	0.35.3	-	Clear	-	0	-
No advisories for the latest published version.
#931	@radix-ui/react-progress	1.1.16	-	Clear	-	0	-
No advisories for the latest published version.
#932	@jest/expect-utils	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#933	fflate	0.8.3	-	Clear	-	0	-
No advisories for the latest published version.
#934	get-package-type	0.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#935	@types/hast	3.0.5	-	Clear	-	0	-
No advisories for the latest published version.
#936	jest-leak-detector	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#937	@types/istanbul-lib-report	3.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#938	@babel/plugin-transform-classes	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#939	@types/mdast	4.0.4	-	Clear	-	0	-
No advisories for the latest published version.
#940	pathval	2.0.1	-	Clear	Feb 10, 2022	1	1 high
AI-generated context The package has one historical advisory in its record, GHSA-g6ww-v8xp-vmwg, a high-severity prototype pollution vulnerability affecting an earlier version of pathval. This was a conventional security flaw rather than malware. The latest release (2.0.1) is clear, so developers depending on an up-to-date version of pathval are not affected by this past issue. Advisory history (1) GHSA-g6ww-v8xp-vmwg high Feb 10, 2022 Prototype pollution in pathval
#941	safe-stable-stringify	2.5.0	-	Clear	-	0	-
No advisories for the latest published version.
#942	node-int64	0.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#943	@radix-ui/react-toggle	1.1.18	-	Clear	-	0	-
No advisories for the latest published version.
#944	@babel/helper-define-polyfill-provider	1.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#945	loupe	3.2.1	-	Clear	-	0	-
No advisories for the latest published version.
#946	char-regex	2.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#947	@babel/plugin-transform-block-scoping	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#948	jest-runner	30.4.2	-	Clear	-	0	-
No advisories for the latest published version.
#949	eslint-module-utils	2.14.0	-	Clear	-	0	-
No advisories for the latest published version.
#950	decompress-response	10.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#951	uglify-js	3.19.3	-	Clear	Oct 24, 2017	2	1 critical 1 high
AI-generated context Uglify-js has two historical advisories, both conventional vulnerabilities rather than malware: a critical issue (GHSA-34r7-q49f-h37c) involving incorrect handling of non-boolean comparisons during minification that could produce subtly broken output, and a high-severity regular expression denial of service (GHSA-c9f4-xj24-8jqx). Both were published in 2017 and have since been resolved, and the package's current release at version 3.19.3 is clear. Advisory history (2) GHSA-34r7-q49f-h37c critical Oct 24, 2017 Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js GHSA-c9f4-xj24-8jqx high Oct 24, 2017 Regular Expression Denial of Service in uglify-js
#952	@smithy/util-defaults-mode-browser	4.5.15	-	Clear	-	0	-
No advisories for the latest published version.
#953	@radix-ui/react-avatar	1.2.6	-	Clear	-	0	-
No advisories for the latest published version.
#954	jest-circus	30.4.2	-	Clear	-	0	-
No advisories for the latest published version.
#955	micromark-util-character	2.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#956	google-logging-utils	1.2.0	-	Clear	-	0	-
No advisories for the latest published version.
#957	regexpu-core	6.4.0	-	Clear	-	0	-
No advisories for the latest published version.
#958	lz-string	1.5.0	-	Clear	-	0	-
No advisories for the latest published version.
#959	min-indent	1.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#960	@babel/plugin-syntax-numeric-separator	7.10.4	-	Clear	-	0	-
No advisories for the latest published version.
#961	@babel/plugin-syntax-optional-catch-binding	7.8.3	-	Clear	-	0	-
No advisories for the latest published version.
#962	fb-watchman	2.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#963	bser	2.1.1	-	Clear	-	0	-
No advisories for the latest published version.
#964	@babel/plugin-transform-spread	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#965	deep-eql	5.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#966	@babel/plugin-syntax-top-level-await	7.14.5	-	Clear	-	0	-
No advisories for the latest published version.
#967	@babel/plugin-syntax-nullish-coalescing-operator	7.8.3	-	Clear	-	0	-
No advisories for the latest published version.
#968	zod-to-json-schema	3.25.2	-	Clear	-	0	-
No advisories for the latest published version.
#969	progress	2.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#970	@smithy/util-body-length-browser	4.4.15	-	Clear	-	0	-
No advisories for the latest published version.
