gitsafehub
github.com/0xsufi/kyushu ↗

0xsufi/kyushu

scanned 2026-08-11 · git 23fad6d
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets2Vulnerable dependencies✓Known OSS vulnerabilities17Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ 2 found · 2 serious

API keys, passwords or tokens committed into the repo.

  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    crates/runtime/src/builtin/web_crypto.rs:3438
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    crates/runtime/src/builtin/web_crypto.rs:3502
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 17 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing RUSTSEC-2023-0071 Marvin Attack: potential key recovery through timing sidechannels
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/Cargo.lock
    A package you depend on has a known security hole (CVE-2023-49092). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0188 WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-58494). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3qhv-2rgh-x77r pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-55180). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4gxm-v5v7-fqc4 pnpm: Reserved bin name deletes PNPM_HOME during global remove
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-55699). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5wx6-mg75-v57r pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-55487). Fix: Update that package to its patched version.
  • Worth fixing GHSA-72r4-9c5j-mj57 pnpm: `patch-remove` could delete project-selected files outside the patches directory
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-59194). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fr4h-3cph-29xv pnpm: Hoisted install imports lockfile alias outside node_modules
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-59196). Fix: Update that package to its patched version.
  • Worth fixing GHSA-gj8w-mvpf-x27x pnpm: Repository-controlled configDependencies can select a pacquet native install engine
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-55697). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qrv3-253h-g69c pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-59195). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v23m-ccfg-pq9h pnpm: `stage download` writes outside its destination directory via manifest name/version traversal
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-55700). Fix: Update that package to its patched version.
  • Worth fixing GHSA-w466-c33r-3gjp pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-55698). Fix: Update that package to its patched version.
  • Minor RUSTSEC-2026-0222 Stores can mix up type indices between engines
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Minor RUSTSEC-2026-0182 Leak in WASIp1 `fd_renumber` implementation
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-54786). Fix: Update that package to its patched version.
  • FYI RUSTSEC-2026-0190 Unsoundness in `Error::downcast_mut()`
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • FYI RUSTSEC-2026-0204 Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • FYI RUSTSEC-2026-0221 `event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • FYI RUSTSEC-2024-0384 `instant` is unmaintained
    /workdirs/scan-71973fc0-17f1-4b43-82e6-91d79799bf76/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.