timheuer/podman-desktop

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/main/src/plugin/telemetry/telemetry.ts:61
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/renderer/src/lib/pod/DeployPodToKube.spec.ts:527
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  website/docusaurus.config.js:452
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2025-7783 form-data: Unsafe random function in form-data
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious CVE-2025-7783 form-data: Unsafe random function in form-data
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious CVE-2024-21534 jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-21534). Fix: Update that package to its patched version.
• Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44728 Babel is a compiler for writing next generation JavaScript. From 7.12. ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-25285 octokit/endpoint: @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-25285). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-25288 octokit/plugin-paginate-rest: @octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-25288). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-25290 octokit/request: @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-25290). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-25290 octokit/request: @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-25290). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-25289 @octokit/request-error: @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-25289). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-25289 @octokit/request-error: @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-25289). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39244 adm-zip: adm-zip: Denial of Service via crafted ZIP file leading to excessive memory allocation
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-39244). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parser
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-45590). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-44fc-8fm5-q62h Convict has Prototype Pollution via startsWith() function
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2026-33864). Fix: Update that package to its patched version.
• Serious GHSA-hf2r-9gf9-rwch Convict has prototype pollution via load(), loadFile(), and schema initialization
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2026-33863). Fix: Update that package to its patched version.
• Serious GHSA-gx9m-whjm-85jf DOMpurify has a nesting-based mXSS
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2024-47875). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-hw8r-x6gr-5gjp JSONPath Plus allows Remote Code Execution
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-1302). Fix: Update that package to its patched version.
• Serious GHSA-pppg-cpfq-h7wr JSONPath Plus Remote Code Execution (RCE) Vulnerability
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2024-21534). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
• Serious GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-24964). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-x4c5-c7rf-jjgv @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25285). Fix: Update that package to its patched version.
• Worth fixing GHSA-h5c3-5r3r-rr8q @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25288). Fix: Update that package to its patched version.
• Worth fixing GHSA-rmvr-2pp2-xj38 @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25290). Fix: Update that package to its patched version.
• Worth fixing GHSA-rmvr-2pp2-xj38 @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25290). Fix: Update that package to its patched version.
• Worth fixing GHSA-xx4v-prfh-6cgc @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25289). Fix: Update that package to its patched version.
• Worth fixing GHSA-xx4v-prfh-6cgc @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-ab2557a5-f2d9-4440-8a02-445c1df9bbfb/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25289). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout