Scan report

php-debugbar / php-debugbar

View on GitHub (opens in a new tab)
PHP
4383 stars
Scanned 29 Jul 2026, 15:18

Report Rescan

Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Safe

Does this code look like it is trying to cause harm?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 9

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

9 total findings

Likely real: 0
Uncertain: 0
Likely noise: 9

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

All 9 findings look like noise (low confidence) — nothing here likely needs attention.

Detections by engine

Dependency checker 9

CVEs, typosquats and risky installs · Supply chain

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@sqltools/formatter^1.2.5' — attacker could push malicious update
```
@sqltools/formatter:^1.2.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@tabler/icons^3.36.0' — attacker could push malicious update
```
@tabler/icons:^3.36.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'highlight.js^11.11.1' — attacker could push malicious update
```
highlight.js:^11.11.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@antfu/eslint-config^6.7.1' — attacker could push malicious update
```
@antfu/eslint-config:^6.7.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@eslint/js^9.39.2' — attacker could push malicious update
```
@eslint/js:^9.39.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'esbuild^0.27.2' — attacker could push malicious update
```
esbuild:^0.27.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'eslint^9.39.2' — attacker could push malicious update
```
eslint:^9.39.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'eslint-plugin-jquery^1.5.1' — attacker could push malicious update
```
eslint-plugin-jquery:^1.5.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'globals^16.5.0' — attacker could push malicious update
```
globals:^16.5.0
```