Sherlock Forensics maintains security audit reports for 50 popular open-source packages across npm and PyPI. A total of 828 known vulnerabilities are catalogued with CVE details, severity ratings and remediation guidance. Updated weekly.
Audited Ecosystems
npm Packages (25 audited)
169 total known vulnerabilities across 25 npm packages.
Most vulnerabilities:
- Next.js - 64 vulnerabilities
- Axios - 44 vulnerabilities
- Angular - 15 vulnerabilities
- Lodash - 10 vulnerabilities
- Mongoose - 9 vulnerabilities
PyPI Packages (25 audited)
659 total known vulnerabilities across 25 PyPI packages.
Most vulnerabilities:
- Django - 320 vulnerabilities
- Pillow - 153 vulnerabilities
- cryptography - 42 vulnerabilities
- Scrapy - 21 vulnerabilities
- Jinja2 - 20 vulnerabilities
Full Dependency Audit
These pages cover individual packages. For a full audit of your project's dependency tree including transitive risks, contact Sherlock Forensics.
Get a Vibe Coding Security Audit