insights
Most common vulnerable dependencies in public repos
102 of the 226 public repositories nittim has read (45%) have at least one runtime dependency with a known advisory.
24 of the 226 public repositories nittim has read (11%) have advisories only in development dependencies. Together, 126 of the 226 public repositories nittim has read (56%) have an advisory of either kind.
Runtime dependencies carry 1,615 advisory hits across the 226 public repositories nittim has read. Development-only dependencies carry 1,003 more, 2,618 in all. A hit is one advisory on one dependency in one repository.
Counted across the 226 public repositories nittim has read, as of November 4, 2026.
Hits by severity
The 2,618 advisory hits across the 226 public repositories nittim has read, by the level each advisory publishes. Advisories that publish no standard level are unrated.
| Severity | Advisory hits |
|---|---|
| Critical | 142 |
| High | 1,042 |
| Medium | 877 |
| Low | 242 |
| Unrated | 315 |
Most common packages
Packages with an advisory in the most repositories, out of the 226 public repositories nittim has read.
| Package | Ecosystem | Repositories |
|---|---|---|
| brace-expansion | npm | 43 of 226 |
| js-yaml | npm | 33 of 226 |
| postcss | npm | 28 of 226 |
| nanoid | npm | 24 of 226 |
| minimatch | npm | 23 of 226 |
| vite | npm | 21 of 226 |
| @babel/core | npm | 19 of 226 |
| ajv | npm | 19 of 226 |
| esbuild | npm | 19 of 226 |
| braces | npm | 17 of 226 |
Most common advisories
The most common advisories, by the number of repositories out of the 226 public repositories nittim has read that carry each one.
| Advisory | Package | Repositories |
|---|---|---|
| GHSA-3jxr-9vmj-r5cp | brace-expansion | 33 of 226 |
| GHSA-5p4m-2wfm-xmqj | js-yaml | 31 of 226 |
| GHSA-mh99-v99m-4gvg | brace-expansion | 31 of 226 |
| GHSA-52cp-r559-cp3m | js-yaml | 28 of 226 |
| GHSA-fxqj-rqcc-2cmp | postcss | 27 of 226 |
| GHSA-f886-m6hf-6m8v | brace-expansion | 22 of 226 |
| GHSA-2v37-7h3g-55p8 | nanoid | 21 of 226 |
| GHSA-28wg-ghj8-5hjv | nanoid | 19 of 226 |
| GHSA-2g4f-4pwh-qvx6 | ajv | 19 of 226 |
| GHSA-4x5r-pxfx-6jf8 | @babel/core | 19 of 226 |
An advisory applies to the version a repository declares at the time it was read. It says nothing about a package's current release or its maintainers. Rows are listed only when several repositories share them, so no row points to a single project.