CoderOfPHCity/StableGuard

scanned 2026-07-25 · git dae2cac

2 of 6 checks flagged a security issue

🟡 Worth a look

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies10Known OSS vulnerabilities20Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 10 found

Packages you depend on that have known security holes (CVEs).

Worth fixing CVE-2026-35515 @nestjs/core: Nest: Server-Sent Events (SSE) injection and spoofing via unsanitized newline characters

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-35515). Fix: Update that package to its patched version.
Worth fixing CVE-2026-31808 file-type: file-type: Denial of Service due to infinite loop in ASF file parsing

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-31808). Fix: Update that package to its patched version.
Worth fixing CVE-2026-32630 file-type: file-type: Denial of Service via excessive memory growth from crafted ZIP files

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-32630). Fix: Update that package to its patched version.
Worth fixing CVE-2026-2359 multer: Multer: Denial of Service via dropped file upload connections

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-2359). Fix: Update that package to its patched version.
Worth fixing CVE-2026-3304 multer: Multer: Denial of Service via malformed requests

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-3304). Fix: Update that package to its patched version.
Worth fixing CVE-2026-3520 multer: Multer: Denial of Service via malformed requests

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-3520). Fix: Update that package to its patched version.
Worth fixing CVE-2026-5079 Multer vulnerable to Denial of Service via deeply nested field names

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-5079). Fix: Update that package to its patched version.
Worth fixing CVE-2026-5038 Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-5038). Fix: Update that package to its patched version.
Worth fixing CVE-2026-8723 ### Summary `qs.stringify` throws `TypeError` when called with `arr ...

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-8723). Fix: Update that package to its patched version.
Minor CVE-2026-12590 body-parser: body-parser: Denial of Service via invalid limit option

api/package-lock.json

A package you depend on has a known security hole (CVE-2026-12590). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 20 found

Your dependencies cross-checked against the OSV vulnerability database.

Worth fixing GHSA-36xv-jgw5-4q75 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-35515). Fix: Update that package to its patched version.
Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
Worth fixing GHSA-5v7r-6r5c-r473 file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-31808). Fix: Update that package to its patched version.
Worth fixing GHSA-j47w-4g3g-c36v file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-32630). Fix: Update that package to its patched version.
Worth fixing GHSA-5j98-mcp5-4vw2 glob CLI: Command injection via -c/--cmd executes matches with shell:true

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2025-64756). Fix: Update that package to its patched version.
Worth fixing GHSA-3p4h-7m6x-2hcm Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-5038). Fix: Update that package to its patched version.
Worth fixing GHSA-5528-5vmv-3xc2 Multer Vulnerable to Denial of Service via Uncontrolled Recursion

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-3520). Fix: Update that package to its patched version.
Worth fixing GHSA-72gw-mp4g-v24j Multer vulnerable to Denial of Service via deeply nested field names

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-5079). Fix: Update that package to its patched version.
Worth fixing GHSA-v52c-386h-88mc Multer vulnerable to Denial of Service via resource exhaustion

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-2359). Fix: Update that package to its patched version.
Worth fixing GHSA-xf7r-hgr6-v32p Multer vulnerable to Denial of Service via incomplete cleanup

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-3304). Fix: Update that package to its patched version.
Worth fixing GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-33672). Fix: Update that package to its patched version.
Worth fixing GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-33671). Fix: Update that package to its patched version.
Worth fixing GHSA-q8mj-m7cp-5q26 qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-8723). Fix: Update that package to its patched version.
Worth fixing GHSA-ph9p-34f9-6g65 tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-44705). Fix: Update that package to its patched version.
Minor GHSA-v422-hmwv-36x6 body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2026-12590). Fix: Update that package to its patched version.
Minor GHSA-52f5-9888-hmc6 tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2025-54798). Fix: Update that package to its patched version.
Minor GHSA-38r7-794h-5758 webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2025-68157). Fix: Update that package to its patched version.
Minor GHSA-8fgc-7cc6-rx7x webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

/workdirs/scan-167b5e33-fe13-4736-8d52-2ecbe33f4fcc/api/package-lock.json

A package you depend on has a known security hole (CVE-2025-68458). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.