Scan report

neomjs / neo

View on GitHub (opens in a new tab)
JavaScript
3282 stars
Scanned 24 Sep 2026, 07:02

Report Rescan

Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

3 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 19
Medium: 0
Low: 44

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

63 total findings

Likely real: 2
Uncertain: 0
Likely noise: 61

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

2 findings likely need attention, 61 look like noise. Most notable: YARA rule matched: detect_download_and_execute — Downloads a remote resource AND execut... in /resources/content/issues/chunk-14/issue-16706.md (1% confidence).

Detections by engine

Dependency checker 33

CVEs, typosquats and risky installs · Supply chain
YARA 28

Malware signature rules · Malicious pattern
GuardDog 2

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/buildScripts/dataSyncPipeline.mjs line 427

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
export async function gitAuthenticated(execute, cwd, args, options = {}) {
    const token = process.env.DATA_SYNC_PUBLISHER_TOKEN;

    if (!token) {
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/buildScripts/dataSyncWatchdog.mjs line 480

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
args                   = new Set(process.argv.slice(2)),
        token                  = process.env.GITHUB_TOKEN,
        repository             = process.env.GITHUB_REPOSITORY || 'neomjs/neo',
        workflow               ...
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 8% confidence

Loose version constraint: 'webpack-dev-server^6.0.0' — attacker could push malicious update
```
webpack-dev-server:^6.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 7% confidence

Loose version constraint: 'url^0.11.4' — attacker could push malicious update
```
url:^0.11.4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 4% confidence

Loose version constraint: 'jsdoc-api^9.3.6' — attacker could push malicious update
```
jsdoc-api:^9.3.6
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 4% confidence

Loose version constraint: 'html-minifier-terser^7.2.0' — attacker could push malicious update
```
html-minifier-terser:^7.2.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'ws^8.21.3' — attacker could push malicious update
```
ws:^8.21.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'webpack-hook-plugin^1.0.7' — attacker could push malicious update
```
webpack-hook-plugin:^1.0.7
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'webpack-cli^7.2.3' — attacker could push malicious update
```
webpack-cli:^7.2.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'webpack^5.111.1' — attacker could push malicious update
```
webpack:^5.111.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'semver^7.8.5' — attacker could push malicious update
```
semver:^7.8.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@fortawesome/fontawesome-free^7.3.1' — attacker could push malicious update
```
@fortawesome/fontawesome-free:^7.3.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@playwright/test^1.63.0' — attacker could push malicious update
```
@playwright/test:^1.63.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'acorn^8.17.0' — attacker could push malicious update
```
acorn:^8.17.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'astring^1.9.0' — attacker could push malicious update
```
astring:^1.9.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'autoprefixer^10.6.1' — attacker could push malicious update
```
autoprefixer:^10.6.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'chalk^6.0.0' — attacker could push malicious update
```
chalk:^6.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'commander^15.0.0' — attacker could push malicious update
```
commander:^15.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'cssnano^9.0.5' — attacker could push malicious update
```
cssnano:^9.0.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'envinfo^7.21.0' — attacker could push malicious update
```
envinfo:^7.21.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'esbuild^0.28.2' — attacker could push malicious update
```
esbuild:^0.28.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'fast-glob^3.3.3' — attacker could push malicious update
```
fast-glob:^3.3.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'fs-extra^11.4.0' — attacker could push malicious update
```
fs-extra:^11.4.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'highlightjs-line-numbers.js^2.9.1' — attacker could push malicious update
```
highlightjs-line-numbers.js:^2.9.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'terser^5.51.2' — attacker could push malicious update
```
terser:^5.51.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'sass^1.104.1' — attacker could push malicious update
```
sass:^1.104.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'postcss^8.5.28' — attacker could push malicious update
```
postcss:^8.5.28
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'parse5^8.0.1' — attacker could push malicious update
```
parse5:^8.0.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'mermaid^12.0.0' — attacker could push malicious update
```
mermaid:^12.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'marked^18.0.13' — attacker could push malicious update
```
marked:^18.0.13
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'lint-staged^17.5.1' — attacker could push malicious update
```
lint-staged:^17.5.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'js-yaml^5.4.2' — attacker could push malicious update
```
js-yaml:^5.4.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'inquirer^14.2.2' — attacker could push malicious update
```
inquirer:^14.2.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'husky^9.1.7' — attacker could push malicious update
```
husky:^9.1.7
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'gray-matter^4.0.3' — attacker could push malicious update
```
gray-matter:^4.0.3
```