coderaiser / cloudcmd

1. high Semgrep This Dockerfile builds on a Node.js image that is affected by CVE-2026-111497 (Brotli decoder out-of-bounds write, remote code execution) or whose patch level cannot be verified from the tag. Pin to a fixed release 22.23.4, 24.22.1, 26.12.1 or later on the same line. Node.js 20 and older, 23 and 25 are end-of-life and will not receive a fix. /docker/Dockerfile:1 94%
2. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /docker/Dockerfile:29 22%
3. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /ChangeLog 1%
4. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /docker/Dockerfile.io 1%
5. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /docker/Dockerfile 1%
6. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /docker/Dockerfile.slim 1%
7. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /docker/Dockerfile.alpine 1%
8. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /client/listeners/index.js 1%
9. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /docker/Dockerfile.io 0%
10. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /HELP.md 0%
11. medium Semgrep RegExp() called with a `prefix` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /client/dom/current-file.js:73 100%
12. medium Semgrep RegExp() called with a `ext` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /client/modules/view/types.js:7 100%
13. medium Semgrep RegExp() called with a `wildcard` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /common/util.js:24 100%
14. medium Semgrep RegExp() called with a `ext` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /client/modules/view/get-type.js:4 100%
15. medium Semgrep RegExp() called with a `char` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /client/key/set-current-by-char.js:12 100%
16. medium Semgrep Service 'web' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. /docker-compose.yml:3 98%
17. medium Semgrep Service 'web' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this. /docker-compose.yml:3 97%
18. medium Semgrep Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used. /server/distribute/import.js:94 95%
19. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:37 52%
20. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:21 52%
21. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:41 52%
22. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:17 52%
23. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:39 52%
24. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:46 52%
25. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/nodejs.yml:62 52%
26. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:16 52%
27. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-io.yml:50 52%
28. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-io.yml:44 52%
29. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-io.yml:39 52%
30. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-io.yml:37 52%
31. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-io.yml:35 52%
32. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-io.yml:19 52%
33. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:52 52%
34. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:64 52%
35. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker.yml:77 52%
36. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/nodejs.yml:19 52%
37. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/nodejs.yml:20 52%
38. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/nodejs.yml:24 52%
39. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/nodejs.yml:36 52%
40. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/nodejs.yml:40 52%
41. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/nodejs.yml:47 52%
42. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-io.yml:15 52%
43. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-io.yml:14 52%
44. low Dependency checker Loose version constraint: 'http-auth^4.2.1' — attacker could push malicious update package.json 8%
45. low Dependency checker Loose version constraint: '@cloudcmd/read-files-sync^2.0.0' — attacker could push malicious update package.json 8%
46. low Dependency checker Loose version constraint: 'url-loader^4.0.0' — attacker could push malicious update package.json 7%
47. low Dependency checker Loose version constraint: 'package-json^10.0.0' — attacker could push malicious update package.json 6%
48. low Dependency checker Loose version constraint: 'cssnano-preset-default^9.0.1' — attacker could push malicious update package.json 5%
49. low Dependency checker Loose version constraint: 'request^2.76.0' — attacker could push malicious update package.json 4%
50. low Dependency checker Loose version constraint: '@cloudcmd/move-files^9.0.1' — attacker could push malicious update package.json 4%
51. low Dependency checker Loose version constraint: 'files-io^4.0.0' — attacker could push malicious update package.json 4%
52. low Dependency checker Loose version constraint: 'just-snake-case^3.2.0' — attacker could push malicious update package.json 4%
53. low Dependency checker Loose version constraint: '@cloudcmd/create-element^2.0.0' — attacker could push malicious update package.json 4%
54. low Dependency checker Loose version constraint: 'html-webpack-plugin^5.6.3' — attacker could push malicious update package.json 4%
55. low Dependency checker Loose version constraint: 'just-capitalize^3.2.0' — attacker could push malicious update package.json 4%
56. low Dependency checker Loose version constraint: 'just-pascal-case^3.2.0' — attacker could push malicious update package.json 4%
57. low Dependency checker Loose version constraint: 'for-each-key^2.0.0' — attacker could push malicious update package.json 3%
58. low Dependency checker Loose version constraint: 'path-browserify^1.0.1' — attacker could push malicious update package.json 2%
59. low Dependency checker Loose version constraint: 'emitify^4.0.1' — attacker could push malicious update package.json 2%
60. low Dependency checker Loose version constraint: 'nodemon^3.0.1' — attacker could push malicious update package.json 2%
61. low Dependency checker Loose version constraint: 'multi-rename^3.0.0' — attacker could push malicious update package.json 2%
62. low Dependency checker Loose version constraint: 'morgan^1.6.1' — attacker could push malicious update package.json 2%
63. low Dependency checker Loose version constraint: 'minor^1.2.2' — attacker could push malicious update package.json 2%
64. low Dependency checker Loose version constraint: 'memfs^4.2.0' — attacker could push malicious update package.json 2%
65. low Dependency checker Loose version constraint: 'madrun^13.0.0' — attacker could push malicious update package.json 2%
66. low Dependency checker Loose version constraint: 'load.js^3.0.0' — attacker could push malicious update package.json 2%
67. low Dependency checker Loose version constraint: 'limier^3.0.0' — attacker could push malicious update package.json 2%
68. low Dependency checker Loose version constraint: 'itype^3.0.1' — attacker could push malicious update package.json 2%
69. low Dependency checker Loose version constraint: 'inherits^2.0.3' — attacker could push malicious update package.json 2%
70. low Dependency checker Loose version constraint: 'gunzip-maybe^1.3.1' — attacker could push malicious update package.json 2%
71. low Dependency checker Loose version constraint: 'cheerio^1.0.0-rc.5' — attacker could push malicious update package.json 2%
72. low Dependency checker Loose version constraint: 'gritty^10.2.0' — attacker could push malicious update package.json 2%
73. low Dependency checker Loose version constraint: 'globals^17.0.0' — attacker could push malicious update package.json 2%
74. low Dependency checker Loose version constraint: 'eslint-plugin-putout^31.0.0' — attacker could push malicious update package.json 2%
75. low Dependency checker Loose version constraint: 'eslint^10.0.0' — attacker could push malicious update package.json 2%
76. low Dependency checker Loose version constraint: 'smalltalk^5.0.0' — attacker could push malicious update package.json 2%
77. low Dependency checker Loose version constraint: 'webpack-merge^6.0.1' — attacker could push malicious update package.json 2%
78. low Dependency checker Loose version constraint: 'util^0.12.5' — attacker could push malicious update package.json 2%
79. low Dependency checker Loose version constraint: 'unionfs^4.0.0' — attacker could push malicious update package.json 2%
80. low Dependency checker Loose version constraint: 'tar-stream^3.0.0' — attacker could push malicious update package.json 2%
81. low Dependency checker Loose version constraint: 'supertape^13.0.0' — attacker could push malicious update package.json 2%
82. low Dependency checker Loose version constraint: 'supermenu^5.0.0' — attacker could push malicious update package.json 2%
83. low Dependency checker Loose version constraint: 'superc8^12.6.0' — attacker could push malicious update package.json 2%
84. low Dependency checker Loose version constraint: 'style-loader^4.0.0' — attacker could push malicious update package.json 2%
85. low Dependency checker Loose version constraint: 'philip^3.0.0' — attacker could push malicious update package.json 2%
86. low Dependency checker Loose version constraint: 'serve-once^4.0.1' — attacker could push malicious update package.json 2%
87. low Dependency checker Loose version constraint: 'scroll-into-view-if-needed^3.0.4' — attacker could push malicious update package.json 2%
88. low Dependency checker Loose version constraint: 'rimraf^6.0.1' — attacker could push malicious update package.json 2%
89. low Dependency checker Loose version constraint: 'redlint^6.0.0' — attacker could push malicious update package.json 2%
90. low Dependency checker Loose version constraint: 'readjson^2.0.1' — attacker could push malicious update package.json 2%
91. low Dependency checker Loose version constraint: 'process^0.11.10' — attacker could push malicious update package.json 2%
92. low Dependency checker Loose version constraint: 'postcss^8.5.3' — attacker could push malicious update package.json 2%
93. low Dependency checker Loose version constraint: 'place^1.1.4' — attacker could push malicious update package.json 2%
94. low Dependency checker Loose version constraint: 'montag^2.0.1' — attacker could push malicious update package.json 2%
