Home / reports
npm package security scans
Scan results for widely used npm packages. Each page shows the verdict and the kinds of signal we found. The full evidence is in the API report. These are automated signals, and they carry no warranty. Looking for agent tooling? See the MCP server reports.
- react
- react-dom
- lodash
- axios
- express
- chalk
- commander
- debug
- moment
- dayjs
- uuid
- dotenv
- classnames
- redux
- zustand
- next
- vue
- svelte
- typescript
- eslint
- prettier
- webpack
- vite
- rollup
- esbuild
- babel-core
- jest
- vitest
- mocha
- chai
- cypress
- playwright
- puppeteer
- cheerio
- jsdom
- node-fetch
- undici
- got
- request
- ws
- socket.io
- graphql
- apollo-server
- mongoose
- sequelize
- prisma
- knex
- pg
- mysql2
- redis
- ioredis
- bcrypt
- jsonwebtoken
- passport
- helmet
- cors
- body-parser
- multer
- nodemailer
- winston
- pino
- yargs
- inquirer
- ora
- rimraf
- glob
- fs-extra
- semver
- chokidar
- nanoid
- zod
- yup
- joi
- ramda
- immer
- rxjs
- date-fns
- sharp
- handlebars
- ejs
- marked
- highlight.js
- tailwindcss
- postcss
- autoprefixer
- sass
- concurrently
- nodemon
- pm2
- cross-env
- husky
- lint-staged
- jquery
- underscore
- luxon
- validator
- qs
- deepmerge
- superagent
- form-data
- follow-redirects
- gulp
- grunt
- browserify
- terser
- ts-node
- tsx
- ava
- tape
- sinon
- nyc
- supertest
- kleur
- picocolors
- boxen
- prompts
- enquirer
- meow
- figlet
- immutable
- mobx
- xstate
- typeorm
- better-sqlite3
- sqlite3
- mongodb
- archiver
- adm-zip
- tar
- unzipper
- ajv
- crypto-js
- bcryptjs
- argon2
- jose
- pug
- mustache
- nunjucks
- markdown-it
- cross-spawn
- execa
- shelljs
- del
- minimist
- minimatch
- fast-glob
- globby
- cosmiconfig
- morgan
- compression
- http-proxy
- node-cron
- dompurify
- sanitize-html