cloudsplaining

Assess AWS IAM policies for risky permissions

salesforce/cloudsplaining · Cloud Security · scanned 0.9.1 (released 2026-06-14) · commit 75a67ea9cb6d · last scan 2026-11-02

The scan method changed on 2026-11-02. npm development dependencies and npm-shrinkwrap.json are now scanned; matches on GitHub Actions referenced by a moving tag and on npm packages the repository defines itself are no longer counted; directories such as integration-tests and test-fixtures are excluded as fixtures. Most differences from the previous week below come from that change, not from the projects. Details.

Changes since last week

842 added; 95 new advisories; 1 resolved.

Added (842)

@achrinza/node-ipc@9.2.10, @babel/code-frame@7.29.0, @babel/compat-data@7.29.0, @babel/core@7.29.0, @babel/eslint-parser@7.28.6, @babel/helper-annotate-as-pure@7.27.3, @babel/helper-compilation-targets@7.28.6, @babel/helper-create-class-features-plugin@7.28.6, @babel/helper-create-regexp-features-plugin@7.28.5, @babel/helper-define-polyfill-provider@0.6.6, @babel/helper-globals@7.28.0, @babel/helper-member-expression-to-functions@7.28.5, @babel/helper-module-imports@7.28.6, @babel/helper-module-transforms@7.28.6, @babel/helper-optimise-call-expression@7.27.1, @babel/helper-plugin-utils@7.28.6, @babel/helper-remap-async-to-generator@7.27.1, @babel/helper-replace-supers@7.28.6, @babel/helper-skip-transparent-expression-wrappers@7.27.1, @babel/helper-validator-option@7.27.1, @babel/helper-wrap-function@7.28.6, @babel/helpers@7.28.6, @babel/plugin-bugfix-firefox-class-in-computed-class-key@7.28.5, @babel/plugin-bugfix-safari-class-field-initializer-scope@7.27.1, @babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.27.1, @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.27.1, @babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@7.28.6, @babel/plugin-proposal-class-properties@7.18.6, @babel/plugin-proposal-decorators@7.29.0, @babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2, @babel/plugin-syntax-decorators@7.28.6, @babel/plugin-syntax-dynamic-import@7.8.3, @babel/plugin-syntax-import-assertions@7.28.6, @babel/plugin-syntax-import-attributes@7.28.6, @babel/plugin-syntax-jsx@7.28.6, @babel/plugin-syntax-unicode-sets-regex@7.18.6, @babel/plugin-transform-arrow-functions@7.27.1, @babel/plugin-transform-async-generator-functions@7.29.0, @babel/plugin-transform-async-to-generator@7.28.6, @babel/plugin-transform-block-scoped-functions@7.27.1, @babel/plugin-transform-block-scoping@7.28.6, @babel/plugin-transform-class-properties@7.28.6, @babel/plugin-transform-class-static-block@7.28.6, @babel/plugin-transform-classes@7.28.6, @babel/plugin-transform-computed-properties@7.28.6, @babel/plugin-transform-destructuring@7.28.5, @babel/plugin-transform-dotall-regex@7.28.6, @babel/plugin-transform-duplicate-keys@7.27.1, @babel/plugin-transform-duplicate-named-capturing-groups-regex@7.29.0, @babel/plugin-transform-dynamic-import@7.27.1, @babel/plugin-transform-explicit-resource-management@7.28.6, @babel/plugin-transform-exponentiation-operator@7.28.6, @babel/plugin-transform-export-namespace-from@7.27.1, @babel/plugin-transform-for-of@7.27.1, @babel/plugin-transform-function-name@7.27.1, @babel/plugin-transform-json-strings@7.28.6, @babel/plugin-transform-literals@7.27.1, @babel/plugin-transform-logical-assignment-operators@7.28.6, @babel/plugin-transform-member-expression-literals@7.27.1, @babel/plugin-transform-modules-amd@7.27.1, @babel/plugin-transform-modules-commonjs@7.28.6, @babel/plugin-transform-modules-systemjs@7.29.4, @babel/plugin-transform-modules-umd@7.27.1, @babel/plugin-transform-named-capturing-groups-regex@7.29.0, @babel/plugin-transform-new-target@7.27.1, @babel/plugin-transform-nullish-coalescing-operator@7.28.6, @babel/plugin-transform-numeric-separator@7.28.6, @babel/plugin-transform-object-rest-spread@7.28.6, @babel/plugin-transform-object-super@7.27.1, @babel/plugin-transform-optional-catch-binding@7.28.6, @babel/plugin-transform-optional-chaining@7.28.6, @babel/plugin-transform-parameters@7.27.7, @babel/plugin-transform-private-methods@7.28.6, @babel/plugin-transform-private-property-in-object@7.28.6, @babel/plugin-transform-property-literals@7.27.1, @babel/plugin-transform-regenerator@7.29.0, @babel/plugin-transform-regexp-modifiers@7.28.6, @babel/plugin-transform-reserved-words@7.27.1, @babel/plugin-transform-runtime@7.29.0, @babel/plugin-transform-shorthand-properties@7.27.1, @babel/plugin-transform-spread@7.28.6, @babel/plugin-transform-sticky-regex@7.27.1, @babel/plugin-transform-template-literals@7.27.1, @babel/plugin-transform-typeof-symbol@7.27.1, @babel/plugin-transform-unicode-escapes@7.27.1, @babel/plugin-transform-unicode-property-regex@7.28.6, @babel/plugin-transform-unicode-regex@7.27.1, @babel/plugin-transform-unicode-sets-regex@7.28.6, @babel/preset-env@7.29.0, @babel/preset-modules@0.1.6-no-external-plugins, @babel/runtime@7.28.6, @babel/template@7.28.6, @babel/traverse@7.29.0, @discoveryjs/json-ext@0.5.7, @eslint-community/eslint-utils@4.9.1, @eslint-community/regexpp@4.12.2, @eslint/eslintrc@2.1.4, @eslint/js@8.57.1, @hapi/hoek@9.3.0, @hapi/topo@5.1.0, @humanwhocodes/config-array@0.13.0, @humanwhocodes/module-importer@1.0.1, @humanwhocodes/object-schema@2.0.3, @isaacs/cliui@8.0.2, @jridgewell/source-map@0.3.11, @leichtgewicht/ip-codec@2.0.5, @nicolo-ribaudo/eslint-scope-5-internals@5.1.1-v1, @node-ipc/js-queue@2.0.3, @nodelib/fs.scandir@2.1.5, @nodelib/fs.stat@2.0.5, @nodelib/fs.walk@1.2.8, @pkgjs/parseargs@0.11.0, @polka/url@1.0.0-next.29, @sideway/address@4.1.5, @sideway/formula@3.0.1, @sideway/pinpoint@2.0.0, @soda/friendly-errors-webpack-plugin@1.8.1, @soda/get-current-script@1.0.2, @types/body-parser@1.19.6, @types/bonjour@3.5.13, @types/connect@3.4.38, @types/connect-history-api-fallback@1.5.4, @types/eslint@8.56.12, @types/eslint-scope@3.7.7, @types/estree@1.0.8, @types/express@4.17.25, @types/express-serve-static-core@4.19.8, @types/express-serve-static-core@5.1.1, @types/html-minifier-terser@6.1.0, @types/http-errors@2.0.5, @types/http-proxy@1.17.17, @types/json-schema@7.0.15, @types/mime@1.3.5, @types/minimist@1.2.5, @types/node@25.3.2, @types/node-forge@1.3.14, @types/normalize-package-data@2.4.4, @types/parse-json@4.0.2, @types/qs@6.14.0, @types/range-parser@1.2.7, @types/retry@0.12.0, @types/send@0.17.6, @types/send@1.2.1, @types/serve-index@1.9.4, @types/serve-static@1.15.10, @types/sockjs@0.3.36, @types/ws@8.18.1, @ungap/structured-clone@1.3.0, @vue/babel-helper-vue-jsx-merge-props@1.4.0, @vue/babel-helper-vue-transform-on@1.5.0, @vue/babel-plugin-jsx@1.5.0, @vue/babel-plugin-resolve-type@1.5.0, @vue/babel-plugin-transform-vue-jsx@1.4.0, @vue/babel-preset-app@5.0.9, @vue/babel-preset-jsx@1.4.0, @vue/babel-sugar-composition-api-inject-h@1.4.0, @vue/babel-sugar-composition-api-render-instance@1.4.0, @vue/babel-sugar-functional-vue@1.4.0, @vue/babel-sugar-inject-h@1.4.0, @vue/babel-sugar-v-model@1.4.0, @vue/babel-sugar-v-on@1.4.0, @vue/cli-overlay@5.0.9, @vue/cli-plugin-babel@5.0.9, @vue/cli-plugin-eslint@5.0.9, @vue/cli-plugin-router@5.0.9, @vue/cli-plugin-vuex@5.0.9, @vue/cli-service@5.0.9, @vue/cli-shared-utils@5.0.9, @vue/component-compiler-utils@3.3.0, @vue/web-component-wrapper@1.3.0, @webassemblyjs/ast@1.14.1, @webassemblyjs/floating-point-hex-parser@1.13.2, @webassemblyjs/helper-api-error@1.13.2, @webassemblyjs/helper-buffer@1.14.1, @webassemblyjs/helper-numbers@1.13.2, @webassemblyjs/helper-wasm-bytecode@1.13.2, @webassemblyjs/helper-wasm-section@1.14.1, @webassemblyjs/ieee754@1.13.2, @webassemblyjs/leb128@1.13.2, @webassemblyjs/utf8@1.13.2, @webassemblyjs/wasm-edit@1.14.1, @webassemblyjs/wasm-gen@1.14.1, @webassemblyjs/wasm-opt@1.14.1, @webassemblyjs/wasm-parser@1.14.1, @webassemblyjs/wast-printer@1.14.1, @xtuc/ieee754@1.2.0, @xtuc/long@4.2.2, accepts@1.3.8, acorn-import-phases@1.0.4, acorn-jsx@5.3.2, acorn-walk@8.3.5, address@1.2.2, ajv@6.14.0, ajv@8.18.0, ajv-formats@2.1.1, ajv-keywords@3.5.2, ajv-keywords@5.1.0, ansi-escapes@3.2.0, ansi-html-community@0.0.8, ansi-regex@3.0.1, ansi-regex@5.0.1, ansi-regex@6.2.2, ansi-styles@3.2.1, ansi-styles@4.3.0, ansi-styles@6.2.3, any-promise@1.3.0, anymatch@3.1.3, arch@2.2.0, argparse@2.0.1, array-flatten@1.1.1, array-union@2.1.0, async@3.2.6, at-least-node@1.0.0, autoprefixer@10.4.27, babel-loader@8.4.1, babel-plugin-dynamic-import-node@2.3.3, babel-plugin-polyfill-corejs2@0.4.15, babel-plugin-polyfill-corejs3@0.13.0, babel-plugin-polyfill-corejs3@0.14.0, babel-plugin-polyfill-regenerator@0.6.6, balanced-match@1.0.2, base64-js@1.5.1, baseline-browser-mapping@2.10.0, batch@0.6.1, big.js@5.2.2, binary-extensions@2.3.0, bl@4.1.0, bluebird@3.7.2, body-parser@1.20.5, bonjour-service@1.3.0, boolbase@1.0.0, brace-expansion@1.1.12, brace-expansion@2.0.2, braces@3.0.3, browser-stdout@1.3.1, browserslist@4.28.1, buffer@5.7.1, buffer-from@1.1.2, bytes@3.1.2, call-bind@1.0.8, call-bind-apply-helpers@1.0.2, call-bound@1.0.4, callsites@3.1.0, camel-case@4.1.2, camelcase@5.3.1, camelcase@6.3.0, caniuse-api@3.0.0, caniuse-lite@1.0.30001774, case-sensitive-paths-webpack-plugin@2.4.0, chai@6.2.2, chalk@2.4.2, chalk@3.0.0, chalk@4.1.2, chokidar@3.6.0, chokidar@4.0.3, chrome-trace-event@1.0.4, ci-info@1.6.0, clean-css@5.3.3, cli-cursor@2.1.0, cli-cursor@3.1.0, cli-highlight@2.1.11, cli-spinners@2.9.2, clipboardy@2.3.0, cliui@7.0.4, cliui@8.0.1, clone@1.0.4, clone-deep@4.0.1, color-convert@1.9.3, color-convert@2.0.1, color-name@1.1.3, color-name@1.1.4, colord@2.9.3, colorette@2.0.20, commander@2.20.3, commander@7.2.0, commander@8.3.0, commondir@1.0.1, compressible@2.0.18, compression@1.8.1, concat-map@0.0.1, connect-history-api-fallback@2.0.0, consolidate@0.15.1, content-disposition@0.5.4, content-type@1.0.5, convert-source-map@2.0.0, cookie@0.7.2, cookie-signature@1.0.7, copy-webpack-plugin@9.1.0, core-js-compat@3.48.0, core-util-is@1.0.3, cosmiconfig@7.1.0, cross-spawn@5.1.0, cross-spawn@6.0.6, cross-spawn@7.0.6, css-declaration-sorter@6.4.1, css-loader@6.11.0, css-minimizer-webpack-plugin@3.4.1, css-select@4.3.0, css-tree@1.1.3, css-what@6.2.2, cssesc@3.0.0, cssnano@5.1.15, cssnano-preset-default@5.2.14, cssnano-utils@3.1.0, csso@4.2.0, debounce@1.2.1, debug@2.6.9, debug@4.4.3, decamelize@4.0.0, deep-is@0.1.4, deepmerge@1.5.2, default-gateway@6.0.3, defaults@1.0.4, define-data-property@1.1.4, define-lazy-prop@2.0.0, define-properties@1.2.1, depd@1.1.2, depd@2.0.0, destroy@1.2.0, detect-node@2.1.0, diff@7.0.0, dir-glob@3.0.1, dns-packet@5.6.1, doctrine@3.0.0, dom-converter@0.2.0, dom-serializer@1.4.1, domelementtype@2.3.0, domhandler@4.3.1, domutils@2.8.0, dot-case@3.0.4, dotenv@10.0.0, dotenv-expand@5.1.0, dunder-proto@1.0.1, duplexer@0.1.2, eastasianwidth@0.2.0, easy-stack@1.0.1, ee-first@1.1.1, electron-to-chromium@1.5.302, emoji-regex@8.0.0, emoji-regex@9.2.2, emojis-list@3.0.0, encodeurl@2.0.0, end-of-stream@1.4.5, enhanced-resolve@5.20.0, entities@2.2.0, entities@4.5.0, error-ex@1.3.4, error-stack-parser@2.1.4, es-define-property@1.0.1, es-errors@1.3.0, es-module-lexer@2.0.0, es-object-atoms@1.1.1, escalade@3.2.0, escape-html@1.0.3, escape-string-regexp@1.0.5, escape-string-regexp@4.0.0, eslint@8.57.1, eslint-plugin-vue@9.33.0, eslint-scope@5.1.1, eslint-scope@7.2.2, eslint-visitor-keys@2.1.0, eslint-visitor-keys@3.4.3, eslint-webpack-plugin@3.2.0, espree@9.6.1, esquery@1.7.0, esrecurse@4.3.0, estraverse@4.3.0, estraverse@5.3.0, esutils@2.0.3, etag@1.8.1, event-pubsub@4.3.0, eventemitter3@4.0.7, events@3.3.0, execa@0.8.0, execa@1.0.0, execa@5.1.1, express@4.22.2, fast-deep-equal@3.1.3, fast-glob@3.3.3, fast-json-stable-stringify@2.1.0, fast-levenshtein@2.0.6, fast-uri@3.1.2, fastq@1.20.1, faye-websocket@0.11.4, figures@2.0.0, file-entry-cache@6.0.1, fill-range@7.1.1, finalhandler@1.3.2, find-cache-dir@3.3.2, find-up@4.1.0, find-up@5.0.0, flat@5.0.2, flat-cache@3.2.0, flatted@3.4.2, follow-redirects@1.16.0, foreground-child@3.3.1, forwarded@0.2.0, fraction.js@5.3.4, fresh@0.5.2, fs-extra@9.1.0, fs-monkey@1.1.0, fs.realpath@1.0.0, fsevents@2.3.3, function-bind@1.1.2, gensync@1.0.0-beta.2, get-caller-file@2.0.5, get-intrinsic@1.3.0, get-proto@1.0.1, get-stream@3.0.0, get-stream@4.1.0, get-stream@6.0.1, glob@10.5.0, glob@7.2.3, glob-parent@5.1.2, glob-parent@6.0.2, glob-to-regexp@0.4.1, globals@13.24.0, globby@11.1.0, gopd@1.2.0, graceful-fs@4.2.11, graphemer@1.4.0, gzip-size@6.0.0, handle-thing@2.0.1, has-flag@3.0.0, has-flag@4.0.0, has-property-descriptors@1.0.2, has-symbols@1.1.0, hash-sum@1.0.2, hash-sum@2.0.0, hasown@2.0.2, he@1.2.0, highlight.js@10.7.3, hosted-git-info@2.8.9, hpack.js@2.1.6, html-entities@2.6.0, html-escaper@2.0.2, html-minifier-terser@6.1.0, html-tags@2.0.0, html-webpack-plugin@5.6.6, htmlparser2@6.1.0, http-deceiver@1.2.7, http-errors@1.8.1, http-errors@2.0.1, http-parser-js@0.5.10, http-proxy@1.18.1, http-proxy-middleware@2.0.9, human-signals@2.1.0, iconv-lite@0.4.24, icss-utils@5.1.0, ieee754@1.2.1, ignore@5.3.2, import-fresh@3.3.1, imurmurhash@0.1.4, inflight@1.0.6, inherits@2.0.4, inline-chunk-html-plugin@1.1.1, ipaddr.js@1.9.1, ipaddr.js@2.3.0, is-arrayish@0.2.1, is-binary-path@2.1.0, is-ci@1.2.1, is-core-module@2.16.1, is-docker@2.2.1, is-extglob@2.1.1, is-file-esm@1.0.0, is-fullwidth-code-point@2.0.0, is-fullwidth-code-point@3.0.0, is-glob@4.0.3, is-interactive@1.0.0, is-number@1.1.2, is-number@7.0.0, is-path-inside@3.0.3, is-plain-obj@2.1.0, is-plain-obj@3.0.0, is-plain-object@2.0.4, is-stream@1.1.0, is-stream@2.0.1, is-unicode-supported@0.1.0, is-wsl@2.2.0, isarray@1.0.0, isexe@2.0.0, isobject@1.0.2, isobject@3.0.1, jackspeak@3.4.3, javascript-stringify@2.1.0, jest-worker@27.5.1, jest-worker@28.1.3, joi@17.13.3, js-message@1.0.7, js-tokens@4.0.0, js-yaml@4.1.1, json-buffer@3.0.1, json-parse-better-errors@1.0.2, json-parse-even-better-errors@2.3.1, json-schema-traverse@0.4.1, json-schema-traverse@1.0.0, json-stable-stringify-without-jsonify@1.0.1, json5@1.0.2, jsonfile@6.2.0, keyv@4.5.4, kind-of@6.0.3, klona@2.0.6, launch-editor@2.13.1, launch-editor-middleware@2.13.1, levn@0.4.1, lilconfig@2.1.0, lines-and-columns@1.2.4, linkify-it@5.0.0, loader-runner@4.3.1, loader-utils@1.4.2, loader-utils@2.0.4, locate-path@5.0.0, locate-path@6.0.0, lodash@4.18.1, lodash.debounce@4.0.8, lodash.defaultsdeep@4.6.1, lodash.kebabcase@4.1.1, lodash.mapvalues@4.6.0, lodash.memoize@4.1.2, lodash.merge@4.6.2, lodash.uniq@4.5.0, log-symbols@4.1.0, log-update@2.3.0, lower-case@2.0.2, lru-cache@10.4.3, lru-cache@4.1.5, lru-cache@5.1.1, lru-cache@6.0.0, make-dir@3.1.0, markdown-anchor@0.2.0, markdown-it@14.1.1, math-intrinsics@1.1.0, mdn-data@2.0.14, mdurl@2.0.0, media-typer@0.3.0, memfs@3.5.3, merge-descriptors@1.0.3, merge-source-map@1.1.0, merge-stream@2.0.0, merge2@1.4.1, methods@1.1.2, micromatch@4.0.8, mime@1.6.0, mime-db@1.52.0, mime-types@2.1.35, mimic-fn@1.2.0, mimic-fn@2.1.0, mini-css-extract-plugin@2.10.0, minimalistic-assert@1.0.1, minimatch@3.1.5, minimatch@9.0.9, minimist@1.2.8, minipass@3.3.6, minipass@7.1.3, mocha@11.7.5, module-alias@2.3.4, mrmime@2.0.1, ms@2.0.0, ms@2.1.3, multicast-dns@7.2.5, mz@2.7.0, natural-compare@1.4.0, negotiator@0.6.3, negotiator@0.6.4, neo-async@2.6.2, nice-try@1.0.5, no-case@3.0.4, node-fetch@2.7.0, node-forge@1.4.0, node-releases@2.0.27, normalize-package-data@2.5.0, normalize-path@1.0.0, normalize-path@3.0.0, normalize-url@6.1.0, npm-run-path@2.0.2, npm-run-path@4.0.1, nth-check@2.1.1, object-assign@4.1.1, object-inspect@1.13.4, object-keys@1.1.1, object.assign@4.1.7, obuf@1.1.2, on-finished@2.4.1, on-headers@1.1.0, once@1.4.0, onetime@2.0.1, onetime@5.1.2, open@8.4.2, opener@1.5.2, optionator@0.9.4, ora@5.4.1, p-finally@1.0.0, p-limit@2.3.0, p-limit@3.1.0, p-locate@4.1.0, p-locate@5.0.0, p-retry@4.6.2, p-try@2.2.0, package-json-from-dist@1.0.1, param-case@3.0.4, parent-module@1.0.1, parse-json@5.2.0, parse5@5.1.1, parse5@6.0.1, parse5-htmlparser2-tree-adapter@6.0.1, parseurl@1.3.3, pascal-case@3.1.2, path-exists@4.0.0, path-is-absolute@1.0.1, path-key@2.0.1, path-key@3.1.1, path-parse@1.0.7, path-scurry@1.11.1, path-to-regexp@0.1.12, path-type@4.0.0, picocolors@0.2.1, picomatch@2.3.2, pkg-dir@4.2.0, portfinder@1.0.38, postcss@7.0.39, postcss-calc@8.2.4, postcss-colormin@5.3.1, postcss-convert-values@5.1.3, postcss-discard-comments@5.1.2, postcss-discard-duplicates@5.1.0, postcss-discard-empty@5.1.1, postcss-discard-overridden@5.1.0, postcss-loader@6.2.1, postcss-merge-longhand@5.1.7, postcss-merge-rules@5.1.4, postcss-minify-font-values@5.1.0, postcss-minify-gradients@5.1.1, postcss-minify-params@5.1.4, postcss-minify-selectors@5.2.1, postcss-modules-extract-imports@3.1.0, postcss-modules-local-by-default@4.2.0, postcss-modules-scope@3.2.1, postcss-modules-values@4.0.0, postcss-normalize-charset@5.1.0, postcss-normalize-display-values@5.1.0, postcss-normalize-positions@5.1.1, postcss-normalize-repeat-style@5.1.1, postcss-normalize-string@5.1.0, postcss-normalize-timing-functions@5.1.0, postcss-normalize-unicode@5.1.1, postcss-normalize-url@5.1.0, postcss-normalize-whitespace@5.1.1, postcss-ordered-values@5.1.3, postcss-reduce-initial@5.1.2, postcss-reduce-transforms@5.1.0, postcss-selector-parser@6.1.2, postcss-selector-parser@7.1.1, postcss-svgo@5.1.0, postcss-unique-selectors@5.1.1, postcss-value-parser@4.2.0, preload-webpack-plugin@3.0.0-beta.4, prelude-ls@1.2.1, prettier@2.8.8, pretty-error@4.0.0, process-nextick-args@2.0.1, progress-webpack-plugin@1.0.16, proxy-addr@2.0.7, pseudomap@1.0.2, pump@3.0.4, punycode@2.3.1, punycode.js@2.3.1, qs@6.15.2, queue-microtask@1.2.3, randombytes@2.1.0, range-parser@1.2.1, raw-body@2.5.3, read-pkg@5.2.0, read-pkg-up@7.0.1, readable-stream@2.3.8, readable-stream@3.6.2, readdirp@3.6.0, readdirp@4.1.2, regenerate@1.4.2, regenerate-unicode-properties@10.2.2, regexpu-core@6.4.0, regjsgen@0.8.0, regjsparser@0.13.0, relateurl@0.2.7, renderkid@3.0.0, require-directory@2.1.1, require-from-string@2.0.2, requires-port@1.0.0, resolve@1.22.11, resolve-from@4.0.0, restore-cursor@2.0.0, restore-cursor@3.1.0, retry@0.13.1, reusify@1.1.0, rimraf@3.0.2, run-parallel@1.2.0, safe-buffer@5.1.2, safe-buffer@5.2.1, safer-buffer@2.1.2, sax@1.5.0, schema-utils@2.7.1, schema-utils@3.3.0, schema-utils@4.3.3, select-hose@2.0.0, selfsigned@2.4.1, semver@5.7.2, semver@6.3.1, semver@7.7.4, send@0.19.2, serialize-javascript@6.0.2, serve-index@1.9.2, serve-static@1.16.3, set-function-length@1.2.2, setprototypeof@1.2.0, shallow-clone@3.0.1, shebang-command@1.2.0, shebang-command@2.0.0, shebang-regex@1.0.0, shebang-regex@3.0.0, shell-quote@1.8.4, side-channel@1.1.0, side-channel-list@1.0.1, side-channel-map@1.0.1, side-channel-weakmap@1.0.2, signal-exit@3.0.7, signal-exit@4.1.0, sirv@2.0.4, slash@3.0.0, sockjs@0.3.24, source-map@0.6.1, source-map-support@0.5.21, spdx-correct@3.2.0, spdx-exceptions@2.5.0, spdx-expression-parse@3.0.1, spdx-license-ids@3.0.23, spdy@4.0.2, spdy-transport@3.0.0, ssri@8.0.1, stable@0.1.8, stackframe@1.3.4, statuses@1.5.0, statuses@2.0.2, string-width@2.1.1, string-width@4.2.3, string-width@5.1.2, string_decoder@1.1.1, string_decoder@1.3.0, stringify-github-anchor@0.1.1, stringify-github-url@0.1.0, strip-ansi@4.0.0, strip-ansi@6.0.1, strip-ansi@7.2.0, strip-eof@1.0.0, strip-final-newline@2.0.0, strip-indent@2.0.0, strip-json-comments@3.1.1, stylehacks@5.1.1, supports-color@5.5.0, supports-color@7.2.0, supports-color@8.1.1, supports-preserve-symlinks-flag@1.0.0, svg-tags@1.0.0, svgo@2.8.2, tapable@2.3.0, terser@5.46.0, terser-webpack-plugin@5.3.16, text-table@0.2.0, thenify@3.3.1, thenify-all@1.6.0, thread-loader@3.0.4, thunky@1.1.0, to-regex-range@5.0.1, toidentifier@1.0.1, totalist@3.0.1, tr46@0.0.3, tslib@2.8.1, type-check@0.4.0, type-fest@0.20.2, type-fest@0.6.0, type-fest@0.8.1, type-is@1.6.18, uc.micro@2.1.0, undici-types@7.18.2, unicode-canonical-property-names-ecmascript@2.0.1, unicode-match-property-ecmascript@2.0.0, unicode-match-property-value-ecmascript@2.2.1, unicode-property-aliases-ecmascript@2.2.0, universalify@2.0.1, unpipe@1.0.0, update-browserslist-db@1.2.3, uri-js@4.4.1, util-deprecate@1.0.2, utila@0.4.0, utils-merge@1.0.1, uuid@8.3.2, validate-npm-package-license@3.0.4, vary@1.1.2, vue-eslint-parser@9.4.3, vue-hot-reload-api@2.3.4, vue-loader@15.11.1, vue-loader@17.4.2, vue-style-loader@4.1.3, vue-template-es2015-compiler@1.9.1, watchpack@2.5.1, wbuf@1.7.3, wcwidth@1.0.1, webidl-conversions@3.0.1, webpack@5.105.3, webpack-bundle-analyzer@4.10.2, webpack-chain@6.5.1, webpack-dev-middleware@5.3.4, webpack-dev-server@4.15.2, webpack-merge@5.10.0, webpack-sources@3.3.4, webpack-virtual-modules@0.4.6, websocket-driver@0.7.4, websocket-extensions@0.1.4, whatwg-fetch@3.6.20, whatwg-url@5.0.0, which@1.3.1, which@2.0.2, wildcard@2.0.1, word-wrap@1.2.5, workerpool@9.3.4, wrap-ansi@3.0.1, wrap-ansi@7.0.0, wrap-ansi@8.1.0, wrappy@1.0.2, ws@7.5.10, ws@8.19.0, xml-name-validator@4.0.0, y18n@5.0.8, yallist@2.1.2, yallist@3.1.1, yallist@4.0.0, yaml@1.10.3, yargs@16.2.0, yargs@17.7.2, yargs-parser@20.2.9, yargs-parser@21.1.1, yargs-unparser@2.0.0, yocto-queue@0.1.0, yorkie@2.0.0

New advisories (95)

• H GHSA-22p9-wv53-3rq4 in linkify-it@5.0.0
• M GHSA-253c-mchw-3w2r in markdown-it@14.1.1
• H GHSA-27r3-jxmh-p828 in body-parser@1.20.5
• H GHSA-2883-xcg3-v3hh in js-yaml@4.1.1
• H GHSA-2p49-hgcm-8545 in svgo@2.8.2
• M GHSA-2wm5-q62r-hmrv in colord@2.9.3
• L GHSA-333x-w4r6-6crp in fast-uri@3.1.2
• H GHSA-37ch-88jc-xwx2 in path-to-regexp@0.1.12
• H GHSA-395f-4hp3-45gv in shell-quote@1.8.4
• M GHSA-3g3m-2fjr-6pw4 in glob@10.5.0
• H GHSA-3jxr-9vmj-r5cp in brace-expansion@2.0.2
• H GHSA-3xgq-45jj-v275 in cross-spawn@5.1.0
• L GHSA-4487-j8r4-4g2f in node-forge@1.4.0
• H GHSA-4528-x5fx-h6hg in joi@17.13.3
• L GHSA-4642-5mcj-2rqw in node-forge@1.4.0
• H GHSA-4c8g-83qw-93j6 in fast-uri@3.1.2
• M GHSA-4mjr-xmp4-gh2g in qs@6.15.2
• M GHSA-4v9v-hfq4-rm2v in webpack-dev-server@4.15.2
• M GHSA-4vpr-x523-8j87 in svgo@2.8.2
• L GHSA-4x5r-pxfx-6jf8 in @babel/core@7.29.0
• M GHSA-525v-9gp9-w22h in node-forge@1.4.0
• H GHSA-52cp-r559-cp3m in js-yaml@4.1.1
• H GHSA-587h-7wmj-h5pm in launch-editor@2.13.1
• M GHSA-58qx-3vcg-4xpx in ws@8.19.0
• H GHSA-5c6j-r48x-rmvq in serialize-javascript@6.0.2
• M GHSA-5cwg-6vw7-rj6p in node-forge@1.4.0
• H GHSA-5p4m-2wfm-xmqj in js-yaml@4.1.1
• H GHSA-5x38-2vff-x55p in node-forge@1.4.0
• M GHSA-64mm-vxmg-q3vj in http-proxy-middleware@2.0.9
• M GHSA-698v-4r3x-3vcv in launch-editor@2.13.1
• H GHSA-6h2x-m376-mqjq in joi@17.13.3
• H GHSA-6j4f-fj2g-mc7p in brace-expansion@2.0.2
• M GHSA-6pq8-jhm2-2vcw in qs@6.15.2
• M GHSA-6v5v-wf23-fmfq in markdown-it@14.1.1
• L GHSA-6w3j-5fw6-r9vr in joi@17.13.3
• M GHSA-6wvx-3r32-xmcg in node-forge@1.4.0
• L GHSA-73rr-hh4g-fpgx in diff@7.0.0
• H GHSA-73wf-gq98-2v4g in browserslist@4.28.1
• M GHSA-79cf-xcqc-c78w in webpack-dev-server@4.15.2
• M GHSA-7fh5-64p2-3v2j in postcss@7.0.39
• H GHSA-7p8r-x3mc-p8w7 in fast-uri@3.1.2
• H GHSA-7wch-p9px-956x in node-forge@1.4.0
• H GHSA-86w9-cpqp-85rv in node-forge@1.4.0
• H GHSA-8hrf-8g6f-7xwp in node-forge@1.4.0
• H GHSA-8r9p-f939-6h3c in follow-redirects@1.16.0
• H GHSA-96hv-2xvq-fx4p in ws@8.19.0
• M GHSA-9jgg-88mc-972h in webpack-dev-server@4.15.2
• H GHSA-c83g-rgw3-j3cx in browserslist@4.28.1
• M GHSA-f5vj-f2hx-8m93 in webpack-dev-server@4.15.2
• H GHSA-f65p-4m7j-42xc in fast-uri@3.1.2
• M GHSA-f886-m6hf-6m8v in brace-expansion@2.0.2
• H GHSA-fph4-wmhf-6fwf in fast-uri@3.1.2
• M GHSA-g3hv-75wg-m249 in minimatch@9.0.9
• H GHSA-g84c-rxfj-3j2c in webpack-dev-middleware@5.3.4
• H GHSA-gfr2-rv44-r23c in markdown-it@14.1.1
• L GHSA-gg4h-3hg2-grpc in joi@17.13.3
• M GHSA-h67p-54hq-rp68 in js-yaml@4.1.1
• L GHSA-h6cr-wjv9-3cpp in node-forge@1.4.0
• H GHSA-hqq3-7jhf-c5jx in node-forge@1.4.0
• M GHSA-hrr3-gc8f-f4qj in fast-uri@3.1.2
• H GHSA-jc66-7q78-782g in node-forge@1.4.0
• C GHSA-jqcg-44mw-7w3h in proxy-addr@2.0.7
• H GHSA-jqff-g426-hqxp in fast-uri@3.1.2
• M GHSA-m28w-2pqf-7qgj in webpack-dev-server@4.15.2
• L GHSA-m5mm-p8h7-m29v in serialize-javascript@6.0.2
• H GHSA-mh99-v99m-4gvg in brace-expansion@2.0.2
• M GHSA-mp7j-qc5w-4988 in websocket-driver@0.7.4
• H GHSA-mrwp-f3q8-3g9p in follow-redirects@1.16.0
• M GHSA-mx8g-39q3-5c79 in webpack-dev-server@4.15.2
• C GHSA-pqg4-j6r4-53mv in shell-quote@1.8.4
• M GHSA-q2hr-2g5m-vwhr in brace-expansion@2.0.2
• H GHSA-q3jh-wrc6-jgq8 in follow-redirects@1.16.0
• M GHSA-q7cg-457f-vx79 in joi@17.13.3
• H GHSA-qhr7-859c-m2p7 in brace-expansion@2.0.2
• M GHSA-qj8w-gfj5-8c6v in serialize-javascript@6.0.2
• H GHSA-qw65-cvwx-89v3 in fast-uri@3.1.2
• H GHSA-r7fv-28h4-cvq7 in markdown-it@14.1.1
• M GHSA-r825-w8mm-5pxw in launch-editor@2.13.1
• H GHSA-rgw5-rvv9-x895 in brace-expansion@2.0.2
• M GHSA-rj75-hqrm-r3gf in postcss-selector-parser@7.1.1
• H GHSA-v245-v573-v5vm in linkify-it@5.0.0
• H GHSA-v2hh-gcrm-f6hx in fast-uri@3.1.2
• L GHSA-v422-hmwv-36x6 in body-parser@1.20.5
• M GHSA-v6wh-96g9-6wx3 in launch-editor@2.13.1
• H GHSA-vc2v-76pw-4v95 in compression@1.8.1
• L GHSA-vfgh-jcmw-g37q in markdown-it@14.1.1
• H GHSA-w27v-7q3p-w38r in svgo@2.8.2
• M GHSA-w5hq-g745-h8pq in uuid@8.3.2
• M GHSA-w5vr-8v7q-w6rv in baseline-browser-mapping@2.10.0
• M GHSA-w74x-v6f9-j3xg in fast-uri@3.1.2
• L GHSA-w9m9-85wc-3x92 in postcss-selector-parser@7.1.1
• M GHSA-wr44-6hxh-3jwq in joi@17.13.3
• M GHSA-x5fp-wj9c-mxmx in qs@6.15.2
• L GHSA-xhq7-xmqj-769h in fast-uri@3.1.2
• C GHSA-xv26-6w52-cph6 in websocket-driver@0.7.4

Resolved advisories (1)

• C GHSA-m38p-3v84-rcjg in cloudsplaining@0.4.8

Known vulnerabilities (145)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Not counted: 1 match (package defined in the repository itself). Neither identifies a version installed from a registry.

Second opinion: OSV-Scanner

OSV-Scanner found 144 advisories in the same files; 144 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.

Release integrity

Verdict: no release files.

• Checksums file: no
• Signatures: no
• SLSA provenance: no
• SBOM published with the release: no

Verified means a signature, provenance, or attestation was checked against an identity in salesforce/cloudsplaining's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

Score 5.7/10, assessed 2026-10-26 (OpenSSF public dataset). Scorecard viewer

GitHub Actions workflow audit (zizmor)

2 potential issues in 7 workflow files at this release: 0 high, 1 medium, 0 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

Dependencies (1005)

By ecosystem: npm 920, pypi 75, github 10.

Licenses (as declared in the SBOM): MIT 775, unknown 88, ISC 60, BSD-2-Clause 25, BSD-3-Clause 19, Apache-2.0 18, BlueOak-1.0.0 5, Unlicense 3, MIT OR CC0-1.0 3, CC0-1.0 2, Python-2.0 1, CC-BY-4.0 1, BSD-3-Clause OR GPL-2.0 1, WTFPL OR MIT 1, CC-BY-3.0 1.