a public repository, read by nittim
chddaniel/chatpack security audit
What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.
TypeScript · 224 stars · last push October 17, 2026
chddaniel/chatpack is a TypeScript repository that contains application code and dependencies. The scan examined all 593 files in the repository and found evidence of security concerns that require attention.
The scan found 1 committed credential on a production path and 23 vulnerable runtime dependencies. Among the vulnerable packages are better-auth with GHSA-965c-763c-88jm and GHSA-q84f-53jg-9ppm, body-parser with GHSA-27r3-jxmh-p828, brace-expansion with GHSA-6j4f-fj2g-mc7p and GHSA-mh99-v99m-4gvg, deepmerge-ts with GHSA-ggr8-5vv4-36mx, fast-uri with GHSA-58mr-gqgx-xq4g, js-yaml with GHSA-2883-xcg3-v3hh and GHSA-5p4m-2wfm-xmqj, nanoid with GHSA-2v37-7h3g-55p8, next with GHSA-2464-fhr4-w9xw and GHSA-2xp9-vwfh-vxw4, proxy-addr with GHSA-jqcg-44mw-7w3h, sharp with GHSA-f88m-g3jw-g9cj, and zod with GHSA-mrhx-c7xc-m3w5.
Developers should address the committed credential immediately and update the vulnerable dependencies. After making these fixes, rescan chddaniel/chatpack to confirm the issues are resolved.
Written from nittim's own scan on November 2, 2026; rescanned when the repository changes.
No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.
What was read — rule-based scan
Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.
Read 593 of 593 eligible files. Commit b950d03. 2026-11-02.
What the scanners found
- Committed secrets on production paths
- 1
- Vulnerable runtime dependencies
- 23
better-auth (GHSA-965c-763c-88jm, GHSA-q84f-53jg-9ppm), body-parser (GHSA-27r3-jxmh-p828), brace-expansion (GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg), deepmerge-ts (GHSA-ggr8-5vv4-36mx), fast-uri (GHSA-58mr-gqgx-xq4g), js-yaml (GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj), nanoid (GHSA-2v37-7h3g-55p8), next (GHSA-2464-fhr4-w9xw, GHSA-2xp9-vwfh-vxw4), proxy-addr (GHSA-jqcg-44mw-7w3h), sharp (GHSA-f88m-g3jw-g9cj), zod (GHSA-mrhx-c7xc-m3w5)
Run it yourself
Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.
Scan your own repoQuestions
- What did nittim read in chddaniel/chatpack?
- nittim read 593 of 593 eligible files in chddaniel/chatpack. The reading ran on November 2, 2026. It was taken at commit b950d03.
- Did nittim find committed secrets or vulnerable dependencies in chddaniel/chatpack?
- The rule-based scan found 1 committed secret and 23 vulnerable dependencies in chddaniel/chatpack. Affected: better-auth (GHSA-965c-763c-88jm, GHSA-q84f-53jg-9ppm), body-parser (GHSA-27r3-jxmh-p828), brace-expansion (GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg), deepmerge-ts (GHSA-ggr8-5vv4-36mx), fast-uri (GHSA-58mr-gqgx-xq4g), js-yaml (GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj), nanoid (GHSA-2v37-7h3g-55p8), next (GHSA-2464-fhr4-w9xw, GHSA-2xp9-vwfh-vxw4), proxy-addr (GHSA-jqcg-44mw-7w3h), sharp (GHSA-f88m-g3jw-g9cj), zod (GHSA-mrhx-c7xc-m3w5).
- Is chddaniel/chatpack production ready?
- A free scan is not a verdict. A full audit gives one.
More like this
More TypeScript repositories →
Add the badge to your README
[](https://nittim.com/library/chddaniel/chatpack)