pnpm-audit-hook 1.0.0

package/dist/static-db/data/packages/ts-nodash.json

@@ -0,0 +1,27 @@
+{
+  "name": "ts-nodash",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-5xjx-4xcm-hpcm",
+      "title": "Prototype Pollution in ts-nodash",
+      "description": "`ts-nodash` before version 1.2.7 is vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-5xjx-4xcm-hpcm",
+      "publishedAt": "2021-12-10T18:53:42Z",
+      "modifiedAt": "2023-01-27T05:00:55Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-5xjx-4xcm-hpcm"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2021-23403"
+        }
+      ],
+      "affectedRange": "< 1.2.7",
+      "fixedVersion": "1.2.7"
+    }
+  ]
+}

package/dist/static-db/data/packages/ts-process-promises.json

@@ -0,0 +1,26 @@
+{
+  "name": "ts-process-promises",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-ww4j-c2rq-47q8",
+      "title": "Command injection in ts-process-promises",
+      "description": "This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js.",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-ww4j-c2rq-47q8",
+      "publishedAt": "2021-01-13T18:22:28Z",
+      "modifiedAt": "2023-09-08T20:18:50Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-ww4j-c2rq-47q8"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2020-7784"
+        }
+      ],
+      "affectedRange": "= 1.0.2"
+    }
+  ]
+}

package/dist/static-db/data/packages/tsup.json

@@ -0,0 +1,26 @@
+{
+  "name": "tsup",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-3mv9-4h5g-vhg3",
+      "title": "tsup DOM Clobbering vulnerability",
+      "description": "A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs_shims.js components",
+      "severity": "low",
+      "url": "https://github.com/advisories/GHSA-3mv9-4h5g-vhg3",
+      "publishedAt": "2025-03-03T18:31:29Z",
+      "modifiedAt": "2025-03-03T22:22:45Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-3mv9-4h5g-vhg3"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-53384"
+        }
+      ],
+      "affectedRange": "<= 8.3.4"
+    }
+  ]
+}

package/dist/static-db/data/packages/tts-api.json

@@ -0,0 +1,27 @@
+{
+  "name": "tts-api",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-jx6q-fq9h-6g7q",
+      "title": "Pedroetb TTS-API OS Command Injection",
+      "description": "A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as 29d9c25415911ea2f8b6de247cb5c4607d13d434. It is recommended to upgrade the affected component. VDB-248278 is the identifier assigned to this vulnerability.",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-jx6q-fq9h-6g7q",
+      "publishedAt": "2023-12-19T15:30:29Z",
+      "modifiedAt": "2023-12-28T21:04:51Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-jx6q-fq9h-6g7q"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2019-25158"
+        }
+      ],
+      "affectedRange": "< 2.2.0",
+      "fixedVersion": "2.2.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/tui-grid.json

@@ -0,0 +1,27 @@
+{
+  "name": "tui-grid",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-9rwj-9j2h-fhvm",
+      "title": "Toast UI Grid vulnerable to Cross-site Scripting",
+      "description": "Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted content into editable cells. This issue was fixed in version 4.21.3. There are no known workarounds.",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-9rwj-9j2h-fhvm",
+      "publishedAt": "2022-09-23T00:00:29Z",
+      "modifiedAt": "2023-01-31T05:04:14Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-9rwj-9j2h-fhvm"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2022-23458"
+        }
+      ],
+      "affectedRange": "< 4.21.3",
+      "fixedVersion": "4.21.3"
+    }
+  ]
+}

package/dist/static-db/data/packages/twitter-fetcher-js.json

@@ -0,0 +1,27 @@
+{
+  "name": "twitter-fetcher-js",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-m688-cx2p-rgq9",
+      "title": "Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access",
+      "description": "A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file `js/twitterFetcher.js` of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 can address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected compone",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-m688-cx2p-rgq9",
+      "publishedAt": "2022-12-29T09:30:19Z",
+      "modifiedAt": "2023-02-02T05:01:18Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-m688-cx2p-rgq9"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2018-25058"
+        }
+      ],
+      "affectedRange": "< 18.0.0",
+      "fixedVersion": "18.0.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/typed-rest-client.json

@@ -0,0 +1,27 @@
+{
+  "name": "typed-rest-client",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-558p-m34m-vpmq",
+      "title": "Potential leak of authentication data to 3rd parties",
+      "description": "### Impact\nUsers of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. \n\nThe flow of the vulnerability is as follows:\n\n1. Send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler` \n2. The target host may return a redirection (3xx), with a link to a second host.\n3. The next request will use the credentials to authenticate with the second host, by setting the `Authorization` header.\n\n",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-558p-m34m-vpmq",
+      "publishedAt": "2023-04-27T14:02:11Z",
+      "modifiedAt": "2023-11-12T05:01:10Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-558p-m34m-vpmq"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2023-30846"
+        }
+      ],
+      "affectedRange": "< 1.8.0",
+      "fixedVersion": "1.8.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/typeorm.json

@@ -0,0 +1,69 @@
+{
+  "name": "typeorm",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-q2pj-6v73-8rgj",
+      "title": "TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update",
+      "description": "### Summary\n\nSQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.\n\n### Details\n\nVulnerable Code:\n\n```js\nconst { username, city, name} = req.body;\nconst updateData = {\n    username,\n    city,\n    name,\n    id:userId\n  }; // Developer aims to only allow above three fields to be updated    \nconst result = await userRepo.save(updateData);\n```\n\nIntended Payload (non-malicious",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-q2pj-6v73-8rgj",
+      "publishedAt": "2025-10-29T18:30:33Z",
+      "modifiedAt": "2025-10-31T17:38:01Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-q2pj-6v73-8rgj"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-60542"
+        }
+      ],
+      "affectedRange": "< 0.3.26",
+      "fixedVersion": "0.3.26"
+    },
+    {
+      "id": "GHSA-fx4w-v43j-vc45",
+      "title": "SQL injection in typeORM",
+      "description": "The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-fx4w-v43j-vc45",
+      "publishedAt": "2022-07-05T00:00:54Z",
+      "modifiedAt": "2024-03-21T18:57:33Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-fx4w-v43j-vc45"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2022-33171"
+        }
+      ],
+      "affectedRange": "< 0.3.0",
+      "fixedVersion": "0.3.0"
+    },
+    {
+      "id": "GHSA-pf2j-9qmp-jqr2",
+      "title": "TypeORM vulnerable to MAID and Prototype Pollution",
+      "description": "Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-pf2j-9qmp-jqr2",
+      "publishedAt": "2021-05-07T16:46:42Z",
+      "modifiedAt": "2023-01-30T05:02:48Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-pf2j-9qmp-jqr2"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2020-8158"
+        }
+      ],
+      "affectedRange": "< 0.2.25",
+      "fixedVersion": "0.2.25"
+    }
+  ]
+}

package/dist/static-db/data/packages/ua-parser-js.json

@@ -0,0 +1,107 @@
+{
+  "name": "ua-parser-js",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-fhg7-m89q-25r3",
+      "title": "ReDoS Vulnerability in ua-parser-js version",
+      "description": "### Description:\nA regular expression denial of service (ReDoS) vulnerability has been discovered in `ua-parser-js`.\n\n### Impact:\nThis vulnerability bypass the library's `MAX_LENGTH` input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.\n\n### Affected Versions:\nFrom version `0.7.30` to before versions `0.7.33` / `1.0.33`.\n\n### P",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-fhg7-m89q-25r3",
+      "publishedAt": "2023-01-24T15:36:32Z",
+      "modifiedAt": "2025-10-17T16:52:25Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-fhg7-m89q-25r3"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2022-25927"
+        }
+      ],
+      "affectedRange": ">= 0.7.30, < 0.7.33",
+      "fixedVersion": "0.7.33"
+    },
+    {
+      "id": "GHSA-pjwm-rvh2-c87w",
+      "title": "Embedded malware in ua-parser-js",
+      "description": "The npm package `ua-parser-js` had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See [this issue](https://github.com/faisalman/ua-parser-js/issues/536) for details as they unfold.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a differe",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w",
+      "publishedAt": "2021-10-22T20:38:14Z",
+      "modifiedAt": "2023-07-28T15:38:49Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-pjwm-rvh2-c87w"
+        }
+      ],
+      "affectedRange": "= 1.0.0",
+      "fixedVersion": "1.0.1"
+    },
+    {
+      "id": "GHSA-394c-5j6w-4xmx",
+      "title": "ua-parser-js Regular Expression Denial of Service vulnerability",
+      "description": "The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-394c-5j6w-4xmx",
+      "publishedAt": "2022-02-09T22:46:53Z",
+      "modifiedAt": "2023-02-01T05:05:35Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-394c-5j6w-4xmx"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2020-7793"
+        }
+      ],
+      "affectedRange": "< 0.7.23",
+      "fixedVersion": "0.7.23"
+    },
+    {
+      "id": "GHSA-78cj-fxph-m83p",
+      "title": "Regular Expression Denial of Service (ReDoS) in ua-parser-js",
+      "description": "ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-78cj-fxph-m83p",
+      "publishedAt": "2021-05-06T16:11:13Z",
+      "modifiedAt": "2023-02-01T05:05:18Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-78cj-fxph-m83p"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2021-27292"
+        }
+      ],
+      "affectedRange": ">= 0.7.14, < 0.7.24",
+      "fixedVersion": "0.7.24"
+    },
+    {
+      "id": "GHSA-662x-fhqg-9p8v",
+      "title": "Regular Expression Denial of Service in ua-parser-js",
+      "description": "The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-662x-fhqg-9p8v",
+      "publishedAt": "2021-05-07T16:18:19Z",
+      "modifiedAt": "2023-01-31T05:06:09Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-662x-fhqg-9p8v"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2020-7733"
+        }
+      ],
+      "affectedRange": "< 0.7.22",
+      "fixedVersion": "0.7.22"
+    }
+  ]
+}

package/dist/static-db/data/packages/uap-core.json

@@ -0,0 +1,27 @@
+{
+  "name": "uap-core",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-p4pj-mg4r-x6v4",
+      "title": "Denial of Service in uap-core",
+      "description": "## Impact\n\nSome regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.\n\n## Patches\n\nPlease update uap-core to >= v0.11.0\n\nDownstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-p4pj-mg4r-x6v4",
+      "publishedAt": "2021-02-02T15:46:38Z",
+      "modifiedAt": "2024-02-08T22:17:20Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-p4pj-mg4r-x6v4"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2021-21317"
+        }
+      ],
+      "affectedRange": "< 0.11.0",
+      "fixedVersion": "0.11.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/umami.json

@@ -0,0 +1,23 @@
+{
+  "name": "umami",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-8www-cffh-4q98",
+      "title": "Anyone with a share link can RESET all website data in Umami",
+      "description": "### Summary\nAnyone with a share link (permissions to view) can reset the website data.\n\n### Details\nWhen a user navigates to a `/share/` URL, he receives a share token which is used for authentication. This token is later verified by `useAuth`. After the token is verified, the user can call most of the `GET` APIs that allow fetching stats about a website.\n\nThe `POST /reset` endpoint is secured using `canViewWebsite` which is the incorrect verification for such destructive action. This makes it p",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-8www-cffh-4q98",
+      "publishedAt": "2023-07-28T15:33:14Z",
+      "modifiedAt": "2023-07-28T15:33:15Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-8www-cffh-4q98"
+        }
+      ],
+      "affectedRange": "< 2.3.1",
+      "fixedVersion": "2.3.1"
+    }
+  ]
+}

package/dist/static-db/data/packages/undefsafe.json

@@ -0,0 +1,27 @@
+{
+  "name": "undefsafe",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-332q-7ff2-57h2",
+      "title": "Prototype Pollution in undefsafe",
+      "description": "undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a `__proto__` payload.",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-332q-7ff2-57h2",
+      "publishedAt": "2022-02-09T22:34:01Z",
+      "modifiedAt": "2023-02-01T05:05:24Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-332q-7ff2-57h2"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2019-10795"
+        }
+      ],
+      "affectedRange": "< 2.0.3",
+      "fixedVersion": "2.0.3"
+    }
+  ]
+}

package/dist/static-db/data/packages/underscore-keypath.json

@@ -0,0 +1,26 @@
+{
+  "name": "underscore-keypath",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-gpvc-mx6g-cchv",
+      "title": "underscore-keypath vulnerable to Prototype Pollution",
+      "description": "Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the `setProperty()` function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like `__proto__`.",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-gpvc-mx6g-cchv",
+      "publishedAt": "2023-08-01T06:30:15Z",
+      "modifiedAt": "2023-11-29T22:34:02Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-gpvc-mx6g-cchv"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2023-26139"
+        }
+      ],
+      "affectedRange": ">= 0.0.11, <= 0.9.3"
+    }
+  ]
+}

package/dist/static-db/data/packages/underscore.json

@@ -0,0 +1,27 @@
+{
+  "name": "underscore",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-cf4h-3jhx-xvhq",
+      "title": "Arbitrary Code Execution in underscore",
+      "description": "The package `underscore` from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq",
+      "publishedAt": "2021-05-06T16:09:43Z",
+      "modifiedAt": "2025-11-04T16:34:00Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-cf4h-3jhx-xvhq"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2021-23358"
+        }
+      ],
+      "affectedRange": ">= 1.3.2, < 1.12.1",
+      "fixedVersion": "1.12.1"
+    }
+  ]
+}