saturninoabril/mobile-performance-server

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2019-10744 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
  package-lock.json
  A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
• Serious CVE-2024-21508 mysql2: Remote Code Execution
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-21508). Fix: Update that package to its patched version.
• Serious CVE-2024-21511 mysql2: Arbitrary Code Injection due to improper sanitization of the timezone parameter
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-21511). Fix: Update that package to its patched version.
• Serious CVE-2019-10748 SQL Injection in sequelize
  package-lock.json
  A package you depend on has a known security hole (CVE-2019-10748). Fix: Update that package to its patched version.
• Serious CVE-2019-10752 SQL Injection in sequelize
  package-lock.json
  A package you depend on has a known security hole (CVE-2019-10752). Fix: Update that package to its patched version.
• Serious CVE-2023-22578 Sequelize - Default support for “raw attributes” when using parentheses
  package-lock.json
  A package you depend on has a known security hole (CVE-2023-22578). Fix: Update that package to its patched version.
• Serious CVE-2023-22579 Unsafe fall-through in getWhereConditions
  package-lock.json
  A package you depend on has a known security hole (CVE-2023-22579). Fix: Update that package to its patched version.
• Serious CVE-2023-25813 Sequelize vulnerable to SQL Injection via replacements
  package-lock.json
  A package you depend on has a known security hole (CVE-2023-25813). Fix: Update that package to its patched version.
• Serious CVE-2026-69240 sequelize: Sequelize: SQL Injection via improper handling of Oracle date functions
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-69240). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parser
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-45590). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-26132 Versions of the package dottie before 2.0.4 are vulnerable to Prototyp ...
  package-lock.json
  A package you depend on has a known security hole (CVE-2023-26132). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-29041 express: cause malformed URLs to be evaluated
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-29041). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function
  package-lock.json
  A package you depend on has a known security hole (CVE-2020-8203). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-23337 nodejs-lodash: command injection via template
  package-lock.json
  A package you depend on has a known security hole (CVE-2021-23337). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-4800). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-28500 nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions
  package-lock.json
  A package you depend on has a known security hole (CVE-2020-28500). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-13465 lodash: prototype pollution in _.unset and _.omit functions
  package-lock.json
  A package you depend on has a known security hole (CVE-2025-13465). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-2950 lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-2950). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-24785 Moment.js: Path traversal in moment.locale
  package-lock.json
  A package you depend on has a known security hole (CVE-2022-24785). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS
  package-lock.json
  A package you depend on has a known security hole (CVE-2022-31129). Fix: Update that package to its patched version.
• Worth fixing GHSA-v78c-4p63-2j6c Cleartext Transmission of Sensitive Information in moment-timezone
  package-lock.json
  A package you depend on has a known security hole (GHSA-v78c-4p63-2j6c). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-21512 mysql2: vulnerable to Prototype Pollution due to improper user input sanitization
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-21512). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-21507 mysql2: Improper Input Validation
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-21507). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-21509 mysql2: Prototype Poisoning
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-21509). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45296 path-to-regexp: Backtracking regular expressions cause ReDoS
  package-lock.json
  A package you depend on has a known security hole (CVE-2024-45296). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
• Serious MAL-2023-462 Malicious code in fsevents (npm)
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Serious GHSA-8r6j-v8pm-fqw3 Code injection in fsevents
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2023-45311). Fix: Update that package to its patched version.
• Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
• Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
• Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
• Serious GHSA-fhjf-83wg-r2j9 Prototype Pollution in mixin-deep
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2019-10746). Fix: Update that package to its patched version.
• Serious GHSA-4rch-2fh8-94vw MySQL2 for Node Arbitrary Code Injection
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2024-21511). Fix: Update that package to its patched version.
• Serious GHSA-fpw7-j2hg-69v5 mysql2 Remote Code Execution (RCE) via the readCodeFor function
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2024-21508). Fix: Update that package to its patched version.
• Serious GHSA-f598-mfpv-gmfx Sequelize - Default support for “raw attributes” when using parentheses
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2023-22578). Fix: Update that package to its patched version.
• Serious GHSA-j9xp-92vc-559j SQL Injection in sequelize
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2019-10748). Fix: Update that package to its patched version.
• Serious GHSA-m9jw-237r-gvfv SQL Injection in sequelize
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2019-10752). Fix: Update that package to its patched version.
• Serious GHSA-v8fg-2rw7-q452 Sequelize: SQL Injection (Oracle DB)
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2026-69240). Fix: Update that package to its patched version.
• Serious GHSA-vqfx-gj96-3w95 Unsafe fall-through in getWhereConditions
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2023-22579). Fix: Update that package to its patched version.
• Serious GHSA-wrh9-cjv3-2hpw Sequelize vulnerable to SQL Injection via replacements
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2023-25813). Fix: Update that package to its patched version.
• Serious GHSA-4g88-fppr-53pp Prototype Pollution in set-value
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2019-10747). Fix: Update that package to its patched version.
• Serious GHSA-4g88-fppr-53pp Prototype Pollution in set-value
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2019-10747). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-93q8-gq69-wqmw Inefficient Regular Expression Complexity in chalk/ansi-regex
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2021-3807). Fix: Update that package to its patched version.
• Worth fixing GHSA-qwcr-r2fm-qrc7 body-parser vulnerable to denial of service when url encoding is enabled
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2024-45590). Fix: Update that package to its patched version.
• Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
• Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
• Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
  /workdirs/scan-33d4ec2a-bf82-40f9-8fb8-db22d7ecac05/package-lock.json
  A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

• Worth fixing guarddog-npm-npm-install-script npm-install-script match in nodemon 1.18.11
  nodemon
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0