kossnocorp/firebase-tools

API keys, passwords or tokens committed into the repo.

• Serious gcp-api-key Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
  src/api.ts:59
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  scripts/emulator-tests/functionsEmulator.spec.ts:427
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  scripts/emulator-tests/functionsEmulator.spec.ts:433
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  scripts/emulator-tests/functionsEmulator.spec.ts:475
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  scripts/emulator-tests/functionsEmulator.spec.ts:481
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  scripts/emulator-tests/functionsEmulator.spec.ts:563
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  scripts/emulator-tests/functionsEmulator.spec.ts:565
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  src/test/emulators/auth/helpers.ts:29
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  src/test/emulators/auth/helpers.ts:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  src/test/emulators/auth/helpers.ts:50
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  src/test/emulators/auth/helpers.ts:52
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/api.ts:18
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/api.ts:58
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/api.ts:179
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/test/accountImporter.spec.ts:99
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2023-36665 protobufjs: prototype pollution using user-controlled protobuf message
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2023-36665). Fix: Update that package to its patched version.
• Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Serious CVE-2023-36665 protobufjs: prototype pollution using user-controlled protobuf message
  scripts/triggers-end-to-end-tests/triggers/package-lock.json
  A package you depend on has a known security hole (CVE-2023-36665). Fix: Update that package to its patched version.
• Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
  scripts/triggers-end-to-end-tests/triggers/package-lock.json
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  scripts/triggers-end-to-end-tests/triggers/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Serious CVE-2023-36665 protobufjs: prototype pollution using user-controlled protobuf message
  scripts/triggers-end-to-end-tests/v1/package-lock.json
  A package you depend on has a known security hole (CVE-2023-36665). Fix: Update that package to its patched version.
• Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
  scripts/triggers-end-to-end-tests/v1/package-lock.json
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  scripts/triggers-end-to-end-tests/v1/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Serious CVE-2023-36665 protobufjs: prototype pollution using user-controlled protobuf message
  scripts/triggers-end-to-end-tests/v2/package-lock.json
  A package you depend on has a known security hole (CVE-2023-36665). Fix: Update that package to its patched version.
• Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
  scripts/triggers-end-to-end-tests/v2/package-lock.json
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  scripts/triggers-end-to-end-tests/v2/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Serious CVE-2025-29927 nextjs: Authorization Bypass in Next.js Middleware
  scripts/webframeworks-deploy-tests/hosting/package-lock.json
  A package you depend on has a known security hole (CVE-2025-29927). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-6460 Logging of the firestore key within nodejs-firestore
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2023-6460). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48068 grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2026-48068). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48069 grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2026-48069). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-37168 grps-js: allocate memory for incoming messages well above configured limits
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2024-37168). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44288 protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parser
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2024-45590). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-29041 express: cause malformed URLs to be evaluated
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2024-29041). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-28176 jose: resource exhaustion
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2024-28176). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-23539 jsonwebtoken: Unrestricted key type could lead to legacy keys usagen
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2022-23539). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-23540 jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2022-23540). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-23541 jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2022-23541). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-65945 node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm
  scripts/emulator-tests/functions/package-lock.json
  A package you depend on has a known security hole (CVE-2025-65945). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-87r5-mp6g-5w5j jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-1615). Fix: Update that package to its patched version.
• Serious GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2025-29927). Fix: Update that package to its patched version.
• Serious GHSA-h755-8qp9-cq85 protobufjs Prototype Pollution vulnerability
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2023-36665). Fix: Update that package to its patched version.
• Serious GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-248r-7h7q-cr24 vm2 Has a Sandbox Breakout Using Async Generator
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-45411). Fix: Update that package to its patched version.
• Serious GHSA-47x8-96vw-5wg6 vm2 Access to Host Object Enables Sandbox Escape
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-43997). Fix: Update that package to its patched version.
• Serious GHSA-55hx-c926-fr95 VM2 Has a Sandbox Escape Issue via SuppressedError
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-26332). Fix: Update that package to its patched version.
• Serious GHSA-6j2x-vhqr-qr7q vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-47210). Fix: Update that package to its patched version.
• Serious GHSA-76w7-j9cq-rx2j vm2 is Vulnerable to Sandbox Breakout Through Promise Species
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-47208). Fix: Update that package to its patched version.
• Serious GHSA-7jxr-cg7f-gpgv vm2 vulnerable to sandbox escape
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2023-29017). Fix: Update that package to its patched version.
• Serious GHSA-8hg8-63c5-gwmx vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-44007). Fix: Update that package to its patched version.
• Serious GHSA-99p7-6v5w-7xg8 vm2 has a Sandbox Escape
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-22709). Fix: Update that package to its patched version.
• Serious GHSA-9qj6-qjgg-37qq vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-44008). Fix: Update that package to its patched version.
• Serious GHSA-9vg3-4rfj-wgcm vm2 has Sandbox Breakout Through Null Proto Exception
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-44009). Fix: Update that package to its patched version.
• Serious GHSA-cchq-frgv-rjh5 vm2 Sandbox Escape vulnerability
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2023-37466). Fix: Update that package to its patched version.
• Serious GHSA-ch3r-j5x3-6q2m vm2 Sandbox Escape vulnerability
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2023-30547). Fix: Update that package to its patched version.
• Serious GHSA-ffh4-j6h5-pg66 VM2 Has a WASM Sandbox Escape
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-26956). Fix: Update that package to its patched version.
• Serious GHSA-g644-9gfx-q4q4 vm2 Sandbox Escape vulnerability
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2023-37903). Fix: Update that package to its patched version.
• Serious GHSA-grj5-jjm8-h35p VM2 Sandbox Breakout Through __lookupGetter__
  /workdirs/scan-eb202036-f930-44d8-aae5-ee8993c6a34d/npm-shrinkwrap.json
  A package you depend on has a known security hole (CVE-2026-24118). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout