nrwl/nx-console

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  apps/intellij/src/main/kotlin/dev/nx/console/telemetry/TelemetryValues.kt:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  libs/shared/telemetry/src/lib/google-analytics.ts:17
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  libs/vscode/mcp/src/lib/periodic-ai-check.ts:59
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  libs/vscode/telemetry/src/lib/google-analytics-sender.ts:20
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  .yarn/releases/yarn-3.2.3.cjs:127
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-frvp-7c67-39w9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
  yarn.lock
  A package you depend on has a known security hole (GHSA-frvp-7c67-39w9). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33750 brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-13676 fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-16221 Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-6321 fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-6321). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-6322 fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-6322). Fix: Update that package to its patched version.
• Worth fixing GHSA-r4q5-vmmm-2653 follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
  yarn.lock
  A package you depend on has a known security hole (GHSA-r4q5-vmmm-2653). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-64756 glob: glob: Command Injection Vulnerability via Malicious Filenames
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-64756). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55602 http-proxy-middleware: http-proxy-middleware: Unintended backend routing due to crafted Host header
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-55602). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42338 ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-42338). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-53632 launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-53632). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-26996 minimatch: minimatch: Denial of Service via specially crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27903 minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-26996 minimatch: minimatch: Denial of Service via specially crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27903 minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-4867 path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-4867). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-4926 path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-4926). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-4923 path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-4923). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2026-33937). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
• Worth fixing GHSA-frvp-7c67-39w9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-345p-7cg4-v4c7 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2026-25536). Fix: Update that package to its patched version.
• Worth fixing GHSA-8r9q-7v3j-jr4g Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2026-0621). Fix: Update that package to its patched version.
• Worth fixing GHSA-w48q-cv73-mx4w Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2025-66414). Fix: Update that package to its patched version.
• Worth fixing GHSA-h5c3-5r3r-rr8q @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25288). Fix: Update that package to its patched version.
• Worth fixing GHSA-rmvr-2pp2-xj38 @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25290). Fix: Update that package to its patched version.
• Worth fixing GHSA-xx4v-prfh-6cgc @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25289). Fix: Update that package to its patched version.
• Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of service
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype values
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatoken
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request construction
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
  /workdirs/scan-7ec886ff-70a3-478d-a10c-5625b5e7b450/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout