Contains Vulnerability (CVSS Critical)

Flags items that contain or rely on components with critical severity vulnerabilities, as identified by sources such as Google OSV and NVD. These vulnerabilities may expose the item to exploitation, including risks like backdoors, privilege escalation, or data compromise.

Unverified Publisher

Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.

Contains Vulnerability (CVSS High)

Flags items that contain or rely on components with high-severity vulnerabilities, as identified by sources such as Google OSV and NVD. These vulnerabilities may expose the item to exploitation, including risks like backdoors, privilege escalation, or data compromise.

GHSA-xvch-5gv4-984h

Prototype Pollution in minimist

CVSS:

9.8

GHSA-8cj5-5rvv-wf4v

tar-fs can extract outside the specified dir with a specific tarball

CVSS:

8.7

GHSA-vj76-c3g6-qr5v

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

CVSS:

8.7

Licenses

MIT License

View License

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to de...