knisterpeter/vscode

scanned 2026-08-13 · git 7424b93

1 of 6 checks flagged a security issue

🔴 Needs attention

Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies✓Known OSS vulnerabilities55Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 400s

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 55 found · 8 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-86wf-436m-h424 Resource Exhaustion Denial of Service in http-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/javascript/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2019-10196). Fix: Update that package to its patched version.
Serious GHSA-8g7p-74h8-hg48 Denial of Service in https-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/javascript/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2018-3739). Fix: Update that package to its patched version.
Serious GHSA-86wf-436m-h424 Resource Exhaustion Denial of Service in http-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/json/server/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2019-10196). Fix: Update that package to its patched version.
Serious GHSA-8g7p-74h8-hg48 Denial of Service in https-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/json/server/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2018-3739). Fix: Update that package to its patched version.
Serious GHSA-8r6j-v8pm-fqw3 Code injection in fsevents

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2023-45311). Fix: Update that package to its patched version.
Serious GHSA-86wf-436m-h424 Resource Exhaustion Denial of Service in http-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2019-10196). Fix: Update that package to its patched version.
Serious GHSA-8g7p-74h8-hg48 Denial of Service in https-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2018-3739). Fix: Update that package to its patched version.
Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Worth fixing GHSA-5p2g-fcmc-qvqq image-size: JXL and HEIF parsers allow denial of service through infinite loops

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/emmet/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2025-71329). Fix: Update that package to its patched version.
Worth fixing GHSA-w3rx-r6r6-pgpr image-size: ICNS parser allows denial of service through an infinite loop

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/emmet/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2025-71330). Fix: Update that package to its patched version.
Worth fixing GHSA-22p9-wv53-3rq4 LinkifyIt#match scan loop has quadratic algorithmic complexity

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/extension-editing/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2026-48801). Fix: Update that package to its patched version.
Worth fixing GHSA-v245-v573-v5vm linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/extension-editing/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2026-59887). Fix: Update that package to its patched version.
Worth fixing GHSA-6v5v-wf23-fmfq markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/extension-editing/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2026-48988). Fix: Update that package to its patched version.
Worth fixing GHSA-6vfc-qv3f-vr6c Uncontrolled Resource Consumption in markdown-it

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/extension-editing/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2022-21670). Fix: Update that package to its patched version.
Worth fixing GHSA-9vvw-cc9w-f27h debug Inefficient Regular Expression Complexity vulnerability

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/javascript/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2017-20165). Fix: Update that package to its patched version.
Worth fixing GHSA-8w57-jfpm-945m Denial of Service in http-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/javascript/npm-shrinkwrap.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-pc5p-h8pf-mvwp Machine-In-The-Middle in https-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/javascript/npm-shrinkwrap.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-w9mr-4mfr-499f Vercel ms Inefficient Regular Expression Complexity vulnerability

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/javascript/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2017-20162). Fix: Update that package to its patched version.
Worth fixing GHSA-9vvw-cc9w-f27h debug Inefficient Regular Expression Complexity vulnerability

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/json/server/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2017-20165). Fix: Update that package to its patched version.
Worth fixing GHSA-8w57-jfpm-945m Denial of Service in http-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/json/server/npm-shrinkwrap.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-pc5p-h8pf-mvwp Machine-In-The-Middle in https-proxy-agent

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/json/server/npm-shrinkwrap.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-w9mr-4mfr-499f Vercel ms Inefficient Regular Expression Complexity vulnerability

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/json/server/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2017-20162). Fix: Update that package to its patched version.
Worth fixing GHSA-vfrc-7r7c-w9mx Prototype Pollution in highlight.js

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/markdown/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2020-26237). Fix: Update that package to its patched version.
Worth fixing GHSA-22p9-wv53-3rq4 LinkifyIt#match scan loop has quadratic algorithmic complexity

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/markdown/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2026-48801). Fix: Update that package to its patched version.
Worth fixing GHSA-v245-v573-v5vm linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

/workdirs/scan-bec33430-054d-4e74-9a58-d33511e21dc3/extensions/markdown/npm-shrinkwrap.json

A package you depend on has a known security hole (CVE-2026-59887). Fix: Update that package to its patched version.

… 30 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.