Loading report…
← nittim
← nittimshared scan
nodeca/js-yaml ↗ · 21b265d · Aug 21, 2026, 10:48 PM
No issues found
Free scan · deterministic evidence only
No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.
121 of 128 files scanned (94%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this means
Two scanners read 121 of 128 files: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.
Read it:
Worth knowing, not blocking
dev depnpm js-yaml4 in 2 versions
4.1.1 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — devDependency
4.3.0 — GHSA-5p4m-2wfm-xmqj
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency
dev depnpm brace-expansion3 in 1 version
1.1.15 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — devDependency
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — devDependency
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation — devDependency
dev depnpm nanoid2 in 1 version
3.3.15 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
nanoid: non-secure generators can loop indefinitely with negative size — devDependency
nanoid: custom generators can loop indefinitely when size is zero — devDependency
dev depnpm postcss2 in 1 version
8.5.16 — GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — devDependency
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure — devDependency
dev depnpm elliptic@6.6.1GHSA-848j-6mx2-7j84
Elliptic Uses a Cryptographic Primitive with a Risky Implementation — devDependency
AI audit · nodeca/js-yaml · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 121 of 128 files · nodeca/js-yaml
Dependency manifests: 3 package roots found, 3 scanned.
README badge
[](https://nittim.com/library/nodeca/js-yaml)