gitsafehub
github.com/plasmohq/plasmo ↗

plasmohq/plasmo

scanned 2026-07-18 · git 9369e28
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies145Known OSS vulnerabilities224Risky code patterns✓Malicious dependencies—Project health8

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 145 found · 6 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2026-25896 fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
  • Serious CVE-2025-29927 nextjs: Authorization Bypass in Next.js Middleware
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-29927). Fix: Update that package to its patched version.
  • Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
  • Serious CVE-2025-9288 sha.js: Missing type checks leading to hash rewind and passing on crafted data
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-9288). Fix: Update that package to its patched version.
  • Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
  • Serious CVE-2026-54466 websocket-driver: Message corruption via abuse of protocol length headers
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44728 Babel is a compiler for writing next generation JavaScript. From 7.12. ...
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48068 grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-48068). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48069 grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-48069). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-37168 grps-js: allocate memory for incoming messages well above configured limits
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2024-37168). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-56648 parcel: Parcel Origin Validation Error
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-56648). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44288 protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-22029 @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-22029). Fix: Update that package to its patched version.
  • Worth fixing GHSA-593m-55hh-j8gv Sentry SDK Prototype Pollution gadget in JavaScript SDKs
    pnpm-lock.yaml
    A package you depend on has a known security hole (GHSA-593m-55hh-j8gv). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27611 base-x: base-x homograph attack allows Unicode lookalike characters to bypass validation.
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-27611). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33750 brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33750 brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-4068 braces: fails to limit the number of characters it can handle
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2024-4068). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-21538 cross-spawn: regular expression denial of service
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2024-21538). Fix: Update that package to its patched version.
  • Worth fixing GHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the response
    pnpm-lock.yaml
    A package you depend on has a known security hole (GHSA-67mh-4wv8-2f99). Fix: Update that package to its patched version.
… 120 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 224 found · 15 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-cpq7-6gpm-g9rc cipher-base is missing type checks, leading to hash rewind and passing on crafted data
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-9287). Fix: Update that package to its patched version.
  • Serious GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Serious GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
  • Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
  • Serious GHSA-wf6x-7x77-mvgw Immutable is vulnerable to Prototype Pollution
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-29063). Fix: Update that package to its patched version.
  • Serious GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-29927). Fix: Update that package to its patched version.
  • Serious GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Serious GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-29927). Fix: Update that package to its patched version.
  • Serious GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-6545). Fix: Update that package to its patched version.
  • Serious GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-6547). Fix: Update that package to its patched version.
  • Serious GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
  • Serious GHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted data
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-9288). Fix: Update that package to its patched version.
  • Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
  • Serious GHSA-3qcw-2rhx-2726 Turbo: Unexpected local code execution during Yarn Berry detection
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-45772). Fix: Update that package to its patched version.
  • Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
  • Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
  • Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5375-pq7m-f5r2 @grpc/grpc-js: A malformed request can cause a server crash
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-48068). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7v5v-9h63-cj86 @grpc/grpc-js can allocate memory for incoming messages well above configured limits
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2024-37168). Fix: Update that package to its patched version.
  • Worth fixing GHSA-99f4-grh7-6pcq @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-48069). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qm9p-f9j5-w83w Parcel has an Origin Validation Error vulnerability
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-56648). Fix: Update that package to its patched version.
  • Worth fixing GHSA-q6x5-8v7m-xcrf protobufjs has overlong UTF-8 decoding
    /workdirs/scan-9c1132b5-17bc-4f6b-8dce-7877e258787d/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
… 199 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ 8 notes

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

  • Minor scorecard-overall OpenSSF Scorecard overall: 5.1/10
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-CI-Tests CI-Tests scored 0: 0 out of 27 merged PRs checked by a CI test -- score normalized to 0
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-CII-Best-Practices CII-Best-Practices scored 0: no effort to earn an OpenSSF best practices badge detected
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Fuzzing Fuzzing scored 0: project is not fuzzed
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Maintained Maintained scored 0: 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Pinned-Dependencies Pinned-Dependencies scored 0: dependency not pinned by hash detected -- score normalized to 0
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-SAST SAST scored 0: SAST tool is not run on all commits -- score normalized to 0
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Token-Permissions Token-Permissions scored 0: detected GitHub workflow tokens with excessive permissions
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.

via OpenSSF Scorecard v5.5.0 · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.