lorhansohaky/nizkctf-front

API keys, passwords or tokens committed into the repo.

• Serious gcp-api-key Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
  next.config.js:6
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious gcp-api-key Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
  next.config.js:16
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious gcp-api-key Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
  next.config.js:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  public/lib/sodium.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  public/lib/sodium.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2025-9287 cipher-base: Cipher-base hash manipulation
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-9287). Fix: Update that package to its patched version.
• Serious GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
  yarn.lock
  A package you depend on has a known security hole (GHSA-vjh7-7g9h-fjfh). Fix: Update that package to its patched version.
• Serious CVE-2022-37601 loader-utils: prototype pollution in function parseQuery in parseQuery.js
  yarn.lock
  A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
• Serious CVE-2021-44906 minimist: prototype pollution
  yarn.lock
  A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
• Serious CVE-2025-6545 pbkdf2: pbkdf2 silently returns predictable key material
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-6545). Fix: Update that package to its patched version.
• Serious CVE-2025-6547 pbkdf2: pbkdf2 silently returns static keys
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-6547). Fix: Update that package to its patched version.
• Serious CVE-2023-36665 protobufjs: prototype pollution using user-controlled protobuf message
  yarn.lock
  A package you depend on has a known security hole (CVE-2023-36665). Fix: Update that package to its patched version.
• Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious CVE-2025-9288 sha.js: Missing type checks leading to hash rewind and passing on crafted data
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-9288). Fix: Update that package to its patched version.
• Serious CVE-2021-42740 The shell-quote package before 1.7.3 for Node.js allows command inject ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2021-42740). Fix: Update that package to its patched version.
• Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48068 grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-48068). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48069 grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-48069). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-37168 grps-js: allocate memory for incoming messages well above configured limits
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-37168). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44288 protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
• Worth fixing GHSA-593m-55hh-j8gv Sentry SDK Prototype Pollution gadget in JavaScript SDKs
  yarn.lock
  A package you depend on has a known security hole (GHSA-593m-55hh-j8gv). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-3807 nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes
  yarn.lock
  A package you depend on has a known security hole (CVE-2021-3807). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-2739 bn.js: bn.js: Denial of Service via calling maskn(0)
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-2739). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-2739 bn.js: bn.js: Denial of Service via calling maskn(0)
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-2739). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-4068 braces: fails to limit the number of characters it can handle
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-4068). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-46234 browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack
  yarn.lock
  A package you depend on has a known security hole (CVE-2023-46234). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-23364 browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS)
  yarn.lock
  A package you depend on has a known security hole (CVE-2021-23364). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-cpq7-6gpm-g9rc cipher-base is missing type checks, leading to hash rewind and passing on crafted data
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2025-9287). Fix: Update that package to its patched version.
• Serious GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Serious GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
• Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
• Serious GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2025-6545). Fix: Update that package to its patched version.
• Serious GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2025-6547). Fix: Update that package to its patched version.
• Serious GHSA-h755-8qp9-cq85 protobufjs Prototype Pollution vulnerability
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2023-36665). Fix: Update that package to its patched version.
• Serious GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious GHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted data
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2025-9288). Fix: Update that package to its patched version.
• Serious GHSA-g4rg-993r-mgx7 Improper Neutralization of Special Elements used in a Command in Shell-quote
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2021-42740). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-5375-pq7m-f5r2 @grpc/grpc-js: A malformed request can cause a server crash
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2026-48068). Fix: Update that package to its patched version.
• Worth fixing GHSA-7v5v-9h63-cj86 @grpc/grpc-js can allocate memory for incoming messages well above configured limits
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2024-37168). Fix: Update that package to its patched version.
• Worth fixing GHSA-99f4-grh7-6pcq @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2026-48069). Fix: Update that package to its patched version.
• Worth fixing GHSA-q6x5-8v7m-xcrf protobufjs has overlong UTF-8 decoding
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
• Worth fixing GHSA-593m-55hh-j8gv Sentry SDK Prototype Pollution gadget in JavaScript SDKs
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-93q8-gq69-wqmw Inefficient Regular Expression Complexity in chalk/ansi-regex
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2021-3807). Fix: Update that package to its patched version.
• Worth fixing GHSA-378v-28hj-76wf bn.js affected by an infinite loop
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2026-2739). Fix: Update that package to its patched version.
• Worth fixing GHSA-378v-28hj-76wf bn.js affected by an infinite loop
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2026-2739). Fix: Update that package to its patched version.
• Worth fixing GHSA-grv7-fg5c-xmjg Uncontrolled resource consumption in braces
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2024-4068). Fix: Update that package to its patched version.
• Worth fixing GHSA-x9w5-v3q2-3rhw browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2023-46234). Fix: Update that package to its patched version.
• Worth fixing GHSA-w8qv-6jwh-64r5 Regular Expression Denial of Service in browserslist
  /workdirs/scan-4ca1bc3d-3691-4663-8fe9-6fb8f331e365/yarn.lock
  A package you depend on has a known security hole (CVE-2021-23364). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout