Scan report

anchore / scan-action

View on GitHub (opens in a new tab)
JavaScript
275 stars
Scanned 29 Jul 2026, 15:18

Report Rescan

Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

1 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 2
Medium: 0
Low: 16

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

18 total findings

Likely real: 0
Uncertain: 0
Likely noise: 18

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

All 18 findings look like noise (low confidence) — nothing here likely needs attention.

Detections by engine

Dependency checker 16

CVEs, typosquats and risky installs · Supply chain
YARA 2

Malware signature rules · Malicious pattern

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'eslint^10.8.1' — attacker could push malicious update
```
eslint:^10.8.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'tslib^2.8.1' — attacker could push malicious update
```
tslib:^2.8.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'tar^7.5.22' — attacker could push malicious update
```
tar:^7.5.22
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'prettier^3.9.6' — attacker could push malicious update
```
prettier:^3.9.6
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'lint-staged^17.3.0' — attacker could push malicious update
```
lint-staged:^17.3.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'husky^9.1.7' — attacker could push malicious update
```
husky:^9.1.7
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'globals^17.11.0' — attacker could push malicious update
```
globals:^17.11.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@actions/cache^6.0.0' — attacker could push malicious update
```
@actions/cache:^6.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'esbuild^0.28.0' — attacker could push malicious update
```
esbuild:^0.28.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'better-npm-audit^3.11.0' — attacker could push malicious update
```
better-npm-audit:^3.11.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@eslint/js^10.0.1' — attacker could push malicious update
```
@eslint/js:^10.0.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@eslint/eslintrc^3.3.6' — attacker could push malicious update
```
@eslint/eslintrc:^3.3.6
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'lodash^4.18.1' — attacker could push malicious update
```
lodash:^4.18.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@actions/tool-cache^4.0.0' — attacker could push malicious update
```
@actions/tool-cache:^4.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@actions/exec^3.0.0' — attacker could push malicious update
```
@actions/exec:^3.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@actions/core^3.0.1' — attacker could push malicious update
```
@actions/core:^3.0.1
```