Loading report…
← nittim
← nittimshared scan
nodeca/js-yaml ↗ · 21b265d · Aug 21, 2026, 10:48 PM
No deterministic issues foundNo problems found by this automatic checkNo issues found
Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only
The secret and dependency scanners surfaced nothing verdict-bearing in what they scanned. This is not a clean bill of health. These two scanners cover a sliver of production-readiness — the 14 dimensions that actually decide whether you ship are unaudited below. Run Audit for the verdict.
The checks for leaked passwords and known package bugs found nothing to flag. This does not mean your code is safe. These two checks cover only a small slice of what matters — the 14 areas that actually decide whether your code is ready to ship are not checked yet. Run Audit for the full verdict.
No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.
121 of 128 files scanned (94%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this meansWhat this means for youWhat this means
Two scanners read 121 of 128 files: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.
Read it:
Worth knowing, not blocking
dev depnpm js-yaml4 in 2 versions
4.1.1 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — devDependency
4.3.0 — GHSA-5p4m-2wfm-xmqj
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency
dev depnpm brace-expansion3 in 1 version
1.1.15 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — devDependency
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — devDependency
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation — devDependency
dev depnpm nanoid2 in 1 version
3.3.15 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
nanoid: non-secure generators can loop indefinitely with negative size — devDependency
nanoid: custom generators can loop indefinitely when size is zero — devDependency
dev depnpm postcss2 in 1 version
8.5.16 — GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — devDependency
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure — devDependency
dev depnpm elliptic@6.6.1GHSA-848j-6mx2-7j84
Elliptic Uses a Cryptographic Primitive with a Risky Implementation — devDependency
AI audit for nodeca/js-yaml · all 14 dimensions · usually within 15 minutes*AI check for nodeca/js-yaml · all 14 areas · usually within 15 minutes*AI audit · nodeca/js-yaml · 14 dimensions · usually within 15 minutes*
14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited
Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.
The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 121 of 128 files · nodeca/js-yaml
Dependency manifests: 3 package roots found, 3 scanned.
README badgeBadge for your project's readme fileREADME badge
[](https://nittim.com)