#971	@babel/plugin-transform-parameters	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#972	@jest/source-map	30.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#973	immediate	3.3.0	-	Clear	-	0	-
No advisories for the latest published version.
#974	@aws-sdk/client-sso	3.1097.0	-	Clear	-	0	-
No advisories for the latest published version.
#975	@babel/plugin-syntax-object-rest-spread	7.8.3	-	Clear	-	0	-
No advisories for the latest published version.
#976	normalize-url	9.0.1	-	Clear	Jun 08, 2021	1	1 high
AI-generated context The package has one historical advisory in its record, GHSA-px4h-xg32-q955, a high-severity regular expression denial of service (ReDoS) vulnerability published in 2021. This was a conventional vulnerability, not malware, and it has since been addressed. The current release is clear, so developers depending on the latest version of normalize-url are not affected by this issue. Advisory history (1) GHSA-px4h-xg32-q955 high Jun 08, 2021 ReDoS in normalize-url
#977	@smithy/config-resolver	4.6.15	-	Clear	Jan 08, 2026	1	1 low
AI-generated context The package has one low-severity advisory in its history, GHSA-6475-r3vj-m8vf, which concerned a defense-in-depth enhancement to how the AWS SDK for JavaScript v3 handled region parameter values rather than any exploitable vulnerability. This was a conventional hardening improvement with no indication of malware. The current release is clear, making this a minimal-concern history for developers depending on the package today. Advisory history (1) GHSA-6475-r3vj-m8vf low Jan 08, 2026 AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value
#978	@babel/plugin-syntax-logical-assignment-operators	7.10.4	-	Clear	-	0	-
No advisories for the latest published version.
#979	@protobufjs/pool	1.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#980	jest-changed-files	30.4.1	-	Clear	-	0	-
No advisories for the latest published version.
#981	@babel/plugin-syntax-json-strings	7.8.3	-	Clear	-	0	-
No advisories for the latest published version.
#982	@csstools/color-helpers	6.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#983	@types/lodash	4.17.24	-	Clear	-	0	-
No advisories for the latest published version.
#984	webpack-virtual-modules	0.6.2	-	Clear	-	0	-
No advisories for the latest published version.
#985	jest-resolve-dependencies	30.4.2	-	Clear	-	0	-
No advisories for the latest published version.
#986	through	2.3.8	-	Clear	-	0	-
No advisories for the latest published version.
#987	util	0.12.5	-	Clear	-	0	-
No advisories for the latest published version.
#988	micromark-util-types	2.0.2	-	Clear	-	0	-
No advisories for the latest published version.
#989	cacache	21.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#990	@types/stack-utils	2.0.3	-	Clear	-	0	-
No advisories for the latest published version.
#991	@emnapi/wasi-threads	2.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#992	axobject-query	4.1.0	-	Clear	-	0	-
No advisories for the latest published version.
#993	@pkgr/core	0.3.6	0.2.8	Clear	Jul 21, 2025 Malware incident · Jul 2025	2	1 high 1 malware
AI-generated context @pkgr/core has two advisories in its history — GHSA-f29h-pxvx-f335 and MAL-2025-6021 — both related to malicious code having been embedded in the package, affecting it alongside several other tools in the same ecosystem. These were confirmed malware incidents rather than conventional vulnerabilities. The latest release (0.3.6) is currently clear, indicating the malicious code has been addressed, but developers should ensure they are not running any previously compromised versions. Advisory history (2) MAL-2025-6021 malware peak affected Jul 21, 2025 Malicious code in @pkgr/core (npm) GHSA-f29h-pxvx-f335 high peak affected Jul 19, 2025 eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
#994	@radix-ui/react-scroll-area	1.2.18	-	Clear	-	0	-
No advisories for the latest published version.
#995	arrify	3.0.0	-	Clear	-	0	-
No advisories for the latest published version.
#996	@babel/plugin-transform-computed-properties	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#997	array.prototype.findlastindex	1.2.6	-	Clear	-	0	-
No advisories for the latest published version.
#998	@opentelemetry/sdk-metrics	2.10.0	-	Clear	-	0	-
No advisories for the latest published version.
#999	@babel/plugin-transform-for-of	8.0.1	-	Clear	-	0	-
No advisories for the latest published version.
#1000	@emnapi/core	1.11.3	-	Clear	-	0	-
No advisories for the latest published version.