| Severity | Findings | Fix exists upstream | Fix existed before release |
|---|---|---|---|
| CRITICAL | 6 | 1 | 0 |
| HIGH | 2 | 2 | 0 |
| MEDIUM | 0 | 0 | 0 |
| LOW | 0 | 0 | 0 |
| UNKNOWN | 1 | 0 | 0 |
| Total | 9 | 3 | 0 |
Scanner results are version matching, not proof of exploitability. A finding means a component version is listed as affected; it does not show that the vulnerable code is reachable or exposed in your deployment. Use the triage columns in findings.csv to record reachability decisions.
| Group | Findings | With fix | Meaning |
|---|---|---|---|
| Act now | 9 | 3 | Malicious package, exploited in the wild, or a ready-to-use exploit exists |
| Review | 0 | 0 | Published exploit, notable exploitation probability, or a critical that applies without conditions |
| Check conditions | 0 | 0 | The advisory says it applies only under stated conditions; confirm whether they hold |
| Routine | 0 | 0 | No exploit, KEV or EPSS signal in the sources that were checked, no stated conditions; normal patch cycle |
| Set aside | 0 | 0 | Evidence it does not apply: kernel header package, already fixed, govulncheck shows the vulnerable function is not in the binary, or the assessor recorded not affected or fixed |
A suggested reading order, not a risk rating. No group, 'Set aside' included, says a finding carries no risk; 'Set aside' is used only where the tool has evidence. Hover a group in the findings table for its reason; record the assessor's decisions in the triage columns of findings.csv.
| Metric | Value |
|---|---|
| Findings with an upstream fix | 3 |
| Fix publication date found | 3 (unknown: 0) |
| Fix existed at least 14 days before the release (not shipped) | 0 |
| Fix published within 14 days before the release (not counted) | 0 |
| Likely already fixed (build label mismatch) | 0 |
| Kernel CVEs on kernel header packages (excluded: containers use the host kernel) | 0 |
| Fix published after the release | 0 |
| CVE published before the release (secondary) | 0 |
| Median days a fix has been available | 1830 |
| Longest days a fix has been available | 2962 |
| Oldest available fix | GHSA-mh6f-8j2x-4483 in event-stream: 4.0.0 published 2018-09-16 (2962 days) |
| Known malicious packages (OpenSSF, or CWE-506 advisories) | 6 |
| Known exploited (CISA KEV) with fix | 0 |
| With fix and a ready-to-use exploit (Metasploit or Nuclei) | 0 |
| With fix and a published exploit (Exploit-DB) | 0 |
| With fix and only GitHub proofs of concept | 0 |
| Highest EPSS among findings with a fix (30-day exploitation probability) | 0.015 |
A fix counts as existing before the release only if the fixed dependency version was published at least 14 days before the project's release date. 'Unshipped' counts fixes public for 90 days or more while the scanned release is still the latest. Fix dates come from deps.dev and Packagist for language packages (GitHub release dates for Go modules deps.dev lacks), from Debian advisories (DSA, DLA) and point releases, Ubuntu Security Notices and Launchpad publishing history, Red Hat advisories (RHSA), Alpine aports commits, and the Go release history for the Go standard library. Amazon Linux has no dated source yet and is counted as unknown; see the fix date coverage table.
No repository given. Pass --repo owner/name for release cadence, archive status, OpenSSF Scorecard and release lag.
| Ecosystem | With fix | Dated | Coverage | Date sources |
|---|---|---|---|---|
| npm | 3 | 3 | 100% | deps.dev 3 |
Release-lag numbers only count dated findings. Where coverage is low, the lag metrics and the likelihood suggestion understate what the scanners found for that ecosystem.
| Source | Findings seen | Seen only by this source |
|---|---|---|
| trivy | 6 | 1 |
| grype | 7 | 0 |
| osv | 8 | 1 |
| All sources | 5 |
Trivy and Grype detect packages independently. OSV is queried with the package list from Trivy, so it is an independent database check, not an independent detector. Single-source findings deserve a closer look rather than automatic dismissal.
| Item | Value |
|---|---|
| Artifact | package-lock.json (lockfile) |
| Repository | n/a |
| Release used for lag | n/a |
| Assessment date | 2026-10-26 |
| Source: trivy | 0.76.1, DB 2026-10-26, hash NOT verified |
| Source: grype | 0.121.0, hash NOT verified |
| Source: osv | 6 packages queried |
| Group | ID | Severity, CVSS | Exploit | Package | Installed | Fix | Before release | Days available |
|---|---|---|---|---|---|---|---|---|
| Act now | GHSA-mh6f-8j2x-4483 | CRITICAL 9.8 | MALICIOUS | event-stream | 3.3.6 | 4.0.0 | unknown | 2962 |
| Act now | GHSA-2v46-p5h4-248w | CRITICAL n/a | MALICIOUS | chalk | 5.6.1 | none | no fix | n/a |
| Act now | GHSA-9x64-5r7x-2q53 | CRITICAL 9.8 | MALICIOUS | flatmap-stream | 0.1.1 | none | no fix | n/a |
| Act now | GHSA-mh6f-8j2x-4483 | CRITICAL 9.8 | MALICIOUS | flatmap-stream | 0.1.1 | none | no fix | n/a |
| Act now | GHSA-qjqf-7j6f-82c4 | CRITICAL n/a | MALICIOUS | @ctrl/tinycolor | 4.1.1 | none | no fix | n/a |
| Act now | NSWG-ECO-477 | CRITICAL n/a | MALICIOUS | flatmap-stream | 0.1.1 | none | no fix | n/a |
| Act now | CVE-2021-4229 | HIGH 8.8 | MALICIOUS | ua-parser-js | 0.7.29 | 0.7.30 | unknown | 1830 |
| Act now | CVE-2025-59144 | HIGH 8.8 v4 | MALICIOUS | debug | 4.4.2 | 4.4.3 | unknown | 408 |
| Act now | MAL-2025-20690 | UNKNOWN n/a | MALICIOUS | flatmap-stream | 0.1.1 | none | no fix | n/a |
Exploit: the strongest public evidence found. Weaponised = a Metasploit module or Nuclei template; public = Exploit-DB; proof of concept = GitHub repositories only (noisy: some are fake, malicious or not exploits at all, so open the repositories listed on hover or in findings.csv). 'None indexed' means none was found in these sources, not that none exists.
Full list, with every CVSS score, EPSS value, exploit reference and advisory condition: findings.csv