Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
Packages you depend on that have known security holes (CVEs).
CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bombCVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bombCVE-2026-54285 @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headersGHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningGHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of serviceGHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype valuesGHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosGHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatokenGHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request constructionGHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of ServiceGHSA-xj6q-8x83-jv6g Axios: Prototype pollution auth subfields can inject Basic authCVE-2026-12143 form-data: form-data: Form field override via CRLF injectionCVE-2026-54290 hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardCVE-2026-54286 hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)CVE-2026-54287 hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and LatticeCVE-2026-54288 hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`CVE-2026-54289 hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the restCVE-2026-59895 Hono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityCVE-2026-59896 hono/jsx does not isolate context per request, leading to cross-request data disclosureCVE-2026-59897 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationCVE-2026-59869 js-yaml: js-yaml: Denial of Service via crafted YAML documentsCVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive headerCVE-2026-59871 node-tar: node-tar: Denial of Service due to incorrect PAX path handlingYour dependencies cross-checked against the OSV vulnerability database.
GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited inputGHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited inputGHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited inputGHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited inputPYSEC-2026-457 Arbitrary Code Execution in PillowGHSA-8988-4f7v-96qf OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagationGHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of serviceGHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype valuesGHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosGHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningGHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatokenGHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request constructionGHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of ServiceGHSA-xj6q-8x83-jv6g Axios: Prototype pollution auth subfields can inject Basic authGHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsGHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashGHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsGHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashGHSA-3c8v-cfp5-9885 Electron: Out-of-bounds read in second-instance IPC on macOS and LinuxGHSA-4p4r-m79c-wq3v Electron: HTTP Response Header Injection in custom protocol handlers and webRequestGHSA-532v-xpq5-8h95 Electron: Use-after-free in offscreen child window paint callbackGHSA-5rqw-r77c-jp79 Electron: AppleScript injection in app.moveToApplicationsFolder on macOSGHSA-6r2x-8pq8-9489 Electron vulnerable to Heap Buffer Overflow in NativeImageCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.