Automated scan of the main branch (commit 6633b32) covering GitHub Actions workflows, npm dependencies, Go modules, and Terraform providers.
Scope notes: No .github/workflows/* files exist in this repo (no GitHub Actions to audit). No go.mod or *.tf files exist in this repo (no Go modules or Terraform providers to audit). Findings below are limited to npm dependencies, the only applicable category.
npm dependencies
Repo has a single package.json at the root (Astro static site, krakenkey-website).
Outdated (2+ majors behind latest)
astro (/package.json, direct dependency) — pinned ^5.17.2, installed 5.17.2, latest published 7.2.2. Two majors behind (5 → 6 → 7).
npm audit findings (13 total: 11 high, 1 moderate, 1 low)
All vulnerable packages are transitive dependencies pulled in by astro; a fix requires the major-version upgrade noted above (npm audit fix reports fixAvailable: astro@7.2.2 (semver-major)).
astro (direct, installed 5.17.2) — high severity overall; multiple advisories apply to the installed version, including:
- GHSA-8hv8-536x-4wqp — Reflected XSS via unescaped slot name (high, CVSS 7.1), affects
<6.3.3
- GHSA-2pvr-wf23-7pc7 — Host header SSRF in prerendered error page fetch (high, CVSS 7.5), affects
<6.4.6
- GHSA-jrpj-wcv7-9fh9 — XSS via unescaped attribute names in spread props (moderate), affects
<6.4.6
- GHSA-j687-52p2-xcff — XSS in
define:vars via incomplete </script> sanitization (moderate), affects <6.1.6
- GHSA-xr5h-phrj-8vxv — Server island encrypted parameters vulnerable to cross-component replay (low), affects
<6.1.10
- GHSA-g735-7g2w-hh3f — Remote allowlist bypass via unanchored
matchPathname wildcard (low), affects <5.18.1
- GHSA-f48w-9m4c-m7f5, GHSA-7pw4-f3q4-r2p2, GHSA-4g3v-8h47-v7g6 — additional XSS advisories affecting versions up to
<7.0.4/<7.0.6/<=7.0.9
js-yaml (transitive via astro) — high, GHSA-5p4m-2wfm-xmqj: quadratic CPU consumption in !!omap resolution (CVE-2026-59870 fix not backported), affects >=4.0.0 <4.3.1; also GHSA-52cp-r559-cp3m (high) and GHSA-h67p-54hq-rp68 (moderate)nanoid (transitive via astro) — high, GHSA-2v37-7h3g-55p8 and GHSA-28wg-ghj8-5hjv: non-secure/custom generators can loop indefinitely with size 0/negative, affects <3.3.18picomatch (transitive via astro) — high, GHSA-c2c7-rcm5-vvqj: ReDoS via extglob quantifiers, affects <=2.3.1 || 4.0.0-4.0.3postcss (transitive via astro) — high, GHSA-r28c-9q8g-f849: path traversal in source-map auto-loading leads to arbitrary .map file disclosure, affects <=8.5.17; also GHSA-6g55-p6wh-862q (high) and GHSA-qx2v-qp2m-jg93/GHSA-fxqj-rqcc-2cmp (moderate)vite (transitive via astro) — high, GHSA-fx2h-pf6j-xcff: server.fs.deny bypass on Windows alternate paths, affects <=6.4.2; also GHSA-p9ff-h696-f583 (high) and GHSA-4w7w-66w2-5vf9/GHSA-v6wh-96g9-6wx3 (moderate)svgo (transitive via astro) — high, GHSA-2p49-hgcm-8545: removeScripts plugin leaves some executable scripts intact (CVSS 8.2), affects >=4.0.0 <4.0.2; also GHSA-xpqw-6gx7-v673 (high, Billion Laughs DoS)defu (transitive via astro) — high, GHSA-737v-mqg7-c878: prototype pollution via __proto__ key in defaults argument, affects <=6.1.4h3 (transitive via astro) — high, GHSA-22cc-p3c6-wpvm: SSE injection via unsanitized newlines in event stream fields, affects <1.15.6; also two path-traversal advisories (moderate)sharp (transitive via astro) — high, GHSA-f88m-g3jw-g9cj: inherited libvips CVEs (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591), affects <0.35.0devalue (transitive via astro) — high, GHSA-77vg-94rm-hx3p: DoS via sparse array deserialization, affects >=5.6.3 <=5.8.0; also GHSA-cfw5-2vxh-hr84 (moderate) and GHSA-mwv9-gp5h-frr4 (low)smol-toml (transitive via astro) — moderate, GHSA-v3rj-xjv7-4jmq: DoS via TOML documents with thousands of consecutive commented lines, affects <1.6.1esbuild (transitive via astro) — low, GHSA-g7r4-m6w7-qqqr: arbitrary file read when running dev server on Windows, affects 0.27.3-0.28.0
Recommended remediation: Upgrade astro from ^5.17.2 to ^7.2.2 (semver-major) to pull in patched versions of all the transitive packages above; review the Astro 6.x and 7.x migration guides for breaking changes before merging.
@astrojs/sitemap (installed 3.7.0, latest 3.7.3) is only a patch version behind and has no reported vulnerabilities — not flagged.
Automated scan of the
mainbranch (commit6633b32) covering GitHub Actions workflows, npm dependencies, Go modules, and Terraform providers.Scope notes: No
.github/workflows/*files exist in this repo (no GitHub Actions to audit). Nogo.modor*.tffiles exist in this repo (no Go modules or Terraform providers to audit). Findings below are limited to npm dependencies, the only applicable category.npm dependencies
Repo has a single
package.jsonat the root (Astro static site,krakenkey-website).Outdated (2+ majors behind latest)
astro(/package.json, direct dependency) — pinned^5.17.2, installed5.17.2, latest published7.2.2. Two majors behind (5 → 6 → 7).npm auditfindings (13 total: 11 high, 1 moderate, 1 low)All vulnerable packages are transitive dependencies pulled in by
astro; a fix requires the major-version upgrade noted above (npm audit fixreportsfixAvailable: astro@7.2.2 (semver-major)).astro(direct, installed 5.17.2) — high severity overall; multiple advisories apply to the installed version, including:<6.3.3<6.4.6<6.4.6define:varsvia incomplete</script>sanitization (moderate), affects<6.1.6<6.1.10matchPathnamewildcard (low), affects<5.18.1<7.0.4/<7.0.6/<=7.0.9js-yaml(transitive via astro) — high, GHSA-5p4m-2wfm-xmqj: quadratic CPU consumption in!!omapresolution (CVE-2026-59870 fix not backported), affects>=4.0.0 <4.3.1; also GHSA-52cp-r559-cp3m (high) and GHSA-h67p-54hq-rp68 (moderate)nanoid(transitive via astro) — high, GHSA-2v37-7h3g-55p8 and GHSA-28wg-ghj8-5hjv: non-secure/custom generators can loop indefinitely with size 0/negative, affects<3.3.18picomatch(transitive via astro) — high, GHSA-c2c7-rcm5-vvqj: ReDoS via extglob quantifiers, affects<=2.3.1 || 4.0.0-4.0.3postcss(transitive via astro) — high, GHSA-r28c-9q8g-f849: path traversal in source-map auto-loading leads to arbitrary.mapfile disclosure, affects<=8.5.17; also GHSA-6g55-p6wh-862q (high) and GHSA-qx2v-qp2m-jg93/GHSA-fxqj-rqcc-2cmp (moderate)vite(transitive via astro) — high, GHSA-fx2h-pf6j-xcff:server.fs.denybypass on Windows alternate paths, affects<=6.4.2; also GHSA-p9ff-h696-f583 (high) and GHSA-4w7w-66w2-5vf9/GHSA-v6wh-96g9-6wx3 (moderate)svgo(transitive via astro) — high, GHSA-2p49-hgcm-8545:removeScriptsplugin leaves some executable scripts intact (CVSS 8.2), affects>=4.0.0 <4.0.2; also GHSA-xpqw-6gx7-v673 (high, Billion Laughs DoS)defu(transitive via astro) — high, GHSA-737v-mqg7-c878: prototype pollution via__proto__key in defaults argument, affects<=6.1.4h3(transitive via astro) — high, GHSA-22cc-p3c6-wpvm: SSE injection via unsanitized newlines in event stream fields, affects<1.15.6; also two path-traversal advisories (moderate)sharp(transitive via astro) — high, GHSA-f88m-g3jw-g9cj: inherited libvips CVEs (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591), affects<0.35.0devalue(transitive via astro) — high, GHSA-77vg-94rm-hx3p: DoS via sparse array deserialization, affects>=5.6.3 <=5.8.0; also GHSA-cfw5-2vxh-hr84 (moderate) and GHSA-mwv9-gp5h-frr4 (low)smol-toml(transitive via astro) — moderate, GHSA-v3rj-xjv7-4jmq: DoS via TOML documents with thousands of consecutive commented lines, affects<1.6.1esbuild(transitive via astro) — low, GHSA-g7r4-m6w7-qqqr: arbitrary file read when running dev server on Windows, affects0.27.3-0.28.0Recommended remediation: Upgrade
astrofrom^5.17.2to^7.2.2(semver-major) to pull in patched versions of all the transitive packages above; review the Astro 6.x and 7.x migration guides for breaking changes before merging.@astrojs/sitemap(installed 3.7.0, latest 3.7.3) is only a patch version behind and has no reported vulnerabilities — not flagged.