95. low Dependency checker Loose version constraint: 'format-io^2.0.0' — attacker could push malicious update package.json 2%
96. low Dependency checker Loose version constraint: 'fullstore^4.0.0' — attacker could push malicious update package.json 2%
97. low Dependency checker Loose version constraint: 'inly^5.0.0' — attacker could push malicious update package.json 2%
98. low Dependency checker Loose version constraint: 'jaguar^6.0.0' — attacker could push malicious update package.json 2%
99. low Dependency checker Loose version constraint: 'jju^1.3.0' — attacker could push malicious update package.json 2%
100. low Dependency checker Loose version constraint: 'jonny^3.0.0' — attacker could push malicious update package.json 2%
101. low Dependency checker Loose version constraint: 'markdown-it^15.0.0' — attacker could push malicious update package.json 2%
102. low Dependency checker Loose version constraint: 'mellow^3.0.0' — attacker could push malicious update package.json 2%
103. low Dependency checker Loose version constraint: 'mime-types^3.0.1' — attacker could push malicious update package.json 2%
104. low Dependency checker Loose version constraint: 'find-up^8.0.0' — attacker could push malicious update package.json 2%
105. low Dependency checker Loose version constraint: 'nano-memoize^3.0.16' — attacker could push malicious update package.json 2%
106. low Dependency checker Loose version constraint: 'nomine^5.0.2' — attacker could push malicious update package.json 2%
107. low Dependency checker Loose version constraint: 'once^1.4.0' — attacker could push malicious update package.json 2%
108. low Dependency checker Loose version constraint: 'onezip^7.0.0' — attacker could push malicious update package.json 2%
109. low Dependency checker Loose version constraint: 'open^11.0.0' — attacker could push malicious update package.json 2%
110. low Dependency checker Loose version constraint: 'pipe-io^4.0.1' — attacker could push malicious update package.json 2%
111. low Dependency checker Loose version constraint: 'ponse^8.0.0' — attacker could push malicious update package.json 2%
112. low Dependency checker Loose version constraint: 'pullout^5.0.0' — attacker could push malicious update package.json 2%
113. low Dependency checker Loose version constraint: 'putout^42.0.5' — attacker could push malicious update package.json 2%
114. low Dependency checker Loose version constraint: 'criton^2.0.0' — attacker could push malicious update package.json 2%
115. low Dependency checker Loose version constraint: '@cloudcmd/dropbox^5.0.1' — attacker could push malicious update package.json 2%
116. low Dependency checker Loose version constraint: '@cloudcmd/fileop^9.0.8' — attacker could push malicious update package.json 2%
117. low Dependency checker Loose version constraint: '@putout/cli-validate-args^2.0.0' — attacker could push malicious update package.json 2%
118. low Dependency checker Loose version constraint: '@putout/plugin-cloudcmd^5.2.0' — attacker could push malicious update package.json 2%
119. low Dependency checker Loose version constraint: 'apart^2.0.0' — attacker could push malicious update package.json 2%
120. low Dependency checker Loose version constraint: 'chalk^6.0.0' — attacker could push malicious update package.json 2%
121. low Dependency checker Loose version constraint: 'compression^1.7.4' — attacker could push malicious update package.json 2%
122. low Dependency checker Loose version constraint: 'console-io^15.0.1' — attacker could push malicious update package.json 2%
123. low Dependency checker Loose version constraint: 'copymitter^10.3.0' — attacker could push malicious update package.json 2%
124. low Dependency checker Loose version constraint: 'css-modules-require-hook^4.2.3' — attacker could push malicious update package.json 2%
125. low Dependency checker Loose version constraint: 'currify^4.0.0' — attacker could push malicious update package.json 2%
126. low Dependency checker Loose version constraint: 'deepmerge^4.0.0' — attacker could push malicious update package.json 2%
127. low Dependency checker Loose version constraint: 'deepword^11.0.0' — attacker could push malicious update package.json 2%
128. low Dependency checker Loose version constraint: 'dword^16.0.0' — attacker could push malicious update package.json 2%
129. low Dependency checker Loose version constraint: 'edward^16.0.0' — attacker could push malicious update package.json 2%
130. low Dependency checker Loose version constraint: 'es6-promisify^7.0.0' — attacker could push malicious update package.json 2%
131. low Dependency checker Loose version constraint: 'execon^1.2.0' — attacker could push malicious update package.json 2%
132. low Dependency checker Loose version constraint: 'express^5.1.0' — attacker could push malicious update package.json 2%
133. low Dependency checker Loose version constraint: 'express-rate-limit^8.5.2' — attacker could push malicious update package.json 2%
134. low Dependency checker Loose version constraint: '@supertape/loader-css^1.0.0' — attacker could push malicious update package.json 2%
135. low Dependency checker Loose version constraint: '@cloudcmd/clipboard^2.0.0' — attacker could push malicious update package.json 2%
136. low Dependency checker Loose version constraint: '@cloudcmd/modal^4.0.0' — attacker could push malicious update package.json 2%
137. low Dependency checker Loose version constraint: '@cloudcmd/olark^3.0.2' — attacker could push malicious update package.json 2%
138. low Dependency checker Loose version constraint: '@cloudcmd/stub^5.0.0' — attacker could push malicious update package.json 2%
139. low Dependency checker Loose version constraint: '@iocmd/wait^2.1.0' — attacker could push malicious update package.json 2%
140. low Dependency checker Loose version constraint: '@playwright/test^1.63.0' — attacker could push malicious update package.json 2%
141. low Dependency checker Loose version constraint: '@putout/eslint-flat^4.0.0' — attacker could push malicious update package.json 2%
142. low Dependency checker Loose version constraint: '@rspack/cli^2.1.4' — attacker could push malicious update package.json 2%
143. low Dependency checker Loose version constraint: '@rspack/core^2.1.4' — attacker could push malicious update package.json 2%
144. low Dependency checker Loose version constraint: 'redzip^4.6.1' — attacker could push malicious update package.json 2%
145. low Dependency checker Loose version constraint: '@types/node-fetch^2.6.11' — attacker could push malicious update package.json 2%
146. low Dependency checker Loose version constraint: 'aleman^2.0.4' — attacker could push malicious update package.json 2%
147. low Dependency checker Loose version constraint: 'auto-globals^4.0.0' — attacker could push malicious update package.json 2%
148. low Dependency checker Loose version constraint: 'babel-loader^10.0.0' — attacker could push malicious update package.json 2%
149. low Dependency checker Loose version constraint: 'babel-plugin-macros^3.0.0' — attacker could push malicious update package.json 2%
150. low Dependency checker Loose version constraint: 'clean-css-loader^4.2.1' — attacker could push malicious update package.json 2%
151. low Dependency checker Loose version constraint: 'codegen.macro^4.0.0' — attacker could push malicious update package.json 2%
152. low Dependency checker Loose version constraint: 'css-loader^7.1.2' — attacker could push malicious update package.json 2%
153. low Dependency checker Loose version constraint: 'domtokenlist-shim^1.2.0' — attacker could push malicious update package.json 2%
154. low Dependency checker Loose version constraint: '@babel/plugin-transform-optional-chaining^8.0.1' — attacker could push malicious update package.json 2%
155. low Dependency checker Loose version constraint: 'qword^1.0.0' — attacker could push malicious update package.json 2%
156. low Dependency checker Loose version constraint: 'rendy^5.0.0' — attacker could push malicious update package.json 2%
157. low Dependency checker Loose version constraint: 'restafary^13.0.1' — attacker could push malicious update package.json 2%
158. low Dependency checker Loose version constraint: 'restbox^4.0.0' — attacker could push malicious update package.json 2%
159. low Dependency checker Loose version constraint: 'shortdate^2.0.0' — attacker could push malicious update package.json 2%
160. low Dependency checker Loose version constraint: 'socket.io^4.0.0' — attacker could push malicious update package.json 2%
161. low Dependency checker Loose version constraint: 'socket.io-client^4.0.1' — attacker could push malicious update package.json 2%
162. low Dependency checker Loose version constraint: 'squad^3.0.0' — attacker could push malicious update package.json 2%
163. low Dependency checker Loose version constraint: 'table^6.0.1' — attacker could push malicious update package.json 2%
164. low Dependency checker Loose version constraint: 'tryrequire^3.0.0' — attacker could push malicious update package.json 2%
165. low Dependency checker Loose version constraint: 'win32^8.0.0' — attacker could push malicious update package.json 2%
166. low Dependency checker Loose version constraint: 'wraptile^3.0.0' — attacker could push malicious update package.json 2%
167. low Dependency checker Loose version constraint: 'writejson^3.0.0' — attacker could push malicious update package.json 2%
168. low Dependency checker Loose version constraint: 'yargs-parser^22.0.0' — attacker could push malicious update package.json 2%
169. low Dependency checker Loose version constraint: '@babel/code-frame^8.0.0' — attacker could push malicious update package.json 2%
170. low Dependency checker Loose version constraint: '@babel/core^8.0.1' — attacker could push malicious update package.json 2%
171. low Dependency checker Loose version constraint: '@babel/preset-env^8.0.2' — attacker could push malicious update package.json 2%
172. low Dependency checker Loose version constraint: 'try-catch^4.0.4' — attacker could push malicious update package.json 1%
173. low Dependency checker Loose version constraint: 'try-to-catch^4.0.0' — attacker could push malicious update package.json 1%
174. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /docker/Dockerfile.io 0%

No findings match these filters. Clear filters