Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2026-44486 axios: Axios: Information disclosure of proxy credentials via HTTP redirectsCVE-2026-44487 axios: Axios: Information disclosure of proxy credentials via redirect flowsCVE-2026-44488 axios: Axios: Denial of Service due to unenforced request and response size limitsCVE-2026-44492 axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalizationCVE-2026-44494 axios: Axios: Man-in-the-Middle (MITM) attack via Prototype PollutionCVE-2026-44496 axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie nameGHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningCVE-2026-44490 axios: Axios: Information disclosure and denial of service due to prototype pollutionGHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of serviceGHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype valuesGHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosGHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatokenGHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request constructionGHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of ServiceGHSA-xj6q-8x83-jv6g Axios: Prototype pollution auth subfields can inject Basic authCVE-2026-12143 form-data: form-data: Form field override via CRLF injectionCVE-2026-44573 next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18nCVE-2026-44574 Next.js: Next.js: Authorization bypass via crafted query parametersCVE-2026-44575 next.js: Next.js: Unauthorized access to protected content via middleware bypassCVE-2026-44578 Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requestsCVE-2026-44579 next.js: Next.js: Denial of Service via crafted POST requests to server actionsCVE-2026-45109 next.js: Next.js: Information disclosure via security fix bypass in middleware with TurbopackCVE-2026-64641 next: Next.js: Denial of Service via crafted requests to App Router with Server ActionsYour dependencies cross-checked against the OSV vulnerability database.
GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited inputGHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious inputGHSA-7g7r-gx96-252g electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`GHSA-35jp-ww65-95wh axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of serviceGHSA-777c-7fjr-54vf Allocation of Resources Without Limits or Throttling in AxiosGHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype valuesGHSA-898c-q2cr-xwhg axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsGHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosGHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningGHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatokenGHSA-hfxv-24rg-xrqf Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionGHSA-j5f8-grm9-p9fc Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionGHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request constructionGHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`GHSA-p92q-9vqr-4j8v Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdapterGHSA-pjwm-pj3p-43mv axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of ServiceGHSA-xj6q-8x83-jv6g Axios: Prototype pollution auth subfields can inject Basic authGHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsGHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashGHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationGHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsGHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.