eslint-plugin-security

Detect security patterns in Node.js with ESLint rules

eslint-community/eslint-plugin-security · Static Application Security Testing (SAST) › Language-specific › JavaScript/Node.js · scanned eslint-plugin-security-v4.2.1 (released 2026-10-30) · commit 7c5b9cd51a70 · last scan 2026-11-02

The scan method changed on 2026-11-02. npm development dependencies and npm-shrinkwrap.json are now scanned; matches on GitHub Actions referenced by a moving tag and on npm packages the repository defines itself are no longer counted; directories such as integration-tests and test-fixtures are excluded as fixtures. Most differences from the previous week below come from that change, not from the projects. Details.

Changes since last week

807 added; 77 new advisories.

Added (807)

@aashutoshrathi/word-wrap@1.2.6, @andrewbranch/untar.js@1.0.4, @arethetypeswrong/cli@0.18.5, @arethetypeswrong/core@0.18.5, @babel/code-frame@7.16.7, @babel/helper-validator-identifier@7.16.7, @babel/highlight@7.17.9, @braidai/lang@1.1.2, @colors/colors@1.5.0, @eslint-community/eslint-utils@4.4.0, @eslint-community/regexpp@4.9.1, @eslint/eslintrc@3.0.2, @eslint/js@9.0.0, @gar/promisify@1.1.3, @humanwhocodes/config-array@0.12.3, @humanwhocodes/module-importer@1.0.1, @humanwhocodes/object-schema@2.0.3, @isaacs/cliui@8.0.2, @isaacs/string-locale-compare@1.1.0, @jest/schemas@29.0.0, @loaderkit/resolve@1.0.6, @nodelib/fs.scandir@2.1.5, @nodelib/fs.stat@2.0.5, @nodelib/fs.walk@1.2.8, @npmcli/arborist@5.6.3, @npmcli/ci-detect@2.0.0, @npmcli/config@4.2.2, @npmcli/disparity-colors@2.0.0, @npmcli/fs@2.1.2, @npmcli/git@3.0.2, @npmcli/installed-package-contents@1.0.7, @npmcli/map-workspaces@2.0.4, @npmcli/metavuln-calculator@3.1.1, @npmcli/move-file@2.0.1, @npmcli/name-from-folder@1.0.1, @npmcli/node-gyp@2.0.0, @npmcli/package-json@2.0.0, @npmcli/promise-spawn@3.0.0, @npmcli/query@1.2.0, @npmcli/run-script@4.2.1, @octokit/auth-token@2.5.0, @octokit/core@3.6.0, @octokit/endpoint@6.0.12, @octokit/graphql@4.8.0, @octokit/openapi-types@11.2.0, @octokit/plugin-paginate-rest@2.17.0, @octokit/plugin-request-log@1.0.4, @octokit/plugin-rest-endpoint-methods@5.13.0, @octokit/request@5.6.3, @octokit/request-error@2.1.0, @octokit/rest@18.12.0, @octokit/types@6.34.0, @pkgjs/parseargs@0.11.0, @semantic-release/commit-analyzer@9.0.2, @semantic-release/error@2.2.0, @semantic-release/error@3.0.0, @semantic-release/github@8.0.4, @semantic-release/npm@9.0.1, @semantic-release/release-notes-generator@10.0.3, @sinclair/typebox@0.24.51, @sindresorhus/is@4.6.0, @tootallnate/once@2.0.0, @types/eslint@9.6.1, @types/estree@1.0.9, @types/json-schema@7.0.15, @types/minimist@1.2.2, @types/normalize-package-data@2.4.1, @types/parse-json@4.0.0, @types/retry@0.12.1, @types/semver@7.5.8, @typescript-eslint/scope-manager@5.62.0, @typescript-eslint/types@5.62.0, @typescript-eslint/typescript-estree@5.62.0, @typescript-eslint/utils@5.62.0, @typescript-eslint/visitor-keys@5.62.0, @typescript/typescript-aix-ppc64@7.0.2, @typescript/typescript-darwin-arm64@7.0.2, @typescript/typescript-darwin-x64@7.0.2, @typescript/typescript-freebsd-arm64@7.0.2, @typescript/typescript-freebsd-x64@7.0.2, @typescript/typescript-linux-arm@7.0.2, @typescript/typescript-linux-arm64@7.0.2, @typescript/typescript-linux-loong64@7.0.2, @typescript/typescript-linux-mips64el@7.0.2, @typescript/typescript-linux-ppc64@7.0.2, @typescript/typescript-linux-riscv64@7.0.2, @typescript/typescript-linux-s390x@7.0.2, @typescript/typescript-linux-x64@7.0.2, @typescript/typescript-netbsd-arm64@7.0.2, @typescript/typescript-netbsd-x64@7.0.2, @typescript/typescript-openbsd-arm64@7.0.2, @typescript/typescript-openbsd-x64@7.0.2, @typescript/typescript-sunos-x64@7.0.2, @typescript/typescript-win32-arm64@7.0.2, @typescript/typescript-win32-x64@7.0.2, abbrev@1.1.1, acorn@8.11.3, acorn-jsx@5.3.2, agent-base@6.0.2, agentkeepalive@4.2.1, aggregate-error@3.1.0, ajv@5.5.2, ajv@6.12.6, ajv@8.11.2, ansi-escapes@4.3.2, ansi-escapes@5.0.0, ansi-escapes@7.3.0, ansi-regex@5.0.1, ansi-regex@6.2.2, ansi-styles@3.2.1, ansi-styles@4.3.0, ansi-styles@5.2.0, ansi-styles@6.1.0, ansi-styles@6.2.3, ansicolors@0.3.2, any-promise@1.3.0, aproba@2.0.0, archy@1.0.0, are-we-there-yet@3.0.1, argparse@2.0.1, argv-formatter@1.0.0, array-ify@1.0.0, array-union@2.1.0, arrify@1.0.1, asap@2.0.6, asn1@0.2.6, assert-plus@1.0.0, astral-regex@2.0.0, asynckit@0.4.0, aws-sign2@0.7.0, aws4@1.13.0, balanced-match@1.0.0, balanced-match@1.0.2, bcrypt-pbkdf@1.0.2, before-after-hook@2.2.2, bin-links@3.0.3, binary-extensions@2.2.0, boolean@3.2.0, boom@4.3.1, boom@5.3.3, bottleneck@2.19.5, brace-expansion@1.1.11, brace-expansion@1.1.18, brace-expansion@2.0.1, brace-expansion@2.1.4, braces@3.0.3, browser-stdout@1.3.1, builtins@5.0.1, cacache@16.1.3, call-bind@1.0.2, callsites@3.1.0, camelcase@5.3.1, camelcase@6.3.0, camelcase-keys@6.2.2, cardinal@2.1.1, caseless@0.12.0, chalk@2.3.0, chalk@2.4.2, chalk@4.1.2, chalk@5.0.1, chalk@5.6.2, changelog@1.4.2, char-regex@1.0.2, chokidar@4.0.3, chownr@2.0.0, ci-info@1.6.0, cidr-regex@3.1.1, cjs-module-lexer@1.4.3, clean-stack@2.2.0, cli@1.0.1, cli-columns@4.0.0, cli-cursor@3.1.0, cli-highlight@2.1.11, cli-table3@0.6.2, cli-table3@0.6.5, cli-truncate@2.1.0, cli-truncate@3.1.0, cliui@7.0.4, cliui@8.0.1, clone@1.0.4, cmd-shim@5.0.0, co@4.6.0, color-convert@1.9.3, color-convert@2.0.1, color-name@1.1.3, color-name@1.1.4, color-support@1.1.3, colorette@2.0.16, columnify@1.6.0, combined-stream@1.0.8, commander@10.0.1, commander@8.3.0, commander@9.4.1, common-ancestor-path@1.0.1, compare-func@2.0.0, concat-map@0.0.1, console-control-strings@1.1.0, conventional-changelog-angular@5.0.13, conventional-changelog-writer@5.0.1, conventional-commits-filter@2.0.7, conventional-commits-parser@3.2.4, core-util-is@1.0.2, cosmiconfig