# npm package vulnerabilities

Source: https://junglewise.ai/threats/vendors/npm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/npm.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 7,030 vulnerabilities in npm packages: 32 in the last 7 days and 929 in the last 90 days, 348 of them critical and 11 exploited in the wild. The most recent, CVE-2026-128065, was published on 13 November 2026. 262 vulnerabilities in the last four weeks, down 37% on the four before (415). 18 critical against 69. 472 packages have a page of their own.

## Counts

- Last 7 days: 32
- Last 30 days: 278
- Last 90 days: 929
- All time: 7030 (348 critical, 11 exploited in the wild)

## About npm

npm is a package manager and registry for JavaScript and Node.js packages.

## Latest npm package vulnerabilities

- [CVE-2026-128065: grpc-js-xds RBAC override policy bypass](https://junglewise.ai/threats/cve-2026-128065-grpc-grpc-js-rbac-override-configs-in-virtualhost-and-route) (medium, CVSS 4, published 13 Nov 2026)
- [CVE-2026-126367: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and…](https://junglewise.ai/threats/cve-2026-126367-grpc-grpc-js-safe-regex-incorrectly-applies-partial-string) (medium, CVSS 4.8, published 13 Nov 2026)
- [CVE-2026-126363: Astro @astrojs/solid-js HTML injection in slot names](https://junglewise.ai/threats/cve-2026-126363-astro-reflected-xss-via-unescaped-slot-names-in-astrojs-solid-js) (medium, CVSS 4, published 13 Nov 2026)
- [CVE-2026-126362: Astro @astrojs/svelte renderer HTML injection via unescaped slot names](https://junglewise.ai/threats/cve-2026-126362-astro-reflected-xss-via-unescaped-slot-names-in-astrojs-svelte) (medium, CVSS 4, published 13 Nov 2026)
- [CVE-2026-126359: Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML…](https://junglewise.ai/threats/cve-2026-126359-hono-css-helper-does-not-escape-a-closing-tag-split-between-the) (low, CVSS 3.4, published 13 Nov 2026)
- [CVE-2026-126358: Hono RegExpRouter middleware bypass via wildcard matching](https://junglewise.ai/threats/cve-2026-126358-hono-regexprouter-skips-wildcard-middleware-for-some-route-sets) (medium, CVSS 5.3, published 13 Nov 2026)
- [CVE-2026-126357: Hono mount() path traversal bypasses middleware scoping](https://junglewise.ai/threats/cve-2026-126357-hono-mount-and-app-mount-can-forward-a-path-that-bypasses) (medium, CVSS 5.3, published 13 Nov 2026)
- [CVE-2026-126356: Hono validator form multipart/form-data parameter bypass](https://junglewise.ai/threats/cve-2026-126356-hono-validator-form-skips-validation-for-multipart-form-data) (medium, CVSS 5.3, published 13 Nov 2026)
- [CVE-2026-126355: Hono csrf() middleware bypass via hyperlink auditing](https://junglewise.ai/threats/cve-2026-126355-hono-csrf-does-not-check-requests-sent-by-hyperlink-auditing) (medium, CVSS 5.3, published 13 Nov 2026)
- [CVE-2026-126346: basic-ftp unhandled exception in control socket event handler](https://junglewise.ai/threats/cve-2026-126346-basic-ftp-uncaught-exception-crashes-the-node-js-process-when-a) (medium, CVSS 5.9, published 12 Nov 2026)
- [CVE-2026-126345: basic-ftp MLSD parser prototype pollution](https://junglewise.ai/threats/cve-2026-126345-basic-ftp-uncaught-typeerror-in-mlsd-directory-listing-parser) (medium, CVSS 5.3, published 12 Nov 2026)
- [CVE-2026-126343: @hono/node-server WebSocket ECONNRESET denial of service](https://junglewise.ai/threats/cve-2026-126343-hono-node-server-unhandled-econnreset-on-the-socket-during-an) (medium, CVSS 5.3, published 12 Nov 2026)
- [CVE-2026-126210: @hono/node-server path traversal via backslash bypass](https://junglewise.ai/threats/cve-2026-126210-hono-node-server-backslash-in-the-request-path-is-parsed-as-a) (medium, CVSS 5.3, published 12 Nov 2026)
- [Signal K Server buffered logs exposure in unauthenticated WebSocket](https://junglewise.ai/threats/signal-k-server-buffered-logs-exposed-to-unauthenticated-websocket-b7032aad) (medium, CVSS 5.3, published 12 Nov 2026)
- [CVE-2026-127109: promzard code injection in template-loading via unescaped context property names](https://junglewise.ai/threats/cve-2026-127109-a-code-injection-vulnerability-in-promzard-s-template-loading) (info, published 12 Nov 2026)
- [CVE-2026-126187: React Server Components remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-126187-react-unauthenticated-remote-code-execution-in-react-server) (critical, CVSS 4, published 10 Nov 2026)
- [CVE-2026-126066: fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags](https://junglewise.ai/threats/cve-2026-126066-fast-xml-parser-allows-users-to-process-xml-from-js-object) (low, CVSS 3.7, published 10 Nov 2026)
- [CVE-2026-125335: Forge: Ed25519 signature verification accepts small-order public keys](https://junglewise.ai/threats/cve-2026-125335-forge-also-called-node-forge-is-a-native-implementation-of) (low, CVSS 3.7, published 10 Nov 2026)
- [CVE-2026-125334: Forge TLS client crash on handshake record without session](https://junglewise.ai/threats/cve-2026-125334-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026)
- [CVE-2026-125333: Forge HTTP ReDoS in response header parsing](https://junglewise.ai/threats/cve-2026-125333-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026)
- [CVE-2026-125332: Forge TLS client crash on unsupported ServerHello compression](https://junglewise.ai/threats/cve-2026-125332-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026)
- [CVE-2026-120792: .NET Aspire sensitive information insertion in log file](https://junglewise.ai/threats/cve-2026-120792-insertion-of-sensitive-information-into-log-file-in-net-aspire) (high, CVSS 7.3, published 10 Nov 2026)
- [CVE-2026-120778: .NET Aspire insecure temporary file creation local privilege escalation](https://junglewise.ai/threats/cve-2026-120778-creation-of-temporary-file-in-directory-with-insecure) (high, CVSS 7.3, published 10 Nov 2026)
- [CVE-2026-79914: NocoBase server-side request forgery in customRequests:send](https://junglewise.ai/threats/cve-2026-79914-nocobase-is-an-ai-powered-no-code-low-code-platform-for-building) (medium, CVSS 4.3, published 10 Nov 2026)
- [CVE-2026-119192: Forge RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding](https://junglewise.ai/threats/cve-2026-119192-forge-rsa-pkcs-1-v1-5-signature-forgery-via-non-canonical) (high, CVSS 7.5, published 10 Nov 2026)

## Most severe npm package vulnerabilities

- [CVE-2025-55182: React Server Components are Vulnerable to RCE](https://junglewise.ai/threats/cve-2025-55182-meta-react-server-components-remote-code-execution) (critical, exploited in the wild, CVSS 10, published 3 Dec 2025)
- [CVE-2025-68613: n8n Vulnerable to Remote Code Execution via Expression Injection](https://junglewise.ai/threats/cve-2025-68613-n8n-remote-code-execution-in-workflow-expression-evaluation) (critical, exploited in the wild, CVSS 9.9, published 19 Dec 2025)
- [CVE-2026-45321: TanStack npm packages supply chain compromise via GitHub Actions OIDC hijacking](https://junglewise.ai/threats/cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions) (critical, exploited in the wild, CVSS 9.6, published 12 May 2026)
- [CVE-2023-4863: RUSTSEC-2023-0060 - libwebp: OOB write in BuildHuffmanTable](https://junglewise.ai/threats/cve-2023-4863-google-chromium-webp-heap-based-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 12 Sep 2023)
- [CVE-2019-10758: mongo-express remote code execution in index creation](https://junglewise.ai/threats/cve-2019-10758-mongodb-mongo-express-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 30 Dec 2019)
- [CVE-2023-5217: Electron heap buffer overflow in libvpx vp8 encoding](https://junglewise.ai/threats/cve-2023-5217-google-chromium-libvpx-heap-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 28 Sep 2023)
- [CVE-2022-4135: Google Chrome heap buffer overflow in GPU](https://junglewise.ai/threats/cve-2022-4135-google-chromium-gpu-heap-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 25 Nov 2022)
- [CVE-2025-54313: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code](https://junglewise.ai/threats/cve-2025-54313-prettier-eslint-config-prettier-embedded-malicious-code) (critical, exploited in the wild, CVSS 3.1, published 19 Jul 2025)
- [CVE-2023-22894: Strapi information disclosure via private field filtering](https://junglewise.ai/threats/cve-2023-22894-strapi-information-disclosure-via-private-field-filtering) (critical, exploited in the wild, CVSS 3.1, published 19 Apr 2023)
- [CVE-2021-21315: System Information Library for Node.JS Command Injection](https://junglewise.ai/threats/cve-2021-21315-system-information-library-for-node-js-command-injection) (critical, exploited in the wild, CVSS 3.1, published 16 Feb 2021)

## Vulnerabilities per week

262 vulnerabilities in the last four weeks, down 37% on the four before (415). 18 critical against 69.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 63 | 16 | 0 |
| 24 Aug 2026 | 31 | 1 | 0 |
| 31 Aug 2026 | 89 | 6 | 0 |
| 7 Sep 2026 | 39 | 3 | 0 |
| 14 Sep 2026 | 132 | 43 | 0 |
| 21 Sep 2026 | 40 | 5 | 0 |
| 28 Sep 2026 | 105 | 9 | 0 |
| 5 Oct 2026 | 138 | 12 | 0 |
| 12 Oct 2026 | 45 | 6 | 0 |
| 19 Oct 2026 | 109 | 6 | 0 |
| 26 Oct 2026 | 79 | 1 | 0 |
| 2 Nov 2026 | 29 | 5 | 0 |
| 9 Nov 2026 | 30 | 2 | 0 |

## npm packages

- [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities
- [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities
- [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities
- [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities
- [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities
- [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities
- [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities
- [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities
- [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities
- [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities
- [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities
- [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities
- [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe): 36 vulnerabilities
- [dompurify (npm)](https://junglewise.ai/threats/technologies/dompurify): 36 vulnerabilities
- [node-forge (npm)](https://junglewise.ai/threats/technologies/node-forge): 36 vulnerabilities
- [flowise-components (npm)](https://junglewise.ai/threats/technologies/flowise-components): 33 vulnerabilities
- [astro (npm)](https://junglewise.ai/threats/technologies/astro): 31 vulnerabilities
- [pnpm (npm)](https://junglewise.ai/threats/technologies/pnpm): 31 vulnerabilities
- [@anthropic-ai/claude-code (npm)](https://junglewise.ai/threats/technologies/anthropic-ai-claude-code): 30 vulnerabilities
- [axios (npm)](https://junglewise.ai/threats/technologies/npm-axios): 29 vulnerabilities
- [nuxt (npm)](https://junglewise.ai/threats/technologies/nuxt): 29 vulnerabilities
- [payload (npm)](https://junglewise.ai/threats/technologies/payload): 29 vulnerabilities
- [better-auth (npm)](https://junglewise.ai/threats/technologies/better-auth): 28 vulnerabilities
- [next (npm)](https://junglewise.ai/threats/technologies/npm-next): 26 vulnerabilities
- [9router (npm)](https://junglewise.ai/threats/technologies/9router): 24 vulnerabilities
- [mongoose (npm)](https://junglewise.ai/threats/technologies/mongoose): 24 vulnerabilities
- [tinymce (npm)](https://junglewise.ai/threats/technologies/tinymce): 24 vulnerabilities
- [@xmldom/xmldom (npm)](https://junglewise.ai/threats/technologies/xmldom-xmldom): 23 vulnerabilities
- [fuxa-server (npm)](https://junglewise.ai/threats/technologies/fuxa-server): 22 vulnerabilities
- [renovate (npm)](https://junglewise.ai/threats/technologies/renovate): 21 vulnerabilities
- [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit): 21 vulnerabilities
- [@openzeppelin/contracts-upgradeable (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts-upgradeable): 20 vulnerabilities
- [electerm (npm)](https://junglewise.ai/threats/technologies/electerm): 19 vulnerabilities
- [liquidjs (npm)](https://junglewise.ai/threats/technologies/liquidjs): 19 vulnerabilities
- [sequelize (npm)](https://junglewise.ai/threats/technologies/sequelize): 19 vulnerabilities
- [xmldom (npm)](https://junglewise.ai/threats/technologies/xmldom): 19 vulnerabilities
- [@openzeppelin/contracts (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts): 18 vulnerabilities
- [@backstage/plugin-scaffolder-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-scaffolder-backend): 17 vulnerabilities
- [fastify (npm)](https://junglewise.ai/threats/technologies/fastify): 17 vulnerabilities
- [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri): 17 vulnerabilities
- [handlebars (npm)](https://junglewise.ai/threats/technologies/npm-handlebars): 17 vulnerabilities
- [marked (npm)](https://junglewise.ai/threats/technologies/npm-marked): 17 vulnerabilities
- [nodemailer (npm)](https://junglewise.ai/threats/technologies/npm-nodemailer): 17 vulnerabilities
- [tar (npm)](https://junglewise.ai/threats/technologies/npm-tar): 17 vulnerabilities
- [protobufjs (npm)](https://junglewise.ai/threats/technologies/protobufjs): 17 vulnerabilities
- [sanitize-html (npm)](https://junglewise.ai/threats/technologies/sanitize-html): 17 vulnerabilities
- [signalk-server (npm)](https://junglewise.ai/threats/technologies/signalk-server): 17 vulnerabilities
- [systeminformation (npm)](https://junglewise.ai/threats/technologies/systeminformation): 17 vulnerabilities
- [devalue (npm)](https://junglewise.ai/threats/technologies/devalue): 16 vulnerabilities
- [@haxtheweb/haxcms-nodejs (npm)](https://junglewise.ai/threats/technologies/haxtheweb-haxcms-nodejs): 16 vulnerabilities
- [mermaid (npm)](https://junglewise.ai/threats/technologies/mermaid): 16 vulnerabilities
- [angular (npm)](https://junglewise.ai/threats/technologies/angular): 15 vulnerabilities
- [ckeditor4 (npm)](https://junglewise.ai/threats/technologies/ckeditor4): 15 vulnerabilities
- [jspdf (npm)](https://junglewise.ai/threats/technologies/jspdf): 15 vulnerabilities
- [multer (npm)](https://junglewise.ai/threats/technologies/npm-multer): 15 vulnerabilities
- [fast-jwt (npm)](https://junglewise.ai/threats/technologies/fast-jwt): 14 vulnerabilities
- [jsrsasign (npm)](https://junglewise.ai/threats/technologies/jsrsasign): 14 vulnerabilities
- [@nyariv/sandboxjs (npm)](https://junglewise.ai/threats/technologies/nyariv-sandboxjs): 14 vulnerabilities
- [shescape (npm)](https://junglewise.ai/threats/technologies/shescape): 14 vulnerabilities
- [svelte (npm)](https://junglewise.ai/threats/technologies/svelte): 14 vulnerabilities
- [swagger-ui (npm)](https://junglewise.ai/threats/technologies/swagger-ui): 14 vulnerabilities
- [@directus/api (npm)](https://junglewise.ai/threats/technologies/directus-api): 13 vulnerabilities
- [fast-xml-parser (npm)](https://junglewise.ai/threats/technologies/fast-xml-parser): 13 vulnerabilities
- [next-auth (npm)](https://junglewise.ai/threats/technologies/next-auth): 13 vulnerabilities
- [seroval (npm)](https://junglewise.ai/threats/technologies/seroval): 13 vulnerabilities
- [strapi (npm)](https://junglewise.ai/threats/technologies/strapi): 13 vulnerabilities
- [vite-plus (npm)](https://junglewise.ai/threats/technologies/vite-plus): 13 vulnerabilities
- [@angular/platform-server (npm)](https://junglewise.ai/threats/technologies/angular-platform-server): 12 vulnerabilities
- [bootstrap (npm)](https://junglewise.ai/threats/technologies/bootstrap): 12 vulnerabilities
- [clawdbot (npm)](https://junglewise.ai/threats/technologies/clawdbot): 12 vulnerabilities
- [@evershop/evershop (npm)](https://junglewise.ai/threats/technologies/evershop-evershop): 12 vulnerabilities
- [js-yaml (npm)](https://junglewise.ai/threats/technologies/js-yaml): 12 vulnerabilities
- [matrix-js-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-js-sdk): 12 vulnerabilities
- [npm (npm)](https://junglewise.ai/threats/technologies/npm): 12 vulnerabilities
- [orval (npm)](https://junglewise.ai/threats/technologies/orval): 12 vulnerabilities
- [uptime-kuma (npm)](https://junglewise.ai/threats/technologies/uptime-kuma): 12 vulnerabilities
- [adm-zip (npm)](https://junglewise.ai/threats/technologies/adm-zip): 11 vulnerabilities
- [h3 (npm)](https://junglewise.ai/threats/technologies/h3): 11 vulnerabilities
- [@lobehub/chat (npm)](https://junglewise.ai/threats/technologies/lobehub-chat): 11 vulnerabilities
- [n8n-mcp (npm)](https://junglewise.ai/threats/technologies/n8n-mcp): 11 vulnerabilities
- [validator (npm)](https://junglewise.ai/threats/technologies/npm-validator): 11 vulnerabilities
- [@oneuptime/common (npm)](https://junglewise.ai/threats/technologies/oneuptime-common): 11 vulnerabilities
- [sillytavern (npm)](https://junglewise.ai/threats/technologies/sillytavern): 11 vulnerabilities
- [@strapi/strapi (npm)](https://junglewise.ai/threats/technologies/strapi-strapi): 11 vulnerabilities
- [@apostrophecms/import-export (npm)](https://junglewise.ai/threats/technologies/apostrophecms-import-export): 10 vulnerabilities
- [brace-expansion (npm)](https://junglewise.ai/threats/technologies/brace-expansion): 10 vulnerabilities
- [highcharts (npm)](https://junglewise.ai/threats/technologies/highcharts): 10 vulnerabilities
- [ip-address (npm)](https://junglewise.ai/threats/technologies/ip-address): 10 vulnerabilities
- [@backstage/plugin-techdocs-node (npm)](https://junglewise.ai/threats/technologies/npm-backstage-plugin-techdocs-node): 10 vulnerabilities
- [open-webui (npm)](https://junglewise.ai/threats/technologies/npm-open-webui): 10 vulnerabilities
- [trigger.dev (npm)](https://junglewise.ai/threats/technologies/npm-trigger-dev): 10 vulnerabilities
- [simple-git (npm)](https://junglewise.ai/threats/technologies/simple-git): 10 vulnerabilities
- [@angular/core (npm)](https://junglewise.ai/threats/technologies/angular-core): 9 vulnerabilities
- [@astrojs/node (npm)](https://junglewise.ai/threats/technologies/astrojs-node): 9 vulnerabilities
- [elliptic (npm)](https://junglewise.ai/threats/technologies/elliptic): 9 vulnerabilities
- [@hono/node-server (npm)](https://junglewise.ai/threats/technologies/hono-node-server): 9 vulnerabilities
- [lodash (npm)](https://junglewise.ai/threats/technologies/lodash): 9 vulnerabilities
- [matrix-appservice-irc (npm)](https://junglewise.ai/threats/technologies/matrix-appservice-irc): 9 vulnerabilities
- [@modelcontextprotocol/sdk (npm)](https://junglewise.ai/threats/technologies/modelcontextprotocol-sdk): 9 vulnerabilities
- [praisonai (npm)](https://junglewise.ai/threats/technologies/npm-praisonai): 9 vulnerabilities
- [serve (npm)](https://junglewise.ai/threats/technologies/serve): 9 vulnerabilities
- [@tinacms/cli (npm)](https://junglewise.ai/threats/technologies/tinacms-cli): 9 vulnerabilities
- [@actual-app/sync-server (npm)](https://junglewise.ai/threats/technologies/actual-app-sync-server): 8 vulnerabilities
- [apollo-server (npm)](https://junglewise.ai/threats/technologies/apollo-server): 8 vulnerabilities
- [aws-cdk-lib (npm)](https://junglewise.ai/threats/technologies/aws-cdk-lib): 8 vulnerabilities
- [basic-ftp (npm)](https://junglewise.ai/threats/technologies/basic-ftp): 8 vulnerabilities
- [@builder.io/qwik-city (npm)](https://junglewise.ai/threats/technologies/builder-io-qwik-city): 8 vulnerabilities
- [editor.md (npm)](https://junglewise.ai/threats/technologies/editor-md): 8 vulnerabilities
- [express-cart (npm)](https://junglewise.ai/threats/technologies/express-cart): 8 vulnerabilities
- [follow-redirects (npm)](https://junglewise.ai/threats/technologies/follow-redirects): 8 vulnerabilities
- [hapi (npm)](https://junglewise.ai/threats/technologies/hapi): 8 vulnerabilities
- [happy-dom (npm)](https://junglewise.ai/threats/technologies/happy-dom): 8 vulnerabilities
- [jquery-ui (npm)](https://junglewise.ai/threats/technologies/jquery-ui): 8 vulnerabilities
- [@keystone-6/core (npm)](https://junglewise.ai/threats/technologies/keystone-6-core): 8 vulnerabilities
- [locutus (npm)](https://junglewise.ai/threats/technologies/locutus): 8 vulnerabilities
- [matrix-react-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-react-sdk): 8 vulnerabilities
- [msgpack5 (npm)](https://junglewise.ai/threats/technologies/msgpack5): 8 vulnerabilities
- [@paperclipai/server (npm)](https://junglewise.ai/threats/technologies/paperclipai-server): 8 vulnerabilities
- [react-server-dom-parcel (npm)](https://junglewise.ai/threats/technologies/react-server-dom-parcel): 8 vulnerabilities
- [react-server-dom-turbopack (npm)](https://junglewise.ai/threats/technologies/react-server-dom-turbopack): 8 vulnerabilities
- [react-server-dom-webpack (npm)](https://junglewise.ai/threats/technologies/react-server-dom-webpack): 8 vulnerabilities
- [serialize-javascript (npm)](https://junglewise.ai/threats/technologies/serialize-javascript): 8 vulnerabilities
- [steal (npm)](https://junglewise.ai/threats/technologies/steal): 8 vulnerabilities
- [@strapi/plugin-users-permissions (npm)](https://junglewise.ai/threats/technologies/strapi-plugin-users-permissions): 8 vulnerabilities
- [tarteaucitronjs (npm)](https://junglewise.ai/threats/technologies/tarteaucitronjs): 8 vulnerabilities
- [trix (npm)](https://junglewise.ai/threats/technologies/trix): 8 vulnerabilities
- [urijs (npm)](https://junglewise.ai/threats/technologies/urijs): 8 vulnerabilities
- [url-parse (npm)](https://junglewise.ai/threats/technologies/url-parse): 8 vulnerabilities
- [vega (npm)](https://junglewise.ai/threats/technologies/vega): 8 vulnerabilities
- [ws (npm)](https://junglewise.ai/threats/technologies/ws): 8 vulnerabilities
- [@aborruso/ckan-mcp-server (npm)](https://junglewise.ai/threats/technologies/aborruso-ckan-mcp-server): 7 vulnerabilities
- [@angular/compiler (npm)](https://junglewise.ai/threats/technologies/angular-compiler): 7 vulnerabilities
- [@angular/ssr (npm)](https://junglewise.ai/threats/technologies/angular-ssr): 7 vulnerabilities
- [@asymmetric-effort/specifyjs (npm)](https://junglewise.ai/threats/technologies/asymmetric-effort-specifyjs): 7 vulnerabilities
- [@auth0/nextjs-auth0 (npm)](https://junglewise.ai/threats/technologies/auth0-nextjs-auth0): 7 vulnerabilities
- [bootstrap-sass (npm)](https://junglewise.ai/threats/technologies/bootstrap-sass): 7 vulnerabilities
- [budibase (npm)](https://junglewise.ai/threats/technologies/budibase): 7 vulnerabilities
- [engine.io (npm)](https://junglewise.ai/threats/technologies/engine-io): 7 vulnerabilities
- [generator-jhipster (npm)](https://junglewise.ai/threats/technologies/generator-jhipster): 7 vulnerabilities
- [hermes-engine (npm)](https://junglewise.ai/threats/technologies/hermes-engine): 7 vulnerabilities
- [@highcharts/dashboards (npm)](https://junglewise.ai/threats/technologies/highcharts-dashboards): 7 vulnerabilities
- [@hulumi/policies (npm)](https://junglewise.ai/threats/technologies/hulumi-policies): 7 vulnerabilities
- [jodit (npm)](https://junglewise.ai/threats/technologies/jodit): 7 vulnerabilities
- [joi (npm)](https://junglewise.ai/threats/technologies/joi): 7 vulnerabilities
- [lodash-es (npm)](https://junglewise.ai/threats/technologies/lodash-es): 7 vulnerabilities
- [lunary (npm)](https://junglewise.ai/threats/technologies/lunary): 7 vulnerabilities
- [markdown-it (npm)](https://junglewise.ai/threats/technologies/markdown-it): 7 vulnerabilities
- [mysql2 (npm)](https://junglewise.ai/threats/technologies/mysql2): 7 vulnerabilities
- [node-opcua (npm)](https://junglewise.ai/threats/technologies/node-opcua): 7 vulnerabilities
- [mariadb (npm)](https://junglewise.ai/threats/technologies/npm-mariadb): 7 vulnerabilities
- [network-ai (npm)](https://junglewise.ai/threats/technologies/npm-network-ai): 7 vulnerabilities
- [obsidian-tc (npm)](https://junglewise.ai/threats/technologies/npm-obsidian-tc): 7 vulnerabilities
- [postcss (npm)](https://junglewise.ai/threats/technologies/postcss): 7 vulnerabilities
- [@saltcorn/server (npm)](https://junglewise.ai/threats/technologies/saltcorn-server): 7 vulnerabilities
- [snyk-broker (npm)](https://junglewise.ai/threats/technologies/snyk-broker): 7 vulnerabilities
- [studiocms (npm)](https://junglewise.ai/threats/technologies/studiocms): 7 vulnerabilities
- [@sync-in/server (npm)](https://junglewise.ai/threats/technologies/sync-in-server): 7 vulnerabilities
- [total.js (npm)](https://junglewise.ai/threats/technologies/total-js): 7 vulnerabilities
- [ua-parser-js (npm)](https://junglewise.ai/threats/technologies/ua-parser-js): 7 vulnerabilities
- [@vendure/core (npm)](https://junglewise.ai/threats/technologies/vendure-core): 7 vulnerabilities
- [@vitejs/plugin-rsc (npm)](https://junglewise.ai/threats/technologies/vitejs-plugin-rsc): 7 vulnerabilities
- [webpack-dev-server (npm)](https://junglewise.ai/threats/technologies/webpack-dev-server): 7 vulnerabilities
- [aaptjs (npm)](https://junglewise.ai/threats/technologies/aaptjs): 6 vulnerabilities
- [@budibase/backend-core (npm)](https://junglewise.ai/threats/technologies/budibase-backend-core): 6 vulnerabilities
- [ep_etherpad-lite (npm)](https://junglewise.ai/threats/technologies/ep-etherpad-lite): 6 vulnerabilities
- [@evomap/evolver (npm)](https://junglewise.ai/threats/technologies/evomap-evolver): 6 vulnerabilities
- [@fastify/static (npm)](https://junglewise.ai/threats/technologies/fastify-static): 6 vulnerabilities
- [@frangoteam/fuxa (npm)](https://junglewise.ai/threats/technologies/frangoteam-fuxa): 6 vulnerabilities
- [@grpc/grpc-js (npm)](https://junglewise.ai/threats/technologies/grpc-grpc-js): 6 vulnerabilities
- [@intlify/vue-i18n-core (npm)](https://junglewise.ai/threats/technologies/intlify-vue-i18n-core): 6 vulnerabilities
- [katex (npm)](https://junglewise.ai/threats/technologies/katex): 6 vulnerabilities
- [mcp-server-kubernetes (npm)](https://junglewise.ai/threats/technologies/mcp-server-kubernetes): 6 vulnerabilities
- [minimatch (npm)](https://junglewise.ai/threats/technologies/minimatch): 6 vulnerabilities
- [music-metadata (npm)](https://junglewise.ai/threats/technologies/music-metadata): 6 vulnerabilities
- [@angular/common (npm)](https://junglewise.ai/threats/technologies/npm-angular-common): 6 vulnerabilities
- [keystone (npm)](https://junglewise.ai/threats/technologies/npm-keystone): 6 vulnerabilities
- [nuxt-og-image (npm)](https://junglewise.ai/threats/technologies/nuxt-og-image): 6 vulnerabilities
- [openpgp (npm)](https://junglewise.ai/threats/technologies/openpgp): 6 vulnerabilities
- [parse-url (npm)](https://junglewise.ai/threats/technologies/parse-url): 6 vulnerabilities
- [passport-wsfed-saml2 (npm)](https://junglewise.ai/threats/technologies/passport-wsfed-saml2): 6 vulnerabilities
- [petite-vue-i18n (npm)](https://junglewise.ai/threats/technologies/petite-vue-i18n): 6 vulnerabilities
- [prismjs (npm)](https://junglewise.ai/threats/technologies/prismjs): 6 vulnerabilities
- [quill (npm)](https://junglewise.ai/threats/technologies/quill): 6 vulnerabilities
- [rsshub (npm)](https://junglewise.ai/threats/technologies/rsshub): 6 vulnerabilities
- [safe-eval (npm)](https://junglewise.ai/threats/technologies/safe-eval): 6 vulnerabilities
- [@steipete/summarize (npm)](https://junglewise.ai/threats/technologies/steipete-summarize): 6 vulnerabilities
- [swagger-typescript-api (npm)](https://junglewise.ai/threats/technologies/swagger-typescript-api): 6 vulnerabilities
- [typeorm (npm)](https://junglewise.ai/threats/technologies/typeorm): 6 vulnerabilities
- [unleash-server (npm)](https://junglewise.ai/threats/technologies/unleash-server): 6 vulnerabilities
- [@vitest/browser (npm)](https://junglewise.ai/threats/technologies/vitest-browser): 6 vulnerabilities
- [vue-i18n (npm)](https://junglewise.ai/threats/technologies/vue-i18n): 6 vulnerabilities
- [apollo-server-core (npm)](https://junglewise.ai/threats/technologies/apollo-server-core): 5 vulnerabilities
- [auth0-js (npm)](https://junglewise.ai/threats/technologies/auth0-js): 5 vulnerabilities
- [@backstage/backend-defaults (npm)](https://junglewise.ai/threats/technologies/backstage-backend-defaults): 5 vulnerabilities
- [@backstage/plugin-catalog-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-catalog-backend): 5 vulnerabilities
- [@builder.io/qwik (npm)](https://junglewise.ai/threats/technologies/builder-io-qwik): 5 vulnerabilities
- [ckeditor5 (npm)](https://junglewise.ai/threats/technologies/ckeditor5): 5 vulnerabilities
- [convict (npm)](https://junglewise.ai/threats/technologies/convict): 5 vulnerabilities
- [dns-sync (npm)](https://junglewise.ai/threats/technologies/dns-sync): 5 vulnerabilities
- [dojo (npm)](https://junglewise.ai/threats/technologies/dojo): 5 vulnerabilities
- [ecstatic (npm)](https://junglewise.ai/threats/technologies/ecstatic): 5 vulnerabilities
- [ejs (npm)](https://junglewise.ai/threats/technologies/ejs): 5 vulnerabilities
- [exceljs (npm)](https://junglewise.ai/threats/technologies/exceljs): 5 vulnerabilities
- [froala-editor (npm)](https://junglewise.ai/threats/technologies/froala-editor): 5 vulnerabilities
- [glance (npm)](https://junglewise.ai/threats/technologies/glance): 5 vulnerabilities
- [@grackle-ai/server (npm)](https://junglewise.ai/threats/technologies/grackle-ai-server): 5 vulnerabilities
- [@highcharts/grid-pro (npm)](https://junglewise.ai/threats/technologies/highcharts-grid-pro): 5 vulnerabilities
- [http-proxy-middleware (npm)](https://junglewise.ai/threats/technologies/http-proxy-middleware): 5 vulnerabilities
- [i18next-http-backend (npm)](https://junglewise.ai/threats/technologies/i18next-http-backend): 5 vulnerabilities
- [@intlify/core (npm)](https://junglewise.ai/threats/technologies/intlify-core): 5 vulnerabilities
- [@intlify/core-base (npm)](https://junglewise.ai/threats/technologies/intlify-core-base): 5 vulnerabilities
- [isomorphic-git (npm)](https://junglewise.ai/threats/technologies/isomorphic-git): 5 vulnerabilities
- [jsonwebtoken (npm)](https://junglewise.ai/threats/technologies/jsonwebtoken): 5 vulnerabilities
- [mathjs (npm)](https://junglewise.ai/threats/technologies/mathjs): 5 vulnerabilities
- [mcp-searxng (npm)](https://junglewise.ai/threats/technologies/mcp-searxng): 5 vulnerabilities
- [muhammara (npm)](https://junglewise.ai/threats/technologies/muhammara): 5 vulnerabilities
- [nanoid (npm)](https://junglewise.ai/threats/technologies/nanoid): 5 vulnerabilities
- [@nestjs/platform-fastify (npm)](https://junglewise.ai/threats/technologies/nestjs-platform-fastify): 5 vulnerabilities
- [decompress (npm)](https://junglewise.ai/threats/technologies/npm-decompress): 5 vulnerabilities
- [elysia (npm)](https://junglewise.ai/threats/technologies/npm-elysia): 5 vulnerabilities
- [joplin (npm)](https://junglewise.ai/threats/technologies/npm-joplin): 5 vulnerabilities
- [magicmirror (npm)](https://junglewise.ai/threats/technologies/npm-magicmirror): 5 vulnerabilities
- [@quasar/app-vite (npm)](https://junglewise.ai/threats/technologies/npm-quasar-app-vite): 5 vulnerabilities
- [path-to-regexp (npm)](https://junglewise.ai/threats/technologies/path-to-regexp): 5 vulnerabilities
- [@perfood/couch-auth (npm)](https://junglewise.ai/threats/technologies/perfood-couch-auth): 5 vulnerabilities
- [public (npm)](https://junglewise.ai/threats/technologies/public): 5 vulnerabilities
- [rendertron (npm)](https://junglewise.ai/threats/technologies/rendertron): 5 vulnerabilities
- [safer-eval (npm)](https://junglewise.ai/threats/technologies/safer-eval): 5 vulnerabilities
- [@samanhappy/mcphub (npm)](https://junglewise.ai/threats/technologies/samanhappy-mcphub): 5 vulnerabilities
- [@sequelize/core (npm)](https://junglewise.ai/threats/technologies/sequelize-core): 5 vulnerabilities
- [shell-quote (npm)](https://junglewise.ai/threats/technologies/shell-quote): 5 vulnerabilities
- [snowflake-sdk (npm)](https://junglewise.ai/threats/technologies/snowflake-sdk): 5 vulnerabilities
- [@strapi/admin (npm)](https://junglewise.ai/threats/technologies/strapi-admin): 5 vulnerabilities
- [sweetalert2 (npm)](https://junglewise.ai/threats/technologies/sweetalert2): 5 vulnerabilities
- [tinacms (npm)](https://junglewise.ai/threats/technologies/tinacms): 5 vulnerabilities
- [@tinacms/graphql (npm)](https://junglewise.ai/threats/technologies/tinacms-graphql): 5 vulnerabilities
- [toml (npm)](https://junglewise.ai/threats/technologies/toml): 5 vulnerabilities
- [total4 (npm)](https://junglewise.ai/threats/technologies/total4): 5 vulnerabilities
- [vditor (npm)](https://junglewise.ai/threats/technologies/vditor): 5 vulnerabilities
- [vega-functions (npm)](https://junglewise.ai/threats/technologies/vega-functions): 5 vulnerabilities
- [xlsx (npm)](https://junglewise.ai/threats/technologies/xlsx): 5 vulnerabilities
- [yarn (npm)](https://junglewise.ai/threats/technologies/yarn): 5 vulnerabilities
- [@apollo/gateway (npm)](https://junglewise.ai/threats/technologies/apollo-gateway): 4 vulnerabilities
- [auth0-lock (npm)](https://junglewise.ai/threats/technologies/auth0-lock): 4 vulnerabilities
- [aws-iot-device-sdk-v2 (npm)](https://junglewise.ai/threats/technologies/aws-iot-device-sdk-v2): 4 vulnerabilities
- [@backstage/plugin-auth-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-auth-backend): 4 vulnerabilities
- [@backstage/plugin-techdocs-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-techdocs-backend): 4 vulnerabilities
- [bestzip (npm)](https://junglewise.ai/threats/technologies/bestzip): 4 vulnerabilities
- [@better-auth/oauth-provider (npm)](https://junglewise.ai/threats/technologies/better-auth-oauth-provider): 4 vulnerabilities
- [braces (npm)](https://junglewise.ai/threats/technologies/braces): 4 vulnerabilities
- [@clerk/nextjs (npm)](https://junglewise.ai/threats/technologies/clerk-nextjs): 4 vulnerabilities
- [@cloudflare/workers-oauth-provider (npm)](https://junglewise.ai/threats/technologies/cloudflare-workers-oauth-provider): 4 vulnerabilities
- [code-server (npm)](https://junglewise.ai/threats/technologies/code-server): 4 vulnerabilities
- [convert-svg-core (npm)](https://junglewise.ai/threats/technologies/convert-svg-core): 4 vulnerabilities
- [@dynatrace-oss/dynatrace-mcp-server (npm)](https://junglewise.ai/threats/technologies/dynatrace-oss-dynatrace-mcp-server): 4 vulnerabilities
- [@earendil-works/pi-coding-agent (npm)](https://junglewise.ai/threats/technologies/earendil-works-pi-coding-agent): 4 vulnerabilities
- [erxes (npm)](https://junglewise.ai/threats/technologies/erxes): 4 vulnerabilities
- [express-xss-sanitizer (npm)](https://junglewise.ai/threats/technologies/express-xss-sanitizer): 4 vulnerabilities
- [@fastify/middie (npm)](https://junglewise.ai/threats/technologies/fastify-middie): 4 vulnerabilities
- [@fastify/reply-from (npm)](https://junglewise.ai/threats/technologies/fastify-reply-from): 4 vulnerabilities
- [@feathersjs/authentication-oauth (npm)](https://junglewise.ai/threats/technologies/feathersjs-authentication-oauth): 4 vulnerabilities
- [@finos/git-proxy (npm)](https://junglewise.ai/threats/technologies/finos-git-proxy): 4 vulnerabilities
- [@hapi/content (npm)](https://junglewise.ai/threats/technologies/hapi-content): 4 vulnerabilities
- [hummus (npm)](https://junglewise.ai/threats/technologies/hummus): 4 vulnerabilities
- [i18next-http-middleware (npm)](https://junglewise.ai/threats/technologies/i18next-http-middleware): 4 vulnerabilities
- [is-my-json-valid (npm)](https://junglewise.ai/threats/technologies/is-my-json-valid): 4 vulnerabilities
- [jquery-validation (npm)](https://junglewise.ai/threats/technologies/jquery-validation): 4 vulnerabilities
- [kysely (npm)](https://junglewise.ai/threats/technologies/kysely): 4 vulnerabilities
- [LangSmith (npm)](https://junglewise.ai/threats/technologies/langsmith): 4 vulnerabilities
- [libxmljs (npm)](https://junglewise.ai/threats/technologies/libxmljs): 4 vulnerabilities
- [materialize-css (npm)](https://junglewise.ai/threats/technologies/materialize-css): 4 vulnerabilities
- [mercurius (npm)](https://junglewise.ai/threats/technologies/mercurius): 4 vulnerabilities
- [@modelcontextprotocol/server (npm)](https://junglewise.ai/threats/technologies/modelcontextprotocol-server): 4 vulnerabilities
- [mongosh (npm)](https://junglewise.ai/threats/technologies/mongosh): 4 vulnerabilities
- [node-saml (npm)](https://junglewise.ai/threats/technologies/node-saml): 4 vulnerabilities
- [@node-saml/node-saml (npm)](https://junglewise.ai/threats/technologies/node-saml-node-saml): 4 vulnerabilities
- [exifreader (npm)](https://junglewise.ai/threats/technologies/npm-exifreader): 4 vulnerabilities
- [jsonata (npm)](https://junglewise.ai/threats/technologies/npm-jsonata): 4 vulnerabilities
- [launch-editor (npm)](https://junglewise.ai/threats/technologies/npm-launch-editor): 4 vulnerabilities
- [moment (npm)](https://junglewise.ai/threats/technologies/npm-moment): 4 vulnerabilities
- [mongo-express (npm)](https://junglewise.ai/threats/technologies/npm-mongo-express): 4 vulnerabilities
- [morgan (npm)](https://junglewise.ai/threats/technologies/npm-morgan): 4 vulnerabilities
- [mppx (npm)](https://junglewise.ai/threats/technologies/npm-mppx): 4 vulnerabilities
- [re2 (npm)](https://junglewise.ai/threats/technologies/npm-re2): 4 vulnerabilities
- [storybook (npm)](https://junglewise.ai/threats/technologies/npm-storybook): 4 vulnerabilities
- [@nuxt/nitro-server (npm)](https://junglewise.ai/threats/technologies/nuxt-nitro-server): 4 vulnerabilities
- [@nuxt/vite-builder (npm)](https://junglewise.ai/threats/technologies/nuxt-vite-builder): 4 vulnerabilities
- [parse-dashboard (npm)](https://junglewise.ai/threats/technologies/parse-dashboard): 4 vulnerabilities
- [@payloadcms/next (npm)](https://junglewise.ai/threats/technologies/payloadcms-next): 4 vulnerabilities
- [protobufjs-cli (npm)](https://junglewise.ai/threats/technologies/protobufjs-cli): 4 vulnerabilities
- [psitransfer (npm)](https://junglewise.ai/threats/technologies/psitransfer): 4 vulnerabilities
- [quasar (npm)](https://junglewise.ai/threats/technologies/quasar): 4 vulnerabilities
- [realms-shim (npm)](https://junglewise.ai/threats/technologies/realms-shim): 4 vulnerabilities
- [remarkable (npm)](https://junglewise.ai/threats/technologies/remarkable): 4 vulnerabilities
- [repomix (npm)](https://junglewise.ai/threats/technologies/repomix): 4 vulnerabilities
- [sails (npm)](https://junglewise.ai/threats/technologies/sails): 4 vulnerabilities
- [@sap/approuter (npm)](https://junglewise.ai/threats/technologies/sap-approuter): 4 vulnerabilities
- [@sentry/nextjs (npm)](https://junglewise.ai/threats/technologies/sentry-nextjs): 4 vulnerabilities
- [ses (npm)](https://junglewise.ai/threats/technologies/ses): 4 vulnerabilities
- [showdown (npm)](https://junglewise.ai/threats/technologies/showdown): 4 vulnerabilities
- [simple-markdown (npm)](https://junglewise.ai/threats/technologies/simple-markdown): 4 vulnerabilities
- [simplehttpserver (npm)](https://junglewise.ai/threats/technologies/simplehttpserver): 4 vulnerabilities
- [sm-crypto (npm)](https://junglewise.ai/threats/technologies/sm-crypto): 4 vulnerabilities
- [smol-toml (npm)](https://junglewise.ai/threats/technologies/smol-toml): 4 vulnerabilities
- [snyk (npm)](https://junglewise.ai/threats/technologies/snyk): 4 vulnerabilities
- [@strapi/plugin-content-manager (npm)](https://junglewise.ai/threats/technologies/strapi-plugin-content-manager): 4 vulnerabilities
- [stream-json (npm)](https://junglewise.ai/threats/technologies/stream-json): 4 vulnerabilities
- [tar-fs (npm)](https://junglewise.ai/threats/technologies/tar-fs): 4 vulnerabilities
- [unhead (npm)](https://junglewise.ai/threats/technologies/unhead): 4 vulnerabilities
- [@uppy/companion (npm)](https://junglewise.ai/threats/technologies/uppy-companion): 4 vulnerabilities
- [valine (npm)](https://junglewise.ai/threats/technologies/valine): 4 vulnerabilities
- [webpack (npm)](https://junglewise.ai/threats/technologies/webpack): 4 vulnerabilities
- [wrangler (npm)](https://junglewise.ai/threats/technologies/wrangler): 4 vulnerabilities
- [xdlocalstorage (npm)](https://junglewise.ai/threats/technologies/xdlocalstorage): 4 vulnerabilities
- [xml-crypto (npm)](https://junglewise.ai/threats/technologies/xml-crypto): 4 vulnerabilities
- [yapi-vendor (npm)](https://junglewise.ai/threats/technologies/yapi-vendor): 4 vulnerabilities
- [@zereight/mcp-gitlab (npm)](https://junglewise.ai/threats/technologies/zereight-mcp-gitlab): 4 vulnerabilities
- [actual (npm)](https://junglewise.ai/threats/technologies/actual): 3 vulnerabilities
- [@adonisjs/http-server (npm)](https://junglewise.ai/threats/technologies/adonisjs-http-server): 3 vulnerabilities
- [aedes (npm)](https://junglewise.ai/threats/technologies/aedes): 3 vulnerabilities
- [agnai (npm)](https://junglewise.ai/threats/technologies/agnai): 3 vulnerabilities
- [@angular/router (npm)](https://junglewise.ai/threats/technologies/angular-router): 3 vulnerabilities
- [@angular/service-worker (npm)](https://junglewise.ai/threats/technologies/angular-service-worker): 3 vulnerabilities
- [@astrojs/netlify (npm)](https://junglewise.ai/threats/technologies/astrojs-netlify): 3 vulnerabilities
- [@auth/core (npm)](https://junglewise.ai/threats/technologies/auth-core): 3 vulnerabilities
- [@backstage/plugin-kubernetes-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-kubernetes-backend): 3 vulnerabilities
- [@backstage/techdocs-common (npm)](https://junglewise.ai/threats/technologies/backstage-techdocs-common): 3 vulnerabilities
- [bin-links (npm)](https://junglewise.ai/threats/technologies/bin-links): 3 vulnerabilities
- [blamer (npm)](https://junglewise.ai/threats/technologies/blamer): 3 vulnerabilities
- [browserify-shim (npm)](https://junglewise.ai/threats/technologies/browserify-shim): 3 vulnerabilities
- [browserslist (npm)](https://junglewise.ai/threats/technologies/browserslist): 3 vulnerabilities
- [bson (npm)](https://junglewise.ai/threats/technologies/bson): 3 vulnerabilities
- [buttle (npm)](https://junglewise.ai/threats/technologies/buttle): 3 vulnerabilities
- [@bytebase/dbhub (npm)](https://junglewise.ai/threats/technologies/bytebase-dbhub): 3 vulnerabilities
- [@clerk/astro (npm)](https://junglewise.ai/threats/technologies/clerk-astro): 3 vulnerabilities
- [@clerk/backend (npm)](https://junglewise.ai/threats/technologies/clerk-backend): 3 vulnerabilities
- [@clerk/express (npm)](https://junglewise.ai/threats/technologies/clerk-express): 3 vulnerabilities
- [@clerk/fastify (npm)](https://junglewise.ai/threats/technologies/clerk-fastify): 3 vulnerabilities
- [@clerk/nuxt (npm)](https://junglewise.ai/threats/technologies/clerk-nuxt): 3 vulnerabilities
- [codecov (npm)](https://junglewise.ai/threats/technologies/codecov): 3 vulnerabilities
- [@commercial/subtext (npm)](https://junglewise.ai/threats/technologies/commercial-subtext): 3 vulnerabilities
- [crypto-js (npm)](https://junglewise.ai/threats/technologies/crypto-js): 3 vulnerabilities
- [@cubejs-backend/api-gateway (npm)](https://junglewise.ai/threats/technologies/cubejs-backend-api-gateway): 3 vulnerabilities
- [@cyclonedx/cdxgen (npm)](https://junglewise.ai/threats/technologies/cyclonedx-cdxgen): 3 vulnerabilities
- [debug (npm)](https://junglewise.ai/threats/technologies/debug): 3 vulnerabilities
- [docsify (npm)](https://junglewise.ai/threats/technologies/docsify): 3 vulnerabilities
- [dojox (npm)](https://junglewise.ai/threats/technologies/dojox): 3 vulnerabilities
- [dot (npm)](https://junglewise.ai/threats/technologies/dot): 3 vulnerabilities
- [dset (npm)](https://junglewise.ai/threats/technologies/dset): 3 vulnerabilities
- [effect (npm)](https://junglewise.ai/threats/technologies/effect): 3 vulnerabilities
- [@enspirit/elo (npm)](https://junglewise.ai/threats/technologies/enspirit-elo): 3 vulnerabilities
- [esbuild (npm)](https://junglewise.ai/threats/technologies/esbuild): 3 vulnerabilities
- [@excalidraw/excalidraw (npm)](https://junglewise.ai/threats/technologies/excalidraw-excalidraw): 3 vulnerabilities
- [express-fileupload (npm)](https://junglewise.ai/threats/technologies/express-fileupload): 3 vulnerabilities
- [@fastify/express (npm)](https://junglewise.ai/threats/technologies/fastify-express): 3 vulnerabilities
- [feathers-sequelize (npm)](https://junglewise.ai/threats/technologies/feathers-sequelize): 3 vulnerabilities
- [@fedify/fedify (npm)](https://junglewise.ai/threats/technologies/fedify-fedify): 3 vulnerabilities
- [file-type (npm)](https://junglewise.ai/threats/technologies/file-type): 3 vulnerabilities
- [find-my-way (npm)](https://junglewise.ai/threats/technologies/find-my-way): 3 vulnerabilities
- [@frontmcp/adapters (npm)](https://junglewise.ai/threats/technologies/frontmcp-adapters): 3 vulnerabilities
- [ftp-srv (npm)](https://junglewise.ai/threats/technologies/ftp-srv): 3 vulnerabilities
- [gnuplot (npm)](https://junglewise.ai/threats/technologies/gnuplot): 3 vulnerabilities
- [@graphql-tools/executor-legacy-ws (npm)](https://junglewise.ai/threats/technologies/graphql-tools-executor-legacy-ws): 3 vulnerabilities
- [@grpc/grpc-js-xds (npm)](https://junglewise.ai/threats/technologies/grpc-grpc-js-xds): 3 vulnerabilities
- [grunt (npm)](https://junglewise.ai/threats/technologies/grunt): 3 vulnerabilities
- [harp (npm)](https://junglewise.ai/threats/technologies/harp): 3 vulnerabilities
- [hekto (npm)](https://junglewise.ai/threats/technologies/hekto): 3 vulnerabilities
- [http-live-simulator (npm)](https://junglewise.ai/threats/technologies/http-live-simulator): 3 vulnerabilities
- [https-proxy-agent (npm)](https://junglewise.ai/threats/technologies/https-proxy-agent): 3 vulnerabilities
- [@hulumi/baseline (npm)](https://junglewise.ai/threats/technologies/hulumi-baseline): 3 vulnerabilities
- [ids-enterprise (npm)](https://junglewise.ai/threats/technologies/ids-enterprise): 3 vulnerabilities
- [image-size (npm)](https://junglewise.ai/threats/technologies/image-size): 3 vulnerabilities
- [immer (npm)](https://junglewise.ai/threats/technologies/immer): 3 vulnerabilities
- [immutable (npm)](https://junglewise.ai/threats/technologies/immutable): 3 vulnerabilities
- [@janhq/core (npm)](https://junglewise.ai/threats/technologies/janhq-core): 3 vulnerabilities
- [@jmondi/url-to-png (npm)](https://junglewise.ai/threats/technologies/jmondi-url-to-png): 3 vulnerabilities
- [jointjs (npm)](https://junglewise.ai/threats/technologies/jointjs): 3 vulnerabilities
- [jose-node-cjs-runtime (npm)](https://junglewise.ai/threats/technologies/jose-node-cjs-runtime): 3 vulnerabilities
- [jose-node-esm-runtime (npm)](https://junglewise.ai/threats/technologies/jose-node-esm-runtime): 3 vulnerabilities
- [jquery-file-upload (npm)](https://junglewise.ai/threats/technologies/jquery-file-upload): 3 vulnerabilities
- [json-ptr (npm)](https://junglewise.ai/threats/technologies/json-ptr): 3 vulnerabilities
- [jsondiffpatch (npm)](https://junglewise.ai/threats/technologies/jsondiffpatch): 3 vulnerabilities
- [jwt-simple (npm)](https://junglewise.ai/threats/technologies/jwt-simple): 3 vulnerabilities
- [keycloak-connect (npm)](https://junglewise.ai/threats/technologies/keycloak-connect): 3 vulnerabilities
- [knex (npm)](https://junglewise.ai/threats/technologies/knex): 3 vulnerabilities
- [@langchain/community (npm)](https://junglewise.ai/threats/technologies/langchain-community): 3 vulnerabilities
- [layui (npm)](https://junglewise.ai/threats/technologies/layui): 3 vulnerabilities
- [@libp2p/gossipsub (npm)](https://junglewise.ai/threats/technologies/libp2p-gossipsub): 3 vulnerabilities
- [llhttp (npm)](https://junglewise.ai/threats/technologies/llhttp): 3 vulnerabilities
- [@lobehub/lobehub (npm)](https://junglewise.ai/threats/technologies/lobehub-lobehub): 3 vulnerabilities
- [localhost-now (npm)](https://junglewise.ai/threats/technologies/localhost-now): 3 vulnerabilities
- [lodash.defaultsdeep (npm)](https://junglewise.ai/threats/technologies/lodash-defaultsdeep): 3 vulnerabilities
- [m-server (npm)](https://junglewise.ai/threats/technologies/m-server): 3 vulnerabilities
- [mailgen (npm)](https://junglewise.ai/threats/technologies/mailgen): 3 vulnerabilities
- [@mariozechner/pi-coding-agent (npm)](https://junglewise.ai/threats/technologies/mariozechner-pi-coding-agent): 3 vulnerabilities
- [@materializecss/materialize (npm)](https://junglewise.ai/threats/technologies/materializecss-materialize): 3 vulnerabilities
- [mathlive (npm)](https://junglewise.ai/threats/technologies/mathlive): 3 vulnerabilities
- [mcp-markdownify-server (npm)](https://junglewise.ai/threats/technologies/mcp-markdownify-server): 3 vulnerabilities
- [minimist (npm)](https://junglewise.ai/threats/technologies/minimist): 3 vulnerabilities
- [mxgraph (npm)](https://junglewise.ai/threats/technologies/mxgraph): 3 vulnerabilities
- [nadesiko3 (npm)](https://junglewise.ai/threats/technologies/nadesiko3): 3 vulnerabilities
- [next-intl (npm)](https://junglewise.ai/threats/technologies/next-intl): 3 vulnerabilities
- [@nguniversal/common (npm)](https://junglewise.ai/threats/technologies/nguniversal-common): 3 vulnerabilities
- [node-fetch (npm)](https://junglewise.ai/threats/technologies/node-fetch): 3 vulnerabilities
- [node-ipc (npm)](https://junglewise.ai/threats/technologies/node-ipc): 3 vulnerabilities
- [node-jose (npm)](https://junglewise.ai/threats/technologies/node-jose): 3 vulnerabilities
- [node-red-dashboard (npm)](https://junglewise.ai/threats/technologies/node-red-dashboard): 3 vulnerabilities
- [notevil (npm)](https://junglewise.ai/threats/technologies/notevil): 3 vulnerabilities
- [cline (npm)](https://junglewise.ai/threats/technologies/npm-cline): 3 vulnerabilities
- [decode-uri-component (npm)](https://junglewise.ai/threats/technologies/npm-decode-uri-component): 3 vulnerabilities
- [@fastify/busboy (npm)](https://junglewise.ai/threats/technologies/npm-fastify-busboy): 3 vulnerabilities
- [js-toml (npm)](https://junglewise.ai/threats/technologies/npm-js-toml): 3 vulnerabilities
- [knowns (npm)](https://junglewise.ai/threats/technologies/npm-knowns): 3 vulnerabilities
- [koa (npm)](https://junglewise.ai/threats/technologies/npm-koa): 3 vulnerabilities
- [multiparty (npm)](https://junglewise.ai/threats/technologies/npm-multiparty): 3 vulnerabilities
- [mysql (npm)](https://junglewise.ai/threats/technologies/npm-mysql): 3 vulnerabilities
- [nx (npm)](https://junglewise.ai/threats/technologies/npm-nx): 3 vulnerabilities
- [@tsparticles/mcp-server (npm)](https://junglewise.ai/threats/technologies/npm-tsparticles-mcp-server): 3 vulnerabilities
- [@nuxt/devtools (npm)](https://junglewise.ai/threats/technologies/nuxt-devtools): 3 vulnerabilities
- [@nuxt/rspack-builder (npm)](https://junglewise.ai/threats/technologies/nuxt-rspack-builder): 3 vulnerabilities
- [@nuxt/webpack-builder (npm)](https://junglewise.ai/threats/technologies/nuxt-webpack-builder): 3 vulnerabilities
- [@nuxtjs/mdc (npm)](https://junglewise.ai/threats/technologies/nuxtjs-mdc): 3 vulnerabilities
- [object-path (npm)](https://junglewise.ai/threats/technologies/object-path): 3 vulnerabilities
- [opencc (npm)](https://junglewise.ai/threats/technologies/opencc): 3 vulnerabilities
- [openclaude (npm)](https://junglewise.ai/threats/technologies/openclaude): 3 vulnerabilities
- [@openclaw/feishu (npm)](https://junglewise.ai/threats/technologies/openclaw-feishu): 3 vulnerabilities
- [openmct (npm)](https://junglewise.ai/threats/technologies/openmct): 3 vulnerabilities
- [parse (npm)](https://junglewise.ai/threats/technologies/parse): 3 vulnerabilities
- [parsel (npm)](https://junglewise.ai/threats/technologies/parsel): 3 vulnerabilities
- [passport-saml (npm)](https://junglewise.ai/threats/technologies/passport-saml): 3 vulnerabilities
- [@payloadcms/graphql (npm)](https://junglewise.ai/threats/technologies/payloadcms-graphql): 3 vulnerabilities
- [pbkdf2 (npm)](https://junglewise.ai/threats/technologies/pbkdf2): 3 vulnerabilities
- [pdf-image (npm)](https://junglewise.ai/threats/technologies/pdf-image): 3 vulnerabilities
- [@pdfme/schemas (npm)](https://junglewise.ai/threats/technologies/pdfme-schemas): 3 vulnerabilities
- [raneto (npm)](https://junglewise.ai/threats/technologies/raneto): 3 vulnerabilities
- [@remix-run/server-runtime (npm)](https://junglewise.ai/threats/technologies/remix-run-server-runtime): 3 vulnerabilities
- [request (npm)](https://junglewise.ai/threats/technologies/request): 3 vulnerabilities
- [rollbar (npm)](https://junglewise.ai/threats/technologies/rollbar): 3 vulnerabilities
- [samlify (npm)](https://junglewise.ai/threats/technologies/samlify): 3 vulnerabilities
- [@sentry/astro (npm)](https://junglewise.ai/threats/technologies/sentry-astro): 3 vulnerabilities
- [serialize-to-js (npm)](https://junglewise.ai/threats/technologies/serialize-to-js): 3 vulnerabilities
- [set-in (npm)](https://junglewise.ai/threats/technologies/set-in): 3 vulnerabilities
- [@siteboon/claude-code-ui (npm)](https://junglewise.ai/threats/technologies/siteboon-claude-code-ui): 3 vulnerabilities
- [slp-validate (npm)](https://junglewise.ai/threats/technologies/slp-validate): 3 vulnerabilities
- [slpjs (npm)](https://junglewise.ai/threats/technologies/slpjs): 3 vulnerabilities
- [socket.io (npm)](https://junglewise.ai/threats/technologies/socket-io): 3 vulnerabilities
- [socket.io-file (npm)](https://junglewise.ai/threats/technologies/socket-io-file): 3 vulnerabilities
- [socket.io-parser (npm)](https://junglewise.ai/threats/technologies/socket-io-parser): 3 vulnerabilities
- [@soketi/soketi (npm)](https://junglewise.ai/threats/technologies/soketi-soketi): 3 vulnerabilities
- [static-eval (npm)](https://junglewise.ai/threats/technologies/static-eval): 3 vulnerabilities
- [statics-server (npm)](https://junglewise.ai/threats/technologies/statics-server): 3 vulnerabilities
- [stimulsoft-dashboards-js (npm)](https://junglewise.ai/threats/technologies/stimulsoft-dashboards-js): 3 vulnerabilities
- [@strapi/core (npm)](https://junglewise.ai/threats/technologies/strapi-core): 3 vulnerabilities
- [@strapi/utils (npm)](https://junglewise.ai/threats/technologies/strapi-utils): 3 vulnerabilities
- [@tanstack/start-server-core (npm)](https://junglewise.ai/threats/technologies/tanstack-start-server-core): 3 vulnerabilities
- [@theia/ai-chat (npm)](https://junglewise.ai/threats/technologies/theia-ai-chat): 3 vulnerabilities
- [@theia/ai-chat-ui (npm)](https://junglewise.ai/threats/technologies/theia-ai-chat-ui): 3 vulnerabilities
- [@theia/ai-claude-code (npm)](https://junglewise.ai/threats/technologies/theia-ai-claude-code): 3 vulnerabilities
- [@theia/ai-code-completion (npm)](https://junglewise.ai/threats/technologies/theia-ai-code-completion): 3 vulnerabilities
- [@theia/ai-core (npm)](https://junglewise.ai/threats/technologies/theia-ai-core): 3 vulnerabilities
- [@theia/ai-editor (npm)](https://junglewise.ai/threats/technologies/theia-ai-editor): 3 vulnerabilities
- [tmp (npm)](https://junglewise.ai/threats/technologies/tmp): 3 vulnerabilities
- [tough-cookie (npm)](https://junglewise.ai/threats/technologies/tough-cookie): 3 vulnerabilities
- [tree-kill (npm)](https://junglewise.ai/threats/technologies/tree-kill): 3 vulnerabilities
- [@typebot.io/js (npm)](https://junglewise.ai/threats/technologies/typebot-io-js): 3 vulnerabilities
- [uap-core (npm)](https://junglewise.ai/threats/technologies/uap-core): 3 vulnerabilities
- [uglify-js (npm)](https://junglewise.ai/threats/technologies/uglify-js): 3 vulnerabilities
- [uri-js (npm)](https://junglewise.ai/threats/technologies/uri-js): 3 vulnerabilities
- [@vitest/mocker (npm)](https://junglewise.ai/threats/technologies/vitest-mocker): 3 vulnerabilities
- [@vrite/sdk (npm)](https://junglewise.ai/threats/technologies/vrite-sdk): 3 vulnerabilities
- [vuetify (npm)](https://junglewise.ai/threats/technologies/vuetify): 3 vulnerabilities
- [@workos-inc/authkit-nextjs (npm)](https://junglewise.ai/threats/technologies/workos-inc-authkit-nextjs): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "npm package vulnerabilities", https://junglewise.ai/threats/vendors/npm, 13 November 2026.