gitsafehub
github.com/thealexlichter/prettier ↗

thealexlichter/prettier

scanned 2026-08-12 · git cf7db35
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies38Known OSS vulnerabilities59Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 38 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-69152 brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13676 fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-16221 Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-18446 fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-18446). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
    website/yarn.lock
    A package you depend on has a known security hole (GHSA-5p4m-2wfm-xmqj). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59869 js-yaml: js-yaml: Denial of Service via crafted YAML documents
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
    website/yarn.lock
    A package you depend on has a known security hole (GHSA-5p4m-2wfm-xmqj). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-67213 nanoid: nanoid: Denial of Service via infinite loop in random ID generation
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-67213). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-67214 nanoid (Nano ID) before 5.1.16 contains an infinite loop in the custom ...
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-67214). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
    website/yarn.lock
    A package you depend on has a known security hole (GHSA-r28c-9q8g-f849). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-69153 postcss: PostCSS: Information disclosure via crafted sourceMappingURL
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-69153). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5c6j-r48x-rmvq Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
    website/yarn.lock
    A package you depend on has a known security hole (GHSA-5c6j-r48x-rmvq). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-34043 serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-34043). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2p49-hgcm-8545 SVGO removeScripts plugin leaves some executable scripts intact
    website/yarn.lock
    A package you depend on has a known security hole (GHSA-2p49-hgcm-8545). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59874). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59871 node-tar: node-tar: Denial of Service due to incorrect PAX path handling
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59871). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59875 node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59875). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r292-9mhp-454m node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
    website/yarn.lock
    A package you depend on has a known security hole (GHSA-r292-9mhp-454m). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-15157 undici: undici: HTTP header injection via unvalidated blob-like body type property
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-15157). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-16728 undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-16728). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-16729 undici: Undici: Cookie attribute injection allows bypassing security protections
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-16729). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41907 uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-41907). Fix: Update that package to its patched version.
… 13 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 59 found · 2 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/scripts/tools/bundle-test/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7p8r-x3mc-p8w7 fast-uri vulnerable to host confusion via backslash authority introducer
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/scripts/tools/bundle-test/yarn.lock
    A package you depend on has a known security hole (CVE-2026-18446). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/scripts/tools/bundle-test/yarn.lock
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7p8r-x3mc-p8w7 fast-uri vulnerable to host confusion via backslash authority introducer
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-18446). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5p2g-fcmc-qvqq image-size: JXL and HEIF parsers allow denial of service through infinite loops
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2025-71329). Fix: Update that package to its patched version.
  • Worth fixing GHSA-w3rx-r6r6-pgpr image-size: ICNS parser allows denial of service through an infinite loop
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2025-71330). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-28wg-ghj8-5hjv nanoid: non-secure generators can loop indefinitely with negative size
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-67214). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zero
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-67213). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fxqj-rqcc-2cmp PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-69153). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-5c6j-r48x-rmvq Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-qj8w-gfj5-8c6v Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-34043). Fix: Update that package to its patched version.
  • Worth fixing GHSA-395f-4hp3-45gv shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13311). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2p49-hgcm-8545 SVGO removeScripts plugin leaves some executable scripts intact
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-8x88-c5mf-7j5w node-tar: Negative tar entry size causes infinite loop in archive replace
    /workdirs/scan-d06294dc-bece-4423-8200-651fc99d1e82/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59874). Fix: Update that package to its patched version.
… 34 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ couldn’t run

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:ERROR: Error while scanning. Received HTTPSConnectionPool(host='registry.npmjs.org', port=443): Max retries exceeded wit

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.