@7.0.1, cosmiconfig@8.0.0, cross-spawn@5.1.0, cross-spawn@6.0.5, cross-spawn@7.0.6, cryptiles@3.2.1, crypto-random-string@2.0.0, cssesc@3.0.0, dashdash@1.14.1, dateformat@3.0.3, debug@4.3.4, debug@4.4.3, debuglog@1.0.1, decamelize@1.2.0, decamelize@4.0.0, decamelize-keys@1.1.0, deep-extend@0.6.0, deep-is@0.1.4, deepmerge@4.2.2, defaults@1.0.3, define-properties@1.1.4, del@6.0.0, delayed-stream@1.0.0, delegates@1.0.0, depd@1.1.2, deprecation@2.3.1, dezalgo@1.0.4, diff@5.1.0, diff@7.0.0, diff-sequences@29.3.1, dir-glob@3.0.1, dot-prop@5.3.0, dot-prop@7.2.0, duplexer2@0.1.4, eastasianwidth@0.2.0, ecc-jsbn@0.1.2, emoji-regex@8.0.0, emoji-regex@9.2.2, emojilib@2.4.0, encoding@0.1.13, entities@3.0.1, env-ci@5.5.0, env-paths@2.2.1, environment@1.1.0, err-code@2.0.3, error-ex@1.3.2, es-abstract@1.20.5, es-to-primitive@1.2.1, escalade@3.1.1, escape-string-regexp@1.0.5, escape-string-regexp@4.0.0, eslint@9.0.0, eslint-config-prettier@8.5.0, eslint-doc-generator@1.7.0, eslint-plugin-eslint-plugin@5.5.1, eslint-scope@5.1.1, eslint-scope@8.0.1, eslint-utils@3.0.0, eslint-visitor-keys@2.1.0, eslint-visitor-keys@3.4.3, eslint-visitor-keys@4.0.0, espree@10.0.1, esprima@4.0.1, esquery@1.5.0, esrecurse@4.3.0, estraverse@4.3.0, estraverse@5.3.0, esutils@2.0.3, execa@0.8.0, execa@5.1.1, exit@0.1.2, expect-type@1.4.0, extend@3.0.2, extsprintf@1.3.0, fast-deep-equal@1.1.0, fast-deep-equal@3.1.3, fast-glob@3.2.11, fast-json-stable-stringify@2.1.0, fast-levenshtein@2.0.6, fastest-levenshtein@1.0.12, fastq@1.13.0, fflate@0.8.3, figures@2.0.0, figures@3.2.0, file-entry-cache@8.0.0, fill-range@7.1.1, find-up@2.1.0, find-up@4.1.0, find-up@5.0.0, find-versions@4.0.0, flat@5.0.2, flat-cache@4.0.1, flatted@3.4.2, foreground-child@3.3.1, forever-agent@0.6.1, form-data@2.3.3, from2@2.3.0, fromentries@1.3.2, fs-extra@10.1.0, fs-minipass@2.1.0, fs.realpath@1.0.0, function-bind@1.1.1, function.prototype.name@1.1.5, functions-have-names@1.2.3, gauge@4.0.4, get-caller-file@2.0.5, get-intrinsic@1.1.3, get-stdin@9.0.0, get-stream@3.0.0, get-stream@6.0.1, get-symbol-description@1.0.0, getpass@0.1.7, git-log-parser@1.2.0, github-url-from-git@1.5.0, glob@10.5.0, glob@7.2.0, glob@7.2.3, glob@8.0.3, glob-parent@5.1.2, glob-parent@6.0.2, globals@14.0.0, globby@11.1.0, gopd@1.0.1, graceful-fs@4.2.10, graphemer@1.4.0, handlebars@4.7.9, har-schema@2.0.0, har-validator@5.0.3, hard-rejection@2.1.0, has@1.0.3, has-bigints@1.0.2, has-color@0.1.7, has-flag@2.0.0, has-flag@3.0.0, has-flag@4.0.0, has-property-descriptors@1.0.0, has-symbols@1.0.3, has-tostringtag@1.0.0, has-unicode@2.0.1, hawk@6.0.2, he@1.2.0, highlight.js@10.7.3, hoek@4.3.1, hook-std@2.0.0, hosted-git-info@2.8.9, hosted-git-info@4.1.0, hosted-git-info@5.2.1, http-cache-semantics@4.1.1, http-proxy-agent@5.0.0, http-signature@1.2.0, https-proxy-agent@5.0.1, human-signals@2.1.0, humanize-ms@1.2.1, iconv-lite@0.6.3, ignore@5.2.0, ignore-walk@5.0.1, import-fresh@3.3.0, import-from@4.0.0, imurmurhash@0.1.4, indent-string@4.0.0, infer-owner@1.0.4, inflight@1.0.6, inherits@2.0.3, inherits@2.0.4, ini@1.3.8, ini@3.0.1, init-package-json@3.0.2, internal-slot@1.0.3, into-stream@6.0.0, ip@2.0.0, ip-regex@4.3.0, is-arrayish@0.2.1, is-bigint@1.0.4, is-boolean-object@1.1.2, is-callable@1.2.7, is-ci@1.2.1, is-cidr@4.0.2, is-core-module@2.10.0, is-core-module@2.8.1, is-date-object@1.0.5, is-extglob@2.1.1, is-fullwidth-code-point@3.0.0, is-fullwidth-code-point@4.0.0, is-glob@4.0.3, is-lambda@1.0.1, is-negative-zero@2.0.2, is-number@7.0.0, is-number-object@1.0.7, is-obj@2.0.0, is-path-cwd@2.2.0, is-path-inside@3.0.3, is-plain-obj@1.1.0, is-plain-obj@2.1.0, is-plain-object@5.0.0, is-regex@1.1.4, is-shared-array-buffer@1.0.2, is-stream@1.1.0, is-stream@2.0.1, is-string@1.0.7, is-symbol@1.0.4, is-text-path@1.0.1, is-typedarray@1.0.0, is-unicode-supported@0.1.0, is-weakref@1.0.2, isarray@1.0.0, isexe@2.0.0, isstream@0.1.2, issue-parser@6.0.0, jackspeak@3.4.3, java-properties@1.0.2, jest-diff@29.3.1, jest-get-type@29.2.0, js-tokens@4.0.0, js-yaml@4.3.2, jsbn@0.1.1, json-buffer@3.0.1, json-parse-better-errors@1.0.2, json-parse-even-better-errors@2.3.1, json-schema@0.4.0, json-schema-traverse@0.3.1, json-schema-traverse@0.4.1, json-schema-traverse@1.0.0, json-stable-stringify-without-jsonify@1.0.1, json-stringify-nice@1.1.4, json-stringify-safe@5.0.1, jsonc-parser@3.1.0, jsonfile@6.1.0, jsonparse@1.3.1, JSONStream@1.3.5, jsprim@1.4.2, just-diff@5.1.1, just-diff-apply@5.4.1, keyv@4.5.4, kind-of@6.0.3, levn@0.4.1, libnpmaccess@6.0.4, libnpmdiff@4.0.5, libnpmexec@4.0.14, libnpmfund@3.0.5, libnpmhook@8.0.4, libnpmorg@4.0.4, libnpmpack@4.1.3, libnpmpublish@6.0.5, libnpmsearch@5.0.4, libnpmteam@4.0.4, libnpmversion@3.0.7, lilconfig@2.0.4, lines-and-columns@1.2.4, linkify-it@4.0.1, lint-staged@12.3.7, listr2@4.0.5, load-json-file@4.0.0, locate-path@2.0.0, locate-path@5.0.0, locate-path@6.0.0, lodash@4.17.21, lodash@4.17.5, lodash.capitalize@4.2.1, lodash.escaperegexp@4.1.2, lodash.ismatch@4.4.0, lodash.isplainobject@4.0.6, lodash.isstring@4.0.1, lodash.merge@4.6.2, lodash.uniqby@4.7.0, log-symbols@4.1.0, log-update@4.0.0, lower-case@2.0.2, lru-cache@10.4.3, lru-cache@11.5.2, lru-cache@4.1.5, lru-cache@6.0.0, lru-cache@7.13.2, make-fetch-happen@10.2.1, map-obj@1.0.1, map-obj@4.3.0, markdown-it@13.0.1, markdown-table@3.0.3, markdownlint@0.26.2, markdownlint-cli@0.32.2, markdownlint-rule-helpers@0.17.2, marked@4.0.14, marked@9.1.6, marked-terminal@5.1.1, marked-terminal@7.3.0, mdurl@1.0.1, memorystream@0.3.1, meow@8.1.2, merge-stream@2.0.0, merge2@1.4.1, micromatch@4.0.5, mime@3.0.0, mime-db@1.52.0, mime-types@2.1.35, mimic-fn@2.1.0, min-indent@1.0.1, minimatch@3.1.2, minimatch@3.1.5, minimatch@5.1.0, minimatch@5.1.9, minimatch@9.0.9, minimist@1.2.6, minimist-options@4.1.0, minipass@3.3.4, minipass@7.1.2, minipass-collect@1.0.2, minipass-fetch@2.1.1, minipass-flush@1.0.5, minipass-json-stream@1.0.1, minipass-pipeline@1.2.4, minipass-sized@1.0.3, minizlib@2.1.2, mkdirp@1.0.4, mkdirp-infer-owner@2.0.0, mocha@11.7.5, modify-values@1.0.1, moment@2.20.1, ms@2.1.2, ms@2.1.3, mute-stream@0.0.8, mz@2.7.0, natural-compare@1.4.0, negotiator@0.6.3, neo-async@2.6.2, nerf-dart@1.0.0, nice-try@1.0.5, no-case@3.0.4, node-emoji@1.11.0, node-emoji@2.2.0, node-fetch@2.6.7, node-gyp@9.1.0, nopt@5.0.0, nopt@6.0.0, normalize-package-data@2.5.0, normalize-package-data@3.0.3, normalize-package-data@4.0.1, normalize-path@1.0.0, normalize-path@3.0.0, normalize-url@6.1.0, npm@8.19.4, npm-audit-report@3.0.0, npm-bundled@1.1.2, npm-bundled@2.0.1, npm-install-checks@5.0.0, npm-normalize-package-bin@1.0.1, npm-normalize-package-bin@2.0.0, npm-package-arg@9.1.0, npm-packlist@5.1.3, npm-pick-manifest@7.0.2, npm-profile@6.2.1, npm-registry-fetch@13.3.1, npm-run-all@4.1.5, npm-run-path@2.0.2, npm-run-path@4.0.1, npm-user-validate@1.0.1, npmlog@6.0.2, oauth-sign@0.8.2, object-assign@4.1.1, object-inspect@1.12.2, object-keys@1.1.1, object.assign@4.1.4, once@1.4.0, onetime@5.1.2, opener@1.5.2, optionator@0.9.3, p-each-series@2.2.0, p-filter@2.1.0, p-finally@1.0.0, p-is-promise@3.0.0, p-limit@1.3.0, p-limit@2.3.0, p-limit@3.1.0, p-locate@2.0.0, p-locate@4.1.0, p-locate@5.0.0, p-map@2.1.0, p-map@4.0.0, p-reduce@2.1.0, p-retry@4.6.1, p-try@1.0.0, p-try@2.2.0, package-json-from-dist@1.0.1, pacote@13.6.2, parent-module@1.0.1, parse-conflict-json@2.0.2, parse-json@4.0.0, parse-json@5.2.0, parse5@5.1.1, parse5@6.0.1, parse5-htmlparser2-tree-adapter@6.0.1, path-exists@3.0.0, path-exists@4.0.0, path-is-absolute@1.0.1, path-key@2.0.1, path-key@3.1.1, path-parse@1.0.7, path-scurry@1.11.1, path-type@3.0.0, path-type@4.0.0, performance-now@2.1.0, picocolors@1.1.1, picomatch@2.3.2, pidtree@0.3.1, pidtree@0.5.0, pify@3.0.0, pkg-conf@2.1.0, postcss-selector-parser@6.0.10, prelude-ls@1.2.1, prettier@3.9.9, pretty-format@29.3.1, proc-log@2.0.1, process-nextick-args@2.0.1, promise-all-reject-late@1.0.1, promise-call-limit@1.0.1, promise-inflight@1.0.1, promise-retry@2.0.1, promzard@0.3.0, pseudomap@1.0.2, punycode@1.4.1, punycode@2.1.1, q@1.5.1, qrcode-terminal@0.12.0, qs@6.5.3, queue-microtask@1.2.3, quick-lru@4.0.1, randombytes@2.1.0, rc@1.2.8, react-is@18.2.0, read@1.0.7, read-cmd-shim@3.0.0, read-package-json@5.0.2, read-package-json-fast@2.0.3, read-pkg@3.0.0, read-pkg@5.2.0, read-pkg-up@7.0.1, readable-stream@2.3.7, readable-stream@3.6.0, readdir-scoped-modules@1.1.0, readdirp@4.1.2, redent@3.0.0, redeyed@2.1.1, regexp.prototype.flags@1.4.3, registry-auth-token@4.2.1, request@2.83.0, require-directory@2.1.1, require-from-string@2.0.2, resolve@1.22.0, resolve-from@4.0.0, resolve-from@5.0.0, restore-cursor@3.1.0, retry@0.12.0, retry@0.13.1, reusify@1.0.4, rfdc@1.3.0, rimraf@3.0.2, run-con@1.2.11, run-parallel@1.2.0, rxjs@7.5.5, safe-buffer@5.1.2, safe-buffer@5.2.1, safe-regex-test@1.0.0, safer-buffer@2.1.2, semantic-release@19.0.3, semver@5.5.0, semver@5.7.1, semver@6.3.0, semver@7.3.7, semver@7.6.0, semver@7.8.5, semver-diff@3.1.1, semver-regex@3.1.3, serialize-javascript@6.0.2, set-blocking@2.0.0, shebang-command@1.2.0, shebang-command@2.0.0, shebang-regex@1.0.0, shebang-regex@3.0.0, shell-quote@1.10.0, side-channel@1.0.4, signal-exit@3.0.7, signal-exit@4.1.0, signale@1.4.0, skin-tone@2.0.0, slash@3.0.0, slice-ansi@3.0.0, slice-ansi@4.0.0, slice-ansi@5.0.0, smart-buffer@4.2.0, sntp@2.1.0, socks@2.7.0, socks-proxy-agent@7.0.0, source-map@0.6.1, spawn-error-forwarder@1.0.0, spdx-correct@3.1.1, spdx-exceptions@2.3.0, spdx-expression-parse@3.0.1, spdx-license-ids@3.0.11, split@1.0.1, split2@1.0.0, split2@3.2.2, sshpk@1.18.0, ssri@9.0.1, stream-combiner2@1.1.1, string-argv@0.3.1, string-width@4.2.3, string-width@5.1.2, string.prototype.padend@3.1.4, string.prototype.trimend@1.0.6, string.prototype.trimstart@1.0.6, string_decoder@1.1.1, string_decoder@1.3.0, stringstream@0.0.6, strip-ansi@6.0.1, strip-ansi@7.1.2, strip-bom@3.0.0, strip-eof@1.0.0, strip-final-newline@2.0.0, strip-indent@2.0.0, strip-indent@3.0.0, strip-json-comments@2.0.1, strip-json-comments@3.1.1, supports-color@4.5.0, supports-color@5.5.0, supports-color@7.2.0, supports-color@8.1.1, supports-color@9.2.1, supports-hyperlinks@2.2.0, supports-hyperlinks@3.2.0, supports-preserve-symlinks-flag@1.0.0, tar@6.1.11, temp-dir@2.0.0, tempy@1.0.1, text-extensions@1.9.0, text-table@0.2.0, thenify@3.3.1, thenify-all@1.6.0, through@2.3.8, through2@2.0.5, through2@4.0.2, tiny-relative-date@1.3.0, to-regex-range@5.0.1, tough-cookie@2.3.4, tr46@0.0.3, traverse@0.6.6, treeverse@2.0.0, trim-newlines@3.0.1, tslib@1.14.1, tslib@2.3.1, tsutils@3.21.0, tunnel-agent@0.6.0, tweetnacl@0.14.5, type-check@0.4.0, type-fest@0.16.0, type-fest@0.18.1, type-fest@0.21.3, type-fest@0.6.0, type-fest@0.8.1, type-fest@1.4.0, type-fest@2.19.0, type-fest@3.3.0, typescript@5.6.1-rc, typescript@7.0.2, uc.micro@1.0.6, uglify-js@3.15.4, unbox-primitive@1.0.2, unicode-emoji-modifier-base@1.0.0, unique-filename@2.0.1, unique-slug@3.0.0, unique-string@2.0.0, universal-user-agent@6.0.0, universalify@2.0.0, uri-js@4.4.1, url-join@4.0.1, util-deprecate@1.0.2, uuid@3.4.0, validate-npm-package-license@3.0.4, validate-npm-package-name@4.0.0, validate-npm-package-name@5.0.1, verror@1.10.0, walk-up-path@1.0.0, wcwidth@1.0.1, webidl-conversions@3.0.1, whatwg-url@5.0.0, which@1.3.1, which@2.0.2, which-boxed-primitive@1.0.2, wide-align@1.1.5, wordwrap@1.0.0, workerpool@9.3.4, wrap-ansi@6.2.0, wrap-ansi@7.0.0, wrap-ansi@8.1.0, wrappy@1.0.2, write-file-atomic@4.0.2, xtend@4.0.1, y18n@5.0.8, yallist@2.1.2, yallist@4.0.0, yaml@1.10.2, yargs@16.2.0, yargs@17.7.2, yargs-parser@20.2.4, yargs-parser@21.1.1, yargs-unparser@2.0.0, yocto-queue@0.1.0, yorkie@2.0.0

