Scan report

prettier / plugin-php

View on GitHub (opens in a new tab)
PHP
1856 stars
Scanned 24 Sep 2026, 10:16

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

13 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 8
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Safe

Does this code look like it is trying to cause harm?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 19

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

27 total findings

Likely real: 6
Uncertain: 2
Likely noise: 19

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

6 findings likely need attention, 19 look like noise. Most notable: This Dependabot configuration does not set a cooldown period. Newly published packages ... in /.github/dependabot.yml (99% confidence).

Detections by engine

Dependency checker 19

CVEs, typosquats and risky installs · Supply chain
Semgrep 8

Pattern-based code analysis · Vulnerability

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/dependabot.yml line 3

Likely real
Yes, 99% confidence

This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
```
- package-ecosystem: npm
    directory: "/"
    schedule:
      interval: daily
    open-pull-requests-limit: 10
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/nodejs.yml line 48

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: codecov/codecov-action@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/nodejs.yml line 42

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-node@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/nodejs.yml line 40

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/nodejs.yml line 21

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/setup-node@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/nodejs.yml line 20

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/tests_config/run_spec.mjs line 26

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
const filename = path.join(dirname, basename);
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/tests_config/run_spec.mjs line 26

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
const filename = path.join(dirname, basename);
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 4% confidence

Loose version constraint: 'cross-env^10.1.0' — attacker could push malicious update
```
cross-env:^10.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'eslint-plugin-prettier-doc^1.1.0' — attacker could push malicious update
```
eslint-plugin-prettier-doc:^1.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'strip-ansi^7.1.0' — attacker could push malicious update
```
strip-ansi:^7.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'rollup^4.60.0' — attacker could push malicious update
```
rollup:^4.60.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'prettier^3.6.1' — attacker could push malicious update
```
prettier:^3.6.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'jest-snapshot-serializer-raw^2.0.0' — attacker could push malicious update
```
jest-snapshot-serializer-raw:^2.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'jest-light-runner^0.7.9' — attacker could push malicious update
```
jest-light-runner:^0.7.9
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'c8^10.1.3' — attacker could push malicious update
```
c8:^10.1.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@rollup/plugin-terser^0.4.3' — attacker could push malicious update
```
@rollup/plugin-terser:^0.4.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@rollup/plugin-replace^6.0.3' — attacker could push malicious update
```
@rollup/plugin-replace:^6.0.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@rollup/plugin-node-resolve^16.0.3' — attacker could push malicious update
```
@rollup/plugin-node-resolve:^16.0.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@rollup/plugin-json^6.1.0' — attacker could push malicious update
```
@rollup/plugin-json:^6.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@rollup/plugin-inject^5.0.5' — attacker could push malicious update
```
@rollup/plugin-inject:^5.0.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@rollup/plugin-commonjs^29.0.2' — attacker could push malicious update
```
@rollup/plugin-commonjs:^29.0.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@rollup/plugin-babel^7.0.0' — attacker could push malicious update
```
@rollup/plugin-babel:^7.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@rollup/plugin-alias^6.0.0' — attacker could push malicious update
```
@rollup/plugin-alias:^6.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@babel/preset-env^7.27.2' — attacker could push malicious update
```
@babel/preset-env:^7.27.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'php-parser^3.7.0' — attacker could push malicious update
```
php-parser:^3.7.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'linguist-languages^9.4.0' — attacker could push malicious update
```
linguist-languages:^9.4.0
```