Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.Packages you depend on that have known security holes (CVEs).
GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)CVE-2026-25896 fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handlingCVE-2025-7783 form-data: Unsafe random function in form-dataCVE-2026-33937 handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile()CVE-2025-9288 sha.js: Missing type checks leading to hash rewind and passing on crafted dataCVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminatorsGHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)CVE-2026-25896 fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handlingCVE-2025-7783 form-data: Unsafe random function in form-dataCVE-2026-33937 handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile()CVE-2025-29927 nextjs: Authorization Bypass in Next.js MiddlewareCVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fieldsCVE-2025-9288 sha.js: Missing type checks leading to hash rewind and passing on crafted dataCVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminatorsCVE-2026-47429 vitest: Vitest: Arbitrary code execution and information disclosure via path traversalCVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groupsCVE-2026-44728 Babel is a compiler for writing next generation JavaScript. From 7.12. ...CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groupsGHSA-8rgj-285w-qcq4 Unknown vulnerability in Coinbase Wallet SDKGHSA-qj3p-xc97-xw74 MetaMask SDK indirectly exposed via malicious [email protected] dependencyGHSA-qj3p-xc97-xw74 MetaMask SDK indirectly exposed via malicious [email protected] dependencyCVE-2025-27611 base-x: base-x homograph attack allows Unicode lookalike characters to bypass validation.CVE-2025-27611 base-x: base-x homograph attack allows Unicode lookalike characters to bypass validation.CVE-2026-2739 bn.js: bn.js: Denial of Service via calling maskn(0)CVE-2026-2739 bn.js: bn.js: Denial of Service via calling maskn(0)Your dependencies cross-checked against the OSV vulnerability database.
GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesGHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundaryGHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type ConfusionGHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted dataGHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op valuesGHSA-5rq4-664w-9x2c Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodGHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesGHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundaryGHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type ConfusionGHSA-f82v-jwr5-mffw Authorization Bypass in Next.js MiddlewareGHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjsGHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted dataGHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op valuesGHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executedRUSTSEC-2026-0007 Integer overflow in `BytesMut::reserve`GHSA-2pgj-5cv2-6xxw FuelVM is vulnerable to heap memory allocation re-use bugRUSTSEC-2024-0421 `idna` accepts Punycode labels that do not produce any non-ASCII when decodedRUSTSEC-2024-0421 `idna` accepts Punycode labels that do not produce any non-ASCII when decodedRUSTSEC-2025-0009 Some AES functions may panic when overflow checking is enabled.RUSTSEC-2026-0104 Reachable panic in certificate revocation list parsingGHSA-7gcf-g7xr-8hxj serde_with: KeyValueMap serialization panics on empty sequence or map entriesRUSTSEC-2026-0009 Denial of Service via Stack ExhaustionGHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groupsCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.