kricsleo/incompatible

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Worth fixing GHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the response
  package-lock.json
  A package you depend on has a known security hole (GHSA-67mh-4wv8-2f99). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification
  package-lock.json
  A package you depend on has a known security hole (CVE-2023-37478). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69262 pnpm: pnpm: Remote code execution via command injection in tokenHelper environment variable substitution
  package-lock.json
  A package you depend on has a known security hole (CVE-2025-69262). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69263 pnpm: pnpm Lockfile Integrity Bypass
  package-lock.json
  A package you depend on has a known security hole (CVE-2025-69263). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50015 pnpm: pnpm: Arbitrary file write/delete due to lack of path validation in patch files
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-50015). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50016 pnpm: pnpm: Arbitrary code execution due to path traversal in dependency aliases
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-50016). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55487 pnpm: pnpm: Supply chain compromise via manipulated package source strings
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-55487). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55697 pnpm: pnpm: Arbitrary code execution via improper handling of config dependencies
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-55697). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55698 pnpm: pnpm: Arbitrary code execution via malicious package-manager lockfile
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-55698). Fix: Update that package to its patched version.
• Worth fixing GHSA-72r4-9c5j-mj57 pnpm: `patch-remove` could delete project-selected files outside the patches directory
  package-lock.json
  A package you depend on has a known security hole (GHSA-72r4-9c5j-mj57). Fix: Update that package to its patched version.
• Worth fixing GHSA-fr4h-3cph-29xv pnpm: Hoisted install imports lockfile alias outside node_modules
  package-lock.json
  A package you depend on has a known security hole (GHSA-fr4h-3cph-29xv). Fix: Update that package to its patched version.
• Worth fixing GHSA-qrv3-253h-g69c pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
  package-lock.json
  A package you depend on has a known security hole (GHSA-qrv3-253h-g69c). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47829 pnpm: pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-47829). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-53866 pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-53866). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-23888 pnpm: pnpm: Arbitrary file write via path traversal in binary fetcher leading to remote code execution
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-23888). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-23889 pnpm: pnpm: Arbitrary file write via path traversal on Windows
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-23889). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-23890 pnpm: pnpm: Arbitrary code execution via path traversal in bin linking
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-23890). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-24056 pnpm: pnpm symlink traversal in file:/git dependencies
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-24056). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-24131 pnpm: pnpm: Arbitrary file permission modification via directory traversal
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-24131). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48995 pnpm: pnpm: Supply chain compromise from unverified dependencies
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-48995). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50014 pnpm: pnpm: Arbitrary Code Execution via Malicious Lockfile
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-50014). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50017 pnpm: pnpm: Information disclosure of authentication credentials via malicious .npmrc file
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-50017). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50021 pnpm: pnpm: Integrity bypass allows installation of altered packages via modified lockfile
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-50021). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50573 pnpm: pnpm: Package integrity check bypass allows installation of malicious content
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-50573). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55180 pnpm: pacquet: pnpm and pacquet: Information disclosure of environment secrets via improper environment variable expansion
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-55180). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/packages/core/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/packages/core/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/packages/core/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/playground/webpack/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/playground/webpack/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the response
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-2phv-j68v-wwqx pnpm vulnerable to Command Injection via environment variable substitution
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2025-69262). Fix: Update that package to its patched version.
• Worth fixing GHSA-3qhv-2rgh-x77r pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-55180). Fix: Update that package to its patched version.
• Worth fixing GHSA-4gxm-v5v7-fqc4 pnpm: Reserved bin name deletes PNPM_HOME during global remove
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-55699). Fix: Update that package to its patched version.
• Worth fixing GHSA-54hh-g5mx-jqcp pnpm: Unsafe default behavior breaks integrity check
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-50573). Fix: Update that package to its patched version.
• Worth fixing GHSA-5r98-f33j-g8h7 pnpm incorrectly parses tar archives relative to specification
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2023-37478). Fix: Update that package to its patched version.
• Worth fixing GHSA-5wx6-mg75-v57r pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-55487). Fix: Update that package to its patched version.
• Worth fixing GHSA-6pfh-p556-v868 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-23888). Fix: Update that package to its patched version.
• Worth fixing GHSA-6x96-7vc8-cm3p pnpm has Windows-specific tarball Path Traversal
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-23889). Fix: Update that package to its patched version.
• Worth fixing GHSA-72r4-9c5j-mj57 pnpm: `patch-remove` could delete project-selected files outside the patches directory
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59194). Fix: Update that package to its patched version.
• Worth fixing GHSA-7vhp-vf5g-r2fw pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2025-69263). Fix: Update that package to its patched version.
• Worth fixing GHSA-8cc4-rfj6-fhg4 pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2024-47829). Fix: Update that package to its patched version.
• Worth fixing GHSA-cjhr-43r9-cfmw pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-50017). Fix: Update that package to its patched version.
• Worth fixing GHSA-fr4h-3cph-29xv pnpm: Hoisted install imports lockfile alias outside node_modules
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59196). Fix: Update that package to its patched version.
• Worth fixing GHSA-gj8w-mvpf-x27x pnpm: Repository-controlled configDependencies can select a pacquet native install engine
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-55697). Fix: Update that package to its patched version.
• Worth fixing GHSA-hg3w-7f8c-63hp pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-48995). Fix: Update that package to its patched version.
• Worth fixing GHSA-hwx4-2j3j-g496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-50016). Fix: Update that package to its patched version.
• Worth fixing GHSA-m733-5w8f-5ggw pnpm has symlink traversal in file:/git dependencies
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-24056). Fix: Update that package to its patched version.
• Worth fixing GHSA-p4xf-rf54-rj3x pnpm: Git Fetch Argument Injection via Lockfile resolution.commit
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-50014). Fix: Update that package to its patched version.
• Worth fixing GHSA-q6j5-fjx5-2mc3 pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field
  /workdirs/scan-9c7f61df-28bb-4704-87fb-6c099ab96f74/package-lock.json
  A package you depend on has a known security hole (CVE-2026-50021). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout