npm
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 62 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
đź“… Data spans from March 8, 2021 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →uri-js through 4.4.1 Denial of Service via removeDotSegments
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Poisoned WhatsApp API package steals messages and accounts
Shai-Hulud 2.0 NPM malware attack exposed up to 400,000 dev secrets
body-parser vulnerable to denial of service when url encoding is used
Monitor npm in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.