Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...GHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningGHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of serviceGHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype valuesGHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosGHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatokenGHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request constructionGHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of ServiceGHSA-xj6q-8x83-jv6g Axios: Prototype pollution auth subfields can inject Basic authCVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexityCVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexityCVE-2026-65898 DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when ...CVE-2026-13676 fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalizationCVE-2026-16221 Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...CVE-2026-12143 form-data: form-data: Form field override via CRLF injectionCVE-2026-12143 form-data: form-data: Form field override via CRLF injectionCVE-2026-55602 http-proxy-middleware: http-proxy-middleware: Unintended backend routing due to crafted Host headerCVE-2026-59869 js-yaml: js-yaml: Denial of Service via crafted YAML documentsCVE-2026-53550 js-yaml: js-yaml: Denial of Service via crafted YAML merge keysCVE-2026-59869 js-yaml: js-yaml: Denial of Service via crafted YAML documentsCVE-2026-53550 js-yaml: js-yaml: Denial of Service via crafted YAML merge keysCVE-2026-53632 launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path accessCVE-2021-3803 nodejs-nth-check: inefficient regular expression complexityYour dependencies cross-checked against the OSV vulnerability database.
GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headersGHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsGHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashGHSA-664h-wqgq-64gw Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of serviceGHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype valuesGHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosGHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningGHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatokenGHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request constructionGHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of ServiceGHSA-xj6q-8x83-jv6g Axios: Prototype pollution auth subfields can inject Basic authGHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsGHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashGHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsGHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashGHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalizationGHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiterGHSA-hmw2-7cc7-3qxx form-data: CRLF injection in form-data via unescaped multipart field names and filenamesGHSA-hmw2-7cc7-3qxx form-data: CRLF injection in form-data via unescaped multipart field names and filenamesGHSA-64mm-vxmg-q3vj http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypassGHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumptionCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.