Is your app affected?
One page per major dependency incident: what happened, which versions are affected, what to do, and a check that reads your repo or lockfile and says whether it matches.
Incidents
- axios npm compromiseDisclosed On 31 March 2026 two malicious axios releases, 1.14.1 and 0.30.4, were on npm for about three hours. They added a dependency, plain-crypto-js, that installs a remote access trojan when npm runs its install script. You are affected only if one of them was installed; a lockfile is the way to tell.
- React2ShellDisclosed React2Shell (CVE-2025-55182) is an unauthenticated remote code execution flaw in React Server Components. You are affected if your app runs React Server Components on a server with react-server-dom-webpack, -parcel or -turbopack 19.0.0, 19.1.0, 19.1.1 or 19.2.0, which includes Next.js 15.x and 16.x apps using the App Router before the patched releases.
- Next.js middleware bypassDisclosed CVE-2025-29927 lets anyone skip Next.js middleware by sending one internal header, so auth checks done only in middleware can be bypassed. Self-hosted apps on Next.js 12.x to 15.x before 12.3.5, 13.5.9, 14.2.25 or 15.2.3 are affected.
For everything else
These pages cover single incidents. For every known advisory in a repo, paste it into the dependency check.
Go further than one check
Map your repo into an architecture diagram with live health on every part, get an alert when a new critical finding lands, and hand your coding agent a brief to build from. Free to start.