thedevdojo/voyager

scanned 2026-06-30 · git 7e7e0f4

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies10Known OSS vulnerabilities76Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 30s

Vulnerable dependencies — Trivyⓘ 10 found

Packages you depend on that have known security holes (CVEs).

Worth fixing GHSA-v78c-4p63-2j6c Cleartext Transmission of Sensitive Information in moment-timezone

package-lock.json

A package you depend on has a known security hole (GHSA-v78c-4p63-2j6c). Fix: Update that package to its patched version.
Worth fixing CVE-2024-55565 nanoid: nanoid mishandles non-integer values

package-lock.json

A package you depend on has a known security hole (CVE-2024-55565). Fix: Update that package to its patched version.
Worth fixing CVE-2026-41305 postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags

package-lock.json

A package you depend on has a known security hole (CVE-2026-41305). Fix: Update that package to its patched version.
Worth fixing CVE-2026-47759 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

package-lock.json

A package you depend on has a known security hole (CVE-2026-47759). Fix: Update that package to its patched version.
Worth fixing CVE-2026-47760 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

package-lock.json

A package you depend on has a known security hole (CVE-2026-47760). Fix: Update that package to its patched version.
Worth fixing CVE-2026-47761 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

package-lock.json

A package you depend on has a known security hole (CVE-2026-47761). Fix: Update that package to its patched version.
Worth fixing CVE-2026-47762 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

package-lock.json

A package you depend on has a known security hole (CVE-2026-47762). Fix: Update that package to its patched version.
Worth fixing CVE-2024-29881 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

package-lock.json

A package you depend on has a known security hole (CVE-2024-29881). Fix: Update that package to its patched version.
Minor GHSA-56x4-j7p9-fcf9 Command Injection in moment-timezone

package-lock.json

A package you depend on has a known security hole (GHSA-56x4-j7p9-fcf9). Fix: Update that package to its patched version.
Minor CVE-2024-9506 vue: Regular Expression Denial of Service (ReDoS)

package-lock.json

A package you depend on has a known security hole (CVE-2024-9506). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 76 found · 7 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-cpq7-6gpm-g9rc cipher-base is missing type checks, leading to hash rewind and passing on crafted data

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-9287). Fix: Update that package to its patched version.
Serious GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Serious GHSA-wf6x-7x77-mvgw Immutable is vulnerable to Prototype Pollution

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2026-29063). Fix: Update that package to its patched version.
Serious GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-6545). Fix: Update that package to its patched version.
Serious GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-6547). Fix: Update that package to its patched version.
Serious GHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted data

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-9288). Fix: Update that package to its patched version.
Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
Worth fixing GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
Worth fixing GHSA-378v-28hj-76wf bn.js affected by an infinite loop

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2026-2739). Fix: Update that package to its patched version.
Worth fixing GHSA-378v-28hj-76wf bn.js affected by an infinite loop

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2026-2739). Fix: Update that package to its patched version.
Worth fixing GHSA-q58r-hwc8-rm9j Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-1647). Fix: Update that package to its patched version.
Worth fixing GHSA-vxmc-5x29-h64v Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2024-6485). Fix: Update that package to its patched version.
Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
Worth fixing GHSA-3xgq-45jj-v275 Regular Expression Denial of Service (ReDoS) in cross-spawn

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2024-21538). Fix: Update that package to its patched version.
Worth fixing GHSA-848j-6mx2-7j84 Elliptic Uses a Cryptographic Primitive with a Risky Implementation

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-14505). Fix: Update that package to its patched version.
Worth fixing GHSA-fc9h-whq2-v747 Valid ECDSA signatures erroneously rejected in Elliptic

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2024-48948). Fix: Update that package to its patched version.
Worth fixing GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2026-6321). Fix: Update that package to its patched version.
Worth fixing GHSA-v39h-62p7-jpjc fast-uri vulnerable to host confusion via percent-encoded authority delimiters

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2026-6322). Fix: Update that package to its patched version.
Worth fixing GHSA-r4q5-vmmm-2653 follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-4www-5p9h-95mh http-proxy-middleware can call writeBody twice because "else if" is not used

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2025-32996). Fix: Update that package to its patched version.
Worth fixing GHSA-64mm-vxmg-q3vj http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass

/workdirs/scan-3f2f6257-ef74-4941-bb9d-344c02bdc44b/package-lock.json

A package you depend on has a known security hole (CVE-2026-55602). Fix: Update that package to its patched version.

… 51 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited — injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious — typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project — not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.