New advisories (77)

• H GHSA-22p9-wv53-3rq4 in linkify-it@4.0.1
• H GHSA-23c5-xmqv-rm74 in minimatch@5.1.0
• C GHSA-23hp-3jrh-7fpw in tar@6.1.11
• M GHSA-253c-mchw-3w2r in markdown-it@13.0.1
• M GHSA-29mw-wpgm-hmr9 in lodash@4.17.5
• M GHSA-2g4f-4pwh-qvx6 in ajv@8.11.2
• H GHSA-2p57-rm9w-gvfp in ip@2.0.0
• H GHSA-34x7-hfp2-rc4v in tar@6.1.11
• H GHSA-35jh-r3h4-6jhm in lodash@4.17.5
• M GHSA-38c4-r59v-3vqw in markdown-it@13.0.1
• M GHSA-3g3m-2fjr-6pw4 in glob@10.5.0
• H GHSA-3jxr-9vmj-r5cp in brace-expansion@2.0.1
• H GHSA-3ppc-4f35-3m26 in minimatch@5.1.0
• H GHSA-3xgq-45jj-v275 in cross-spawn@6.0.5
• H GHSA-44pw-h2cw-w3vq in hawk@6.0.2
• M GHSA-48c2-rrv3-qjmp in yaml@1.10.2
• M GHSA-4mjr-xmp4-gh2g in qs@6.5.3
• L GHSA-4x5v-gmq8-25ch in semver-regex@3.1.3
• H GHSA-4xc9-xhrj-v574 in lodash@4.17.5
• H GHSA-5c6j-r48x-rmvq in serialize-javascript@6.0.2
• H GHSA-6j4f-fj2g-mc7p in brace-expansion@2.1.4
• M GHSA-6rw7-vpxm-498p in qs@6.5.3
• M GHSA-6v5v-wf23-fmfq in markdown-it@13.0.1
• M GHSA-72xf-g2v4-qvf3 in tough-cookie@2.3.4
• L GHSA-73rr-hh4g-fpgx in diff@7.0.0
• L GHSA-78xj-cgh5-2h22 in ip@2.0.0
• H GHSA-7r86-cg39-jmmj in minimatch@5.1.0
• H GHSA-83g3-92jg-28cx in tar@6.1.11
• H GHSA-8hfj-j24r-96c4 in moment@2.20.1
• H GHSA-8qq5-rm4j-mr97 in tar@6.1.11
• C GHSA-8r5x-fm3f-whwj in handlebars@4.7.9
• H GHSA-8x88-c5mf-7j5w in tar@6.1.11
• M GHSA-952p-6rrq-rcjv in micromatch@4.0.5
• H GHSA-9ppj-qmqm-q256 in tar@6.1.11
• H GHSA-c2qf-rxjj-qqgw in semver@7.3.7
• H GHSA-c429-5p7v-vgjp in hoek@4.3.1
• M GHSA-f23m-r3pf-42rh in lodash@4.17.5
• M GHSA-f5x3-32g6-xq36 in tar@6.1.11
• M GHSA-f886-m6hf-6m8v in brace-expansion@2.0.1
• C GHSA-fjxv-7rqg-78g4 in form-data@2.3.3
• M GHSA-g3hv-75wg-m249 in minimatch@9.0.9
• L GHSA-gcqx-w48m-w2h4 in deepmerge@4.2.2
• M GHSA-gvwx-54wh-qm9j in tar@6.1.11
• M GHSA-h5c3-5r3r-rr8q in @octokit/plugin-paginate-rest@2.17.0
• H GHSA-hmw2-7cc7-3qxx in form-data@2.3.3
• C GHSA-jf85-cpcp-j695 in lodash@4.17.5
• L GHSA-m5mm-p8h7-m29v in serialize-javascript@6.0.2
• H GHSA-mh99-v99m-4gvg in brace-expansion@2.0.1
• H GHSA-p6mc-m468-83gw in lodash@4.17.5
• M GHSA-p8p7-x288-28g6 in request@2.83.0
• C GHSA-p8wg-vrv2-v86f in handlebars@4.7.9
• C GHSA-pqg4-j6r4-53mv in shell-quote@1.10.0
