Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2024-51757 happy-dom allows for server side code to be executed by a <script> tagCVE-2025-61927 happy-dom: Happy-DOM VM Context EscapeCVE-2026-47429 When Vitest UI server is listening, arbitrary file can be read and executedCVE-2023-2972 antfu/utils vulnerable to prototype pollutionCVE-2024-4068 braces: fails to limit the number of characters it can handleCVE-2024-21538 cross-spawn: regular expression denial of serviceCVE-2026-35209 defu: Prototype pollution via `__proto__` key in defaults argumentGHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the responseCVE-2023-43646 get-func-name: ReDoS in chai moduleCVE-2026-34226 happy-dom: Happy DOM: Information disclosure via incorrect cookie handling in fetch requestsCVE-2025-64718 js-yaml: js-yaml prototype pollution in mergeCVE-2026-53550 js-yaml: js-yaml: Denial of Service via crafted YAML merge keysCVE-2026-48801 LinkifyIt#match scan loop has quadratic algorithmic complexityCVE-2026-2327 markdown-it: markdown-it: Denial of Service via Regular Expression Denial of Service in linkify functionCVE-2026-48988 markdown-it is a Markdown parser. Versions 14.1.1 and below contain a ...CVE-2024-4067 micromatch: vulnerable to Regular Expression Denial of ServiceCVE-2024-55565 nanoid: nanoid mishandles non-integer valuesCVE-2026-33671 picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patternsCVE-2026-33672 picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressionsCVE-2023-44270 PostCSS: Improper input validation in PostCSSCVE-2026-41305 postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tagsCVE-2024-53382 prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader pluginCVE-2024-47068 rollup: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSSCVE-2026-27606 rollup: Rollup: Remote Code Execution via Path Traversal VulnerabilityCVE-2022-25883 nodejs-semver: Regular expression denial of serviceYour dependencies cross-checked against the OSV vulnerability database.
GHSA-37j7-fg3j-429f Happy DOM: VM Context Escape can lead to Remote Code ExecutionGHSA-96g7-g7g9-jxw8 happy-dom allows for server side code to be executed by a <script> tagGHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op valuesGHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executedGHSA-p2fh-2h23-6grg antfu/utils vulnerable to prototype pollutionGHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` optionGHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustionGHSA-grv7-fg5c-xmjg Uncontrolled resource consumption in bracesGHSA-3xgq-45jj-v275 Regular Expression Denial of Service (ReDoS) in cross-spawnGHSA-3xgq-45jj-v275 Regular Expression Denial of Service (ReDoS) in cross-spawnGHSA-737v-mqg7-c878 defu: Prototype pollution via `__proto__` key in defaults argumentGHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the responseGHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the responseGHSA-25h7-pfq9-p65f flatted vulnerable to unbounded recursion DoS in parse() revive phaseGHSA-rf6f-7fwh-wjgh Prototype Pollution via parse() in NodeJS flattedGHSA-4q6p-r6v2-jvc5 Chaijs/get-func-name vulnerable to ReDoSGHSA-w4gp-fjgq-3q4g Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiesGHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesGHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<)GHSA-9c47-m6qq-7p4h Prototype Pollution in JSON5 via Parse MethodGHSA-22p9-wv53-3rq4 LinkifyIt#match scan loop has quadratic algorithmic complexityGHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key namesGHSA-xxjr-mmjv-4gpg Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functionsGHSA-38c4-r59v-3vqw markdown-it is has a Regular Expression Denial of Service (ReDoS)Code that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
scorecard-overall OpenSSF Scorecard overall: 3.0/10scorecard-CII-Best-Practices CII-Best-Practices scored 0: no effort to earn an OpenSSF best practices badge detectedscorecard-Code-Review Code-Review scored 0: Found 0/30 approved changesets -- score normalized to 0scorecard-Dependency-Update-Tool Dependency-Update-Tool scored 0: no update tool detectedscorecard-Fuzzing Fuzzing scored 0: project is not fuzzedscorecard-Maintained Maintained scored 0: 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0scorecard-Pinned-Dependencies Pinned-Dependencies scored 0: dependency not pinned by hash detected -- score normalized to 0scorecard-SAST SAST scored 0: no SAST tool detectedscorecard-Security-Policy Security-Policy scored 0: security policy file not detectedscorecard-Token-Permissions Token-Permissions scored 0: detected GitHub workflow tokens with excessive permissions