mcollina/opentelemetry-js-contrib

API keys, passwords or tokens committed into the repo.

• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  packages/instrumentation-net/test/fixtures/tls.key:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/mysql/docker/grafana/grafana.ini:251
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Worth fixing CVE-2026-48068 grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-48068). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48069 grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-48069). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54285 @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-59892 @opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-59892). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69152 brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33750 brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45149 brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-45149). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27903 minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48712 protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-48712). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54269 protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-54269). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-59877 protobufjs: protobufjs: Denial of Service via crafted .proto schema
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-59877). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50289 systeminformation is a System and OS information library for node.js. ...
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-50289). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41907 uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-41907). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Worth fixing GHSA-m5vv-6r4h-3vj9 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2024-35255). Fix: Update that package to its patched version.
• Worth fixing GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
• Worth fixing GHSA-5375-pq7m-f5r2 @grpc/grpc-js: A malformed request can cause a server crash
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-48068). Fix: Update that package to its patched version.
• Worth fixing GHSA-99f4-grh7-6pcq @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-48069). Fix: Update that package to its patched version.
• Worth fixing GHSA-36hh-x5p5-jgc8 @hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44974). Fix: Update that package to its patched version.
• Worth fixing GHSA-jg4p-7fhp-p32p @hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-35213). Fix: Update that package to its patched version.
• Worth fixing GHSA-vhjm-w67q-g75c @hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44979). Fix: Update that package to its patched version.
• Worth fixing GHSA-x426-x7cc-3fpc @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-48022). Fix: Update that package to its patched version.
• Worth fixing GHSA-47p6-69vm-vw6v @koa/router has an Access Control Bypass
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9495). Fix: Update that package to its patched version.
• Worth fixing GHSA-cj7v-w2c7-cp7c nest allows a remote attacker to execute arbitrary code via the Content-Type header
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2024-29409). Fix: Update that package to its patched version.
• Worth fixing GHSA-36xv-jgw5-4q75 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-35515). Fix: Update that package to its patched version.
• Worth fixing GHSA-8988-4f7v-96qf OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing GHSA-45rx-2jwx-cxfr OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59892). Fix: Update that package to its patched version.
• Worth fixing GHSA-jfc7-64v2-mr8c @sigstore/core has DSSE payloadType type-binding failure
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-48758). Fix: Update that package to its patched version.
• Worth fixing GHSA-xgjw-pm74-86q4 sigstore-js has Insufficient Verification of Data Authenticity
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-48816). Fix: Update that package to its patched version.
• Worth fixing GHSA-xcpc-8h2w-3j85 adm-zip: Crafted ZIP file triggers 4GB memory allocation
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-39244). Fix: Update that package to its patched version.
• Worth fixing GHSA-35jp-ww65-95wh axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44494). Fix: Update that package to its patched version.
• Worth fixing GHSA-3g43-6gmg-66jw axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44495). Fix: Update that package to its patched version.
• Worth fixing GHSA-3w6x-2g7m-8v23 Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-42044). Fix: Update that package to its patched version.
• Worth fixing GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of service
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-67313). Fix: Update that package to its patched version.
• Worth fixing GHSA-445q-vr5w-6q77 Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-42037). Fix: Update that package to its patched version.
• Worth fixing GHSA-5c9x-8gcm-mpgx Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
  /workdirs/scan-ebb1fcaf-3d6f-4b9c-9f1f-2523d8da2ec7/package-lock.json
  A package you depend on has a known security hole (CVE-2026-42034). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout