baronha/nport

scanned 2026-08-12 · git 2477f0c

3 of 6 checks flagged a security issue

🔴 Needs attention

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies21Known OSS vulnerabilities21Risky code patterns✓Malicious dependencies2Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 21 found · 4 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2021-44906 minimist: prototype pollution

package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious CVE-2022-2421 Insufficient validation when decoding a Socket.IO packet

package-lock.json

A package you depend on has a known security hole (CVE-2022-2421). Fix: Update that package to its patched version.
Serious CVE-2020-28502 nodejs-xmlhttprequest: Code injection through user input to xhr.send

package-lock.json

A package you depend on has a known security hole (CVE-2020-28502). Fix: Update that package to its patched version.
Serious CVE-2021-31597 xmlhttprequest-ssl: SSL certificate validation disabled by default

package-lock.json

A package you depend on has a known security hole (CVE-2021-31597). Fix: Update that package to its patched version.
Worth fixing CVE-2017-20165 A vulnerability classified as problematic has been found in debug-js d ...

package-lock.json

A package you depend on has a known security hole (CVE-2017-20165). Fix: Update that package to its patched version.
Worth fixing CVE-2020-36048 yarnpkg-socket.io/engine.io: allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport

package-lock.json

A package you depend on has a known security hole (CVE-2020-36048). Fix: Update that package to its patched version.
Worth fixing CVE-2022-41940 engine.io: Specially crafted HTTP request can trigger an uncaught exception

package-lock.json

A package you depend on has a known security hole (CVE-2022-41940). Fix: Update that package to its patched version.
Worth fixing CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload

package-lock.json

A package you depend on has a known security hole (CVE-2020-7598). Fix: Update that package to its patched version.
Worth fixing CVE-2017-20162 Vercel ms Inefficient Regular Expression Complexity vulnerability

package-lock.json

A package you depend on has a known security hole (CVE-2017-20162). Fix: Update that package to its patched version.
Worth fixing CVE-2024-36751 parse-uri Regular expression Denial of Service (ReDoS)

package-lock.json

A package you depend on has a known security hole (CVE-2024-36751). Fix: Update that package to its patched version.
Worth fixing CVE-2020-28481 CORS misconfiguration in socket.io

package-lock.json

A package you depend on has a known security hole (CVE-2020-28481). Fix: Update that package to its patched version.
Worth fixing CVE-2024-38355 socket.io: Unhandled 'error' event

package-lock.json

A package you depend on has a known security hole (CVE-2024-38355). Fix: Update that package to its patched version.
Worth fixing CVE-2020-36049 yarnpkg-socket.io-parser: a denial of service (memory consumption) via a large packet because a concatenation approach is used

package-lock.json

A package you depend on has a known security hole (CVE-2020-36049). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33151 socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packets

package-lock.json

A package you depend on has a known security hole (CVE-2026-33151). Fix: Update that package to its patched version.
Worth fixing CVE-2026-69185 socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets

package-lock.json

A package you depend on has a known security hole (CVE-2026-69185). Fix: Update that package to its patched version.
Worth fixing CVE-2023-32695 socket.io parser is a socket.io encoder and decoder written in JavaScr ...

package-lock.json

A package you depend on has a known security hole (CVE-2023-32695). Fix: Update that package to its patched version.
Worth fixing CVE-2026-41907 uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality

package-lock.json

A package you depend on has a known security hole (CVE-2026-41907). Fix: Update that package to its patched version.
Worth fixing CVE-2024-37890 nodejs-ws: denial of service when handling a request with many HTTP headers

package-lock.json

A package you depend on has a known security hole (CVE-2024-37890). Fix: Update that package to its patched version.
Worth fixing CVE-2026-48779 ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

package-lock.json

A package you depend on has a known security hole (CVE-2026-48779). Fix: Update that package to its patched version.
Minor CVE-2024-47764 cookie: cookie accepts cookie name, path, and domain with out of bounds characters

package-lock.json

A package you depend on has a known security hole (CVE-2024-47764). Fix: Update that package to its patched version.
Minor CVE-2017-16137 nodejs-debug: Regular expression Denial of Service

package-lock.json

A package you depend on has a known security hole (CVE-2017-16137). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 21 found · 4 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious GHSA-qm95-pgcg-qqfq Insufficient validation when decoding a Socket.IO packet

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2022-2421). Fix: Update that package to its patched version.
Serious GHSA-72mh-269x-7mh5 Improper Certificate Validation in xmlhttprequest-ssl

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2021-31597). Fix: Update that package to its patched version.
Serious GHSA-h4j5-c7cj-74xg xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2020-28502). Fix: Update that package to its patched version.
Worth fixing GHSA-9vvw-cc9w-f27h debug Inefficient Regular Expression Complexity vulnerability

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2017-20165). Fix: Update that package to its patched version.
Worth fixing GHSA-j4f2-536g-r55m Resource exhaustion in engine.io

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2020-36048). Fix: Update that package to its patched version.
Worth fixing GHSA-r7qp-cfhv-p84w Uncaught exception in engine.io

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2022-41940). Fix: Update that package to its patched version.
Worth fixing GHSA-vh95-rmgr-6w4m Prototype Pollution in minimist

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2020-7598). Fix: Update that package to its patched version.
Worth fixing GHSA-w9mr-4mfr-499f Vercel ms Inefficient Regular Expression Complexity vulnerability

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2017-20162). Fix: Update that package to its patched version.
Worth fixing GHSA-6fx8-h7jm-663j parse-uri Regular expression Denial of Service (ReDoS)

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2024-36751). Fix: Update that package to its patched version.
Worth fixing GHSA-25hc-qcg6-38wj socket.io has an unhandled 'error' event

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2024-38355). Fix: Update that package to its patched version.
Worth fixing GHSA-fxwf-4rqh-v8g3 CORS misconfiguration in socket.io

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2020-28481). Fix: Update that package to its patched version.
Worth fixing GHSA-2m8v-j782-fhvr Socket.IO: Zero-attachment Memory Exhaustion

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2026-69185). Fix: Update that package to its patched version.
Worth fixing GHSA-677m-j7p3-52f9 socket.io allows an unbounded number of binary attachments

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2026-33151). Fix: Update that package to its patched version.
Worth fixing GHSA-cqmj-92xf-r6r9 Insufficient validation when decoding a Socket.IO packet

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2023-32695). Fix: Update that package to its patched version.
Worth fixing GHSA-xfhh-g9f5-x4m4 Resource exhaustion in socket.io-parser

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2020-36049). Fix: Update that package to its patched version.
Worth fixing GHSA-w5hq-g745-h8pq uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2026-41907). Fix: Update that package to its patched version.
Worth fixing GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2024-37890). Fix: Update that package to its patched version.
Worth fixing GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2026-48779). Fix: Update that package to its patched version.
Minor GHSA-pxg6-pf52-xh8x cookie accepts cookie name, path, and domain with out of bounds characters

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2024-47764). Fix: Update that package to its patched version.
Minor GHSA-gxpj-cx7g-858c Regular Expression Denial of Service in debug

/workdirs/scan-7cf105b9-47f8-46c1-9bbb-fec468daa7b4/package-lock.json

A package you depend on has a known security hole (CVE-2017-16137). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ 2 found

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Worth fixing guarddog-npm-npm-install-script npm-install-script match in tldjs 2.3.2

tldjs

A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
Worth fixing guarddog-npm-shady-links shady-links match in tldjs 2.3.2

tldjs

A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.