stvlynn/rsshub

API keys, passwords or tokens committed into the repo.

• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  lib/routes/1point3acres/offer.ts:72
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  lib/routes/1point3acres/offer.ts:89
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  lib/routes/appstore/in-app-purchase.ts:43
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  lib/routes/caixin/utils-fulltext.ts:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious airtable-api-key Uncovered a possible Airtable API Key, potentially compromising database access and leading to data leakage or alteration.
  lib/routes/layoffs/index.ts:57
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious algolia-api-key Identified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platforms.
  lib/routes/nintendo/eshop-us.ts:25
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious algolia-api-key Identified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platforms.
  lib/routes/skeb/search.ts:40
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  lib/routes/sspai/prime-community.ts:34
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious twitch-api-token Discovered a Twitch API token, which could compromise streaming services and account integrations.
  lib/routes/twitch/video.ts:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious twitch-api-token Discovered a Twitch API token, which could compromise streaming services and account integrations.
  lib/routes/twitch/schedule.ts:6
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious twitch-api-token Discovered a Twitch API token, which could compromise streaming services and account integrations.
  lib/routes/twitch/live.ts:6
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  lib/routes/xiaoyuzhou/pickup.ts:19
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious gcp-api-key Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
  lib/routes/youtube/charts.ts:94
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  lib/routes/zuvio/utils.ts:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes-deprecated/dailyart/index.js:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/middleware/parameter.test.ts:4
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes/cohere/index.ts:33
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes/douban/other/ustop.ts:25
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes/dxy/utils.ts:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes/huxiu/util.ts:259
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes/instructables/projects.ts:36
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes/kuaidi100/utils.ts:4
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes/kuaidi100/utils.ts:6
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes/kuaidi100/utils.ts:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/routes/kuaidi100/utils.ts:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-27699 basic-ftp: basic-ftp: File overwrite due to path traversal
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-27699). Fix: Update that package to its patched version.
• Serious CVE-2025-7783 form-data: Unsafe random function in form-data
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious CVE-2025-7783 form-data: Unsafe random function in form-data
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious CVE-2025-7783 form-data: Unsafe random function in form-data
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious CVE-2026-4599 jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-4599). Fix: Update that package to its patched version.
• Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-29087 @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-29087). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39406 @hono/node-server: Middleware bypass via repeated slashes in serveStatic
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-39406). Fix: Update that package to its patched version.
• Worth fixing GHSA-frvp-7c67-39w9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
  pnpm-lock.yaml
  A package you depend on has a known security hole (GHSA-frvp-7c67-39w9). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54285 @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44902 opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44902). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44288 protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41324 basic-ftp: basic-ftp: Denial of Service via unbounded memory growth from malicious directory listings
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-41324). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44240 basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44240). Fix: Update that package to its patched version.
• Worth fixing GHSA-6v7q-wjvx-w8wg basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
  pnpm-lock.yaml
  A package you depend on has a known security hole (GHSA-6v7q-wjvx-w8wg). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69152 brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33750 brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-21538 cross-spawn: regular expression denial of service
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2024-21538). Fix: Update that package to its patched version.
• Worth fixing GHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the response
  pnpm-lock.yaml
  A package you depend on has a known security hole (GHSA-67mh-4wv8-2f99). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-12143 form-data: form-data: Form field override via CRLF injection
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-12143 form-data: form-data: Form field override via CRLF injection
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-5rq4-664w-9x2c Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-27699). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-5jx8-q4cp-rhh6 jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-4599). Fix: Update that package to its patched version.
• Serious GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
• Serious GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-24964). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-92pp-h63x-v22m @hono/node-server: Middleware bypass via repeated slashes in serveStatic
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-39406). Fix: Update that package to its patched version.
• Worth fixing GHSA-frvp-7c67-39w9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-wc8c-qw6v-h7f6 @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-29087). Fix: Update that package to its patched version.
• Worth fixing GHSA-8988-4f7v-96qf OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing GHSA-q7rr-3cgh-j5r3 Prometheus exporter process crash via malformed HTTP request
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44902). Fix: Update that package to its patched version.
• Worth fixing GHSA-q6x5-8v7m-xcrf protobufjs has overlong UTF-8 decoding
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
• Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing GHSA-6v7q-wjvx-w8wg basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-rp42-5vxx-qpwr basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-41324). Fix: Update that package to its patched version.
• Worth fixing GHSA-rpmf-866q-6p89 basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44240). Fix: Update that package to its patched version.
• Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
  /workdirs/scan-ece35a82-44c9-4f78-ab2b-14c9310e1dad/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout