transloadit/uppy

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/transloadit/main.js:13
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/transloadit/main.js:13
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/transloadit/gr.js:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  examples/transloadit/main.js:13
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/@uppy/companion/test/providers.test.js:252
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/@uppy/companion/test/providers.test.js:440
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/@uppy/companion/test/providers.test.js:569
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-25896 fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
• Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-27qh-8cxx-2cr5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (GHSA-27qh-8cxx-2cr5). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55568 Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain c ...
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-55568). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55767 Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar in ...
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-55767). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-59883 guzzle/guzzle: Guzzle: Cross-host cookie disclosure and injection due to improper domain matching in CookieJar.
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-59883). Fix: Update that package to its patched version.
• Worth fixing GHSA-94pj-82f3-465w Guzzle: Proxy-Authorization headers can be sent to origin servers
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (GHSA-94pj-82f3-465w). Fix: Update that package to its patched version.
• Worth fixing GHSA-f283-ghqc-fg79 Guzzle: Unbounded response cookies risk denial of service
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (GHSA-f283-ghqc-fg79). Fix: Update that package to its patched version.
• Worth fixing GHSA-h95v-h523-3mw8 Guzzle: URI fragments disclosed in redirect Referer headers
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (GHSA-h95v-h523-3mw8). Fix: Update that package to its patched version.
• Worth fixing GHSA-wm3w-8rrp-j577 Guzzle: Host-only cookie scope is not preserved
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (GHSA-wm3w-8rrp-j577). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48998 guzzlehttp/psr7: guzzlehttp/psr7: Information disclosure via improper Host header validation
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-48998). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-49214 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-49214). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55766 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-55766). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-59882 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
  examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-59882). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50170 @angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-50170). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50171 @angular/common: Angular @angular/common: Denial of Service via malformed digitsInfo parameter
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-50171). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54266 @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-54266). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54268 @angular/common: Angular @angular/common: Denial of Service via crafted date format string
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-54268). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-32635 @angular/core: @angular/compiler: Angular has XSS in i18n attribute bindings
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-32635). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50557 @angular/compiler: @angular/core: Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-50557). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54265 @angular/compiler: Angular: Two-Way Property Binding Sanitization Bypass (XSS)
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-54265). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-g93w-mfhg-p222 Angular vulnerable to XSS in i18n attribute bindings
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-32635). Fix: Update that package to its patched version.
• Serious GHSA-g93w-mfhg-p222 Angular vulnerable to XSS in i18n attribute bindings
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-32635). Fix: Update that package to its patched version.
• Serious GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
• Serious GHSA-wf6x-7x77-mvgw Immutable is vulnerable to Prototype Pollution
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-29063). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-3qcw-2rhx-2726 Turbo: Unexpected local code execution during Yarn Berry detection
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-45772). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-27qh-8cxx-2cr5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-94pj-82f3-465w Guzzle: Proxy-Authorization headers can be sent to origin servers
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-cwxw-98qj-8qjx guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-55767). Fix: Update that package to its patched version.
• Worth fixing GHSA-f283-ghqc-fg79 Guzzle: Unbounded response cookies risk denial of service
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-g446-98w2-8p5w Guzzle: Cookie Disclosure and Injection via IP-Address Domains
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-59883). Fix: Update that package to its patched version.
• Worth fixing GHSA-h95v-h523-3mw8 Guzzle: URI fragments disclosed in redirect Referer headers
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-wm3w-8rrp-j577 Guzzle: Host-only cookie scope is not preserved
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-wpwq-4j6v-78m3 guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-55568). Fix: Update that package to its patched version.
• Worth fixing GHSA-34xg-wgjx-8xph guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-48998). Fix: Update that package to its patched version.
• Worth fixing GHSA-c2w2-prh8-qm98 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-59882). Fix: Update that package to its patched version.
• Worth fixing GHSA-hq7v-mx3g-29hw guzzlehttp/psr7 has CRLF Injection via URI Host Component
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-49214). Fix: Update that package to its patched version.
• Worth fixing GHSA-vm85-hxw5-5432 guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/examples/aws-php/composer.lock
  A package you depend on has a known security hole (CVE-2026-55766). Fix: Update that package to its patched version.
• Worth fixing GHSA-39pv-4j6c-2g6v @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-54266). Fix: Update that package to its patched version.
• Worth fixing GHSA-48r7-hpm6-gfxm @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-54268). Fix: Update that package to its patched version.
• Worth fixing GHSA-p3vc-36g9-x9gr @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
  /workdirs/scan-6459402f-a704-4a46-9aa6-da86da1f7792/yarn.lock
  A package you depend on has a known security hole (CVE-2026-50171). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout