Home / reports
npm package security scans
Automated scan results for widely-used npm packages. Each page shows the verdict and the signal categories; the full evidence is in the report from the API. Results are automated signals, not a warranty. Looking for agent tooling? See the MCP server reports.
- react
- react-dom
- lodash
- axios
- express
- chalk
- commander
- debug
- moment
- dayjs
- uuid
- dotenv
- classnames
- redux
- zustand
- next
- vue
- svelte
- typescript
- eslint
- prettier
- webpack
- vite
- rollup
- esbuild
- babel-core
- jest
- vitest
- mocha
- chai
- cypress
- playwright
- puppeteer
- cheerio
- jsdom
- node-fetch
- undici
- got
- request
- ws
- socket.io
- graphql
- apollo-server
- mongoose
- sequelize
- prisma
- knex
- pg
- mysql2
- redis
- ioredis
- bcrypt
- jsonwebtoken
- passport
- helmet
- cors
- body-parser
- multer
- nodemailer
- winston
- pino
- yargs
- inquirer
- ora
- rimraf
- glob
- fs-extra
- semver
- chokidar
- nanoid
- zod
- yup
- joi
- ramda
- immer
- rxjs
- date-fns
- sharp
- handlebars
- ejs
- marked
- highlight.js
- tailwindcss
- postcss
- autoprefixer
- sass
- concurrently
- nodemon
- pm2
- cross-env
- husky
- lint-staged
- jquery
- underscore
- luxon
- validator
- qs
- deepmerge
- superagent
- form-data
- follow-redirects
- gulp
- grunt
- browserify
- terser
- ts-node
- tsx
- ava
- tape
- sinon
- nyc
- supertest
- kleur
- picocolors
- boxen
- prompts
- enquirer
- meow
- figlet
- immutable
- mobx
- xstate
- typeorm
- better-sqlite3
- sqlite3
- mongodb
- archiver
- adm-zip
- tar
- unzipper
- ajv
- crypto-js
- bcryptjs
- argon2
- jose
- pug
- mustache
- nunjucks
- markdown-it
- cross-spawn
- execa
- shelljs
- del
- minimist
- minimatch
- fast-glob
- globby
- cosmiconfig
- morgan
- compression
- http-proxy
- node-cron
- dompurify
- sanitize-html