Loading report…
← nittim
← nittimshared scan
snoopysecurity/dvws-node ↗ · a7385b8 · Aug 21, 2026, 11:07 PM
We found hard evidence. 30 things need your attention now.We found real evidence of problems. 30 things need your attention now.30 issues need attention now.
Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only
These are facts from deterministic scanners, not opinion — 30 high/critical dependency vulnerabilities. The full picture — architecture, AI-generated-code risk, privacy, and 11 more dimensions — needs Audit.
These are facts found by automatic checks, not opinions — 30 serious security bugs in the ready-made packages your project uses. The full picture — how your code is built, AI-generated-code risk, privacy, and 11 more areas — needs Audit.
30 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
60 of 70 files scanned (85%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this meansWhat this means for youWhat this means
Two scanners read 60 of 70 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 30 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvenpm @xmldom/xmldom3 in 1 version
0.8.11 — GHSA-2v35-w6hq-6mfw, GHSA-f6ww-3ggp-fr8h, GHSA-j759-j44w-7fr8
xmldom: Uncontrolled recursion in XML serialization leads to DoS — HIGH
xmldom has XML injection through unvalidated DocumentType serialization — HIGH
xmldom has XML node injection through unvalidated comment serialization — HIGH
cvenpm libxmljs3 in 1 version
1.0.11 — GHSA-6433-x5p4-8jc7, GHSA-jv72-59wq-8rxm, GHSA-mg49-jqgw-gcj6
libxmljs vulnerable to type confusion when parsing specially crafted XML — CRITICAL
libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS) — HIGH
libxmljs vulnerable to type confusion when parsing specially crafted XML — CRITICAL
cvenpm minimatch3 in 1 version
5.1.6 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — HIGH
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — HIGH
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — HIGH
cvenpm tar3 in 1 version
6.2.1 — GHSA-23hp-3jrh-7fpw, GHSA-34x7-hfp2-rc4v, GHSA-83g3-92jg-28cx
node-tar: Decompression/parse DoS via unlimited input — CRITICAL
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal — HIGH
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction — HIGH
cvenpm brace-expansion2 in 1 version
2.0.2 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH
cvenpm js-yaml2 in 1 version
4.1.1 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
js-yaml: YAML merge-key chains can force quadratic CPU consumption — HIGH
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — HIGH
cvenpm vm22 in 1 version
3.10.3 — GHSA-248r-7h7q-cr24, GHSA-47x8-96vw-5wg6
vm2 Has a Sandbox Breakout Using Async Generator — CRITICAL
vm2 Access to Host Object Enables Sandbox Escape — CRITICAL
cvenpm angular@1.8.3GHSA-4w4v-5hc9-xrr2
angular vulnerable to super-linear runtime due to backtracking — HIGH
cvenpm apollo-server@3.13.0GHSA-mp6q-xf9x-fwf7
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer` — HIGH
cvenpm form-data@4.0.5GHSA-hmw2-7cc7-3qxx
form-data: CRLF injection in form-data via unescaped multipart field names and filenames — HIGH
cvenpm http-proxy-middleware@3.0.5GHSA-gcq2-9pq2-cxqm
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody` — HIGH
cvenpm ip@1.1.9GHSA-2p57-rm9w-gvfp
ip SSRF improper categorization in isPublic — HIGH
cvenpm ip-address@10.1.0GHSA-mwp4-54f8-5fhr
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass — HIGH
cvenpm lodash@4.17.23GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names — HIGH
cvenpm mongoose@7.8.8GHSA-wpg9-53fq-2r8h
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection — HIGH
cvenpm node-serialize@0.0.4GHSA-q4v7-4rhw-9hqm
Code Execution through IIFE in node-serialize — CRITICAL
cvenpm path-to-regexp@0.1.12GHSA-37ch-88jc-xwx2
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters — HIGH
cvenpm sequelize@6.37.7GHSA-6457-6jrx-69cr
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type — HIGH
cvenpm serialize-javascript@6.0.2GHSA-5c6j-r48x-rmvq
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() — HIGH
Worth knowing, not blocking
moderate cvenpm angular2 in 1 version
1.8.3 — GHSA-2qqx-w9hr-q5gx, GHSA-2vrf-hf26-jrp5
angular vulnerable to regular expression denial of service via the $resource service — MODERATE
angular vulnerable to regular expression denial of service via the angular.copy() utility — MODERATE
moderate cvenpm @protobufjs/utf8@1.1.0GHSA-q6x5-8v7m-xcrf
protobufjs has overlong UTF-8 decoding — MODERATE
low cvenpm @tootallnate/once@1.1.2GHSA-vpq2-c234-7xj6
@tootallnate/once vulnerable to Incorrect Control Flow Scoping — LOW
moderate cvenpm apollo-server-core@3.13.0GHSA-9q82-xgwf-vj6h
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention — MODERATE
low cvenpm body-parser@1.20.4GHSA-v422-hmwv-36x6
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement — LOW
moderate cvenpm brace-expansion@2.0.2GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE
low cvenpm diff@5.2.0GHSA-73rr-hh4g-fpgx
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch — LOW
moderate cvenpm dottie@2.0.6GHSA-r5mx-6wc6-7h9w
dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() — MODERATE
moderate cvenpm follow-redirects@1.15.11GHSA-r4q5-vmmm-2653
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets — MODERATE
moderate cvenpm http-proxy-middleware@3.0.5GHSA-64mm-vxmg-q3vj
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass — MODERATE
moderate cvenpm ip-address@10.1.0GHSA-v2v4-37r5-5v8g
ip-address has XSS in Address6 HTML-emitting methods — MODERATE
moderate cvenpm js-yaml@4.1.1GHSA-h67p-54hq-rp68
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — MODERATE
moderate cvenpm lodash@4.17.23GHSA-f23m-r3pf-42rh
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — MODERATE
moderate cvenpm mongoose@7.8.8GHSA-664h-wqgq-64gw
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) — MODERATE
moderate cvenpm qs@6.14.2GHSA-q8mj-m7cp-5q26
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set — MODERATE
moderate cvenpm serialize-javascript@6.0.2GHSA-qj8w-gfj5-8c6v
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects — MODERATE
moderate cvenpm uuid@9.0.1GHSA-w5hq-g745-h8pq
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided — MODERATE
moderate cvenpm vm2@3.10.3GHSA-2cm2-m3w5-gp2f
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` — MODERATE
AI audit for snoopysecurity/dvws-node · all 14 dimensions · usually within 15 minutes*AI check for snoopysecurity/dvws-node · all 14 areas · usually within 15 minutes*AI audit · snoopysecurity/dvws-node · 14 dimensions · usually within 15 minutes*
14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited
Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.
The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 60 of 70 files · snoopysecurity/dvws-node
Dependency manifests: 1 package root found, 1 scanned — package list truncated at the vulnerability-lookup limit.
README badgeBadge for your project's readme fileREADME badge
[](https://nittim.com)