safer-dependencies

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

ROOT-APP-PYPI-GHSA-WVPP-8HX9-P66J GHSA-wvpp-8hx9-p66j in GitPython - Patched by Root

Root has patched GHSA-wvpp-8hx9-p66j in the GitPython package for Root:PyPI. Multiple fixed versions available...

safer-dependencies v0.6.1

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

Safer Dependencies 0.6.1

safer-dependencies is a security layer for Claude Code: it sits between Claude and your manifest files and runs its security checks automatically: vulnerable installs are denied before they run, and a risky version written to a manifest is corrected on disk right after the write. It detects and...

safer-dependencies v0.6.0

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

GO-2025-3987 vulnerabilities

Vulnerabilities for packages: hydra-fips, hydra, weaviate...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: cloudbeat, image-factory, aactl, zarf-fips, docker-cli-buildx-fips, kubescape, buildkitd-fips, ratify-fips, kubescape-server, cg, kyverno, trivy-operator, docker-cli-buildx, teleport, cloudbeat-fips, witness, tekton-chains, vexctl, kubescape-server-fips, chainctl-fip...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: aactl, wolfictl, kubescape, tekton-chains, vexctl, falcoctl, apko, slsa-verifier, spire-server-fips, spire-server, tkn-fips, falcoctl-fips, goreleaser, zot, policy-controller, ko-fips, gitsign, neuvector-sigstore-interface, flux-source-controller, melange,...

GO-2026-5751 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

MAL-2026-6088 Malicious code in vite-common-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1d3397d754ffeb3726496769b2f159ce8596b2233b5875afa8f7fbca29ed0fd The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a element whose src is hardcoded to...

EUVD-2019-0434

Malware in sbrugna...

MAL-2024-7423 Malicious code in dependent-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 70f70c2dd1e2fa144fb729148ad1259433561dcfc205e028a514ea1fc4c6a65a The OpenSSF Package Analysis project identified 'dependent-package' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious Package

Overview All versions of aysnc typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...