• M GHSA-q2hr-2g5m-vwhr in brace-expansion@2.1.4
• H GHSA-qffp-2rhf-9h96 in tar@6.1.11
• H GHSA-qhr7-859c-m2p7 in brace-expansion@2.1.4
• M GHSA-qj8w-gfj5-8c6v in serialize-javascript@6.0.2
• H GHSA-r292-9mhp-454m in tar@6.1.11
• H GHSA-r5fr-rjxr-66jc in lodash@4.17.5
• H GHSA-r6q2-hw4h-h46w in tar@6.1.11
• H GHSA-r7fv-28h4-cvq7 in markdown-it@13.0.1
• H GHSA-rgw5-rvv9-x895 in brace-expansion@2.0.1
• M GHSA-rj75-hqrm-r3gf in postcss-selector-parser@6.0.10
• M GHSA-rmvr-2pp2-xj38 in @octokit/request@5.6.3
• H GHSA-v245-v573-v5vm in linkify-it@4.0.1
• L GHSA-v6h2-p8h4-qcjw in brace-expansion@2.0.1
• M GHSA-v88g-cgmw-v5xw in ajv@5.5.2
• L GHSA-vfgh-jcmw-g37q in markdown-it@13.0.1
• M GHSA-vmf3-w455-68vh in tar@6.1.11
• L GHSA-vpq2-c234-7xj6 in @tootallnate/once@2.0.0
• H GHSA-w4pp-8pjf-rmxw in pacote@13.6.2
• M GHSA-w5hq-g745-h8pq in uuid@3.4.0
• M GHSA-w8wr-v893-vjvp in tar@6.1.11
• H GHSA-wc69-rhjr-hc9g in moment@2.20.1
• M GHSA-x5rq-j2xg-h7qm in lodash@4.17.5
• M GHSA-xw65-4hp5-5hc7 in handlebars@4.7.9
• M GHSA-xx4v-prfh-6cgc in @octokit/request-error@2.1.0
• M GHSA-xxjr-mmjv-4gpg in lodash@4.17.5

Known vulnerabilities (108)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Second opinion: OSV-Scanner

OSV-Scanner found 66 advisories in the same files; 75 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.

Release integrity

Verdict: no release files.

• Checksums file: no
• Signatures: no
• SLSA provenance: no
• SBOM published with the release: no

Verified means a signature, provenance, or attestation was checked against an identity in eslint-community/eslint-plugin-security's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

No Scorecard result yet (the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used). Results are added as the weekly budget allows.

GitHub Actions workflow audit (zizmor)

10 potential issues in 3 workflow files at this release: 9 high, 0 medium, 1 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

Dependencies (814)

By ecosystem: npm 810, github 4.

Licenses (as declared in the SBOM): unknown 550, MIT 113, ISC 113, Apache-2.0 26, BSD-2-Clause 6, BSD-3-Clause 2, BlueOak-1.0.0 1, WTFPL OR MIT 1, CC-BY-3.0 1, CC0-1.0 1.