opengoofy/hippo4j

API keys, passwords or tokens committed into the repo.

• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  agent/hippo4j-agent-core/src/main/java/cn/hippo4j/agent/core/util/PrivateKeyUtil.java:33
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  agent/hippo4j-agent-core/src/main/java/cn/hippo4j/agent/core/util/PrivateKeyUtil.java:35
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  agent/hippo4j-agent-core/src/main/java/cn/hippo4j/agent/core/util/PrivateKeyUtil.java:33
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  agent/hippo4j-agent-core/src/main/java/cn/hippo4j/agent/core/util/PrivateKeyUtil.java:35
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-naocs-spring-boot-3x/src/main/resources/application.properties:35
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-naocs-spring-boot-3x/src/main/resources/application.properties:37
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-naocs-spring-boot-3x/src/main/resources/application.properties:39
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-apollo-spring-boot-3x/src/main/resources/application.properties:28
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-apollo-spring-boot-3x/src/main/resources/application.properties:30
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-apollo-spring-boot-3x/src/main/resources/application.properties:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-apollo/src/main/resources/bootstrap.properties:28
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-apollo/src/main/resources/bootstrap.properties:30
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-apollo/src/main/resources/bootstrap.properties:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/src/main/resources/bootstrap.properties:28
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/src/main/resources/bootstrap.properties:30
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/src/main/resources/bootstrap.properties:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-nacos-spring-boot-1x/src/main/resources/bootstrap.properties:23
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-nacos-spring-boot-1x/src/main/resources/bootstrap.properties:25
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-nacos-spring-boot-1x/src/main/resources/bootstrap.properties:27
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/config/config-nacos-spring-boot3/src/main/resources/application.properties:27
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/config/config-nacos-spring-boot3/src/main/resources/application.properties:29
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/config/config-nacos-spring-boot3/src/main/resources/application.properties:31
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-nacos/src/main/resources/bootstrap.properties:29
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-nacos/src/main/resources/bootstrap.properties:31
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/threadpool-example/agent/config-nacos/src/main/resources/bootstrap.properties:33
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2023-45133 babel: arbitrary code execution
  docs/package-lock.json
  A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
• Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
  docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Serious CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+
  examples/pom.xml
  A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
• Serious CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+
  examples/pom.xml
  A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
• Serious CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+
  examples/pom.xml
  A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
• Serious CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-14379). Fix: Update that package to its patched version.
• Serious CVE-2019-14540 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-14540). Fix: Update that package to its patched version.
• Serious CVE-2019-16335 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-16335). Fix: Update that package to its patched version.
• Serious CVE-2019-16942 jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-16942). Fix: Update that package to its patched version.
• Serious CVE-2019-16943 jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-16943). Fix: Update that package to its patched version.
• Serious CVE-2019-17267 jackson-databind: Serialization gadgets in classes of the ehcache package
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-17267). Fix: Update that package to its patched version.
• Serious CVE-2019-17531 jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-17531). Fix: Update that package to its patched version.
• Serious CVE-2019-20330 jackson-databind: lacks certain net.sf.ehcache blocking
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-20330). Fix: Update that package to its patched version.
• Serious CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2020-8840). Fix: Update that package to its patched version.
• Serious CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2020-9547). Fix: Update that package to its patched version.
• Serious CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2020-9548). Fix: Update that package to its patched version.
• Serious CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
• Serious CVE-2016-1000027 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
• Serious CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+
  examples/threadpool-example/agent/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
• Serious CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution
  examples/threadpool-example/config/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-14379). Fix: Update that package to its patched version.
• Serious CVE-2019-14540 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig
  examples/threadpool-example/config/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-14540). Fix: Update that package to its patched version.
• Serious CVE-2019-16335 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource
  examples/threadpool-example/config/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-16335). Fix: Update that package to its patched version.
• Serious CVE-2019-16942 jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*
  examples/threadpool-example/config/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-16942). Fix: Update that package to its patched version.
• Serious CVE-2019-16943 jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource
  examples/threadpool-example/config/config-apollo-spring-boot-1x/pom.xml
  A package you depend on has a known security hole (CVE-2019-16943). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/threadpool/console-new/yarn.lock
  A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/threadpool/console-new/yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-87r5-mp6g-5w5j jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/threadpool/console-new/yarn.lock
  A package you depend on has a known security hole (CVE-2026-1615). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/threadpool/console-new/yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/threadpool/console-new/yarn.lock
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing GHSA-3g43-6gmg-66jw axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44495). Fix: Update that package to its patched version.
• Worth fixing GHSA-3p68-rc4w-qgx5 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2025-62718). Fix: Update that package to its patched version.
• Worth fixing GHSA-43fc-jf86-j433 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-25639). Fix: Update that package to its patched version.
• Worth fixing GHSA-5c9x-8gcm-mpgx Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-42034). Fix: Update that package to its patched version.
• Worth fixing GHSA-62hf-57xw-28j9 Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-42039). Fix: Update that package to its patched version.
• Worth fixing GHSA-6chq-wfr3-2hj9 Axios: Header Injection via Prototype Pollution
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-42035). Fix: Update that package to its patched version.
• Worth fixing GHSA-898c-q2cr-xwhg axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44490). Fix: Update that package to its patched version.
• Worth fixing GHSA-fvcv-3m26-pcqx Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-40175). Fix: Update that package to its patched version.
• Worth fixing GHSA-hfxv-24rg-xrqf Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44496). Fix: Update that package to its patched version.
• Worth fixing GHSA-j5f8-grm9-p9fc Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2026-44486). Fix: Update that package to its patched version.
• Worth fixing GHSA-jr5f-v2jv-69x6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
  /workdirs/scan-def988c1-903b-42cb-be18-b119e38ed8ef/docs/package-lock.json
  A package you depend on has a known security hole (CVE-2025-27152). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0