npm Package Vulnerabilities

All 2,958 JavaScript / Node.js packages with known CVEs, ranked by live CVE volume — 7,178 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 2,501.@sentry/solidstart1 CVE
  2. 2,502.@sentry/sveltekit1 CVE
  3. 2,503.@sequa-ai/sequa-mcp1 CVE
  4. 2,504.sequelize-typescript1 CVE
  5. 2,505.serc.js1 CVE
  6. 2,506.@serenity-is/corelib1 CVE
  7. 2,507.serial-number1 CVE
  8. 2,508.serve461 CVE
  9. 2,509.serve-here.js1 CVE
  10. 2,510.serve-index1 CVE
  11. 2,511.serverabc1 CVE
  12. 2,512.serverhuwenhui1 CVE
  13. 2,513.serverless1 CVE
  14. 2,514.serverless-offline1 CVE
  15. 2,515.serverliujiayi11 CVE
  16. 2,516.serverlyr1 CVE
  17. 2,517.serverwg1 CVE
  18. 2,518.serverwzl1 CVE
  19. 2,519.serverxxx1 CVE
  20. 2,520.serveryaozeyan1 CVE
  21. 2,521.serveryztyzt1 CVE
  22. 2,522.serverzyy1 CVE
  23. 2,523.servey1 CVE
  24. 2,524.servify-express1 CVE
  25. 2,525.servst1 CVE
  26. 2,526.set-deep-prop1 CVE
  27. 2,527.set-getter1 CVE
  28. 2,528.set-object-value1 CVE
  29. 2,529.set-or-get1 CVE
  30. 2,530.sexstatic1 CVE
  31. 2,531.sey1 CVE
  32. 2,532.sfml1 CVE
  33. 2,533.sgqserve1 CVE
  34. 2,534.shadowsock1 CVE
  35. 2,535.sha.js1 CVE
  36. 2,536.shamefile1 CVE
  37. 2,537.shave1 CVE
  38. 2,538.shelljs1 CVE
  39. 2,539.shenliru1 CVE
  40. 2,540.shit-server1 CVE
  41. 2,541.@shopify/hydrogen1 CVE
  42. 2,542.@shopify/koa-shopify-auth1 CVE
  43. 2,543.short-video-maker1 CVE
  44. 2,544.shout1 CVE
  45. 2,545.shvl1 CVE
  46. 2,546.@sideway/formula1 CVE
  47. 2,547.@signalk/set-system-time1 CVE
  48. 2,548.sigstore1 CVE
  49. 2,549.@sigstore/core1 CVE
  50. 2,550.@sigstore/verify1 CVE

Which npm packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Book a Demo →