npm
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 60 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from March 8, 2021 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Poisoned WhatsApp API package steals messages and accounts
Shai-Hulud 2.0 NPM malware attack exposed up to 400,000 dev secrets
body-parser vulnerable to denial of service when url encoding is used
Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub
Shai-Hulud worm returns, belches secrets to 25K GitHub repos
Monitor npm in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.