43 packages matching “TOCTOU”

pi-edit

v1.1.0 · 20 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Claude Code-style editing discipline for Pi — read-before-write, TOCTOU protection, bash steering, post-edit diagnostics, schema-error recovery

12Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v1.1.0 (the latest release), from the OSV.dev database.

ssrf-fetch

v0.1.0 · 14 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

A drop-in fetch() that blocks SSRF: refuses loopback/private/link-local/CGNAT targets and pins the connection to the validated IP to defeat DNS rebinding (TOCTOU).

5Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.1.0 (the latest release), from the OSV.dev database.

tar

v7.5.22 · 8 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

tar for node

84.7MDownloads across all versions in the last 7 days, from the official npm downloads API.BlueOak-1.0.0License declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v7.5.22 (the latest release), from the OSV.dev database.

@openclaw/fs-safe

v0.5.1 · 9 hours ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.

3.4MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.5.1 (the latest release), from the OSV.dev database.

@armalo/telemetry

v0.1.0 · 2 months ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Continuous behavioral telemetry for AI agents. Drop in, stream tool calls + sessions to Armalo Trust Oracle. Closes the L4 TOCTOU gap.

4Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.1.0 (the latest release), from the OSV.dev database.

@solana/mpp

v0.7.0 · 19 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Solana payment method for the MPP protocol

979Downloads across all versions in the last 7 days, from the official npm downloads API.ISCLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.7.0 (the latest release), from the OSV.dev database.

ciphersweet-js

v2.0.6 · 3 years ago

85
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Searchable encryption for Node.js projects

5.0KDownloads across all versions in the last 7 days, from the official npm downloads API.ISCLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v2.0.6 (the latest release), from the OSV.dev database.

ssrf-guard

v0.6.0 · 1 month ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

SSRF protection: validate URLs, pin resolved IPs to the socket, eliminating the DNS-rebind window

1.2KDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.6.0 (the latest release), from the OSV.dev database.

cda-schematron-validator

v1.1.12 · 3 years ago

85
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Fork of Eric Wadkins' javascript implementation of schematron testing for C-CDA XML documents. This includes bug fixes and some house keeping.

862Downloads across all versions in the last 7 days, from the official npm downloads API.LICENSE.mdLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v1.1.12 (the latest release), from the OSV.dev database.

@revenexx/integrations-node-sdk

v0.18.1 · 4 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

TypeScript interfaces and utilities for Revenexx integration nodes

482Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.18.1 (the latest release), from the OSV.dev database.

@connexum/ai-governance

v1.0.0-beta.32 · 17 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Enterprise AI agent governance framework. Hook-based enforcement, compliance packs (SOC 2, HIPAA, GDPR, PCI DSS, DORA, EU AI Act, ISO 27001), audit trails, multi-LLM adapter architecture (Claude production today; additional providers on roadmap).

56Downloads across all versions in the last 7 days, from the official npm downloads API.SEE LICENSE IN LICENSE.mdLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v1.0.0-beta.32 (the latest release), from the OSV.dev database.

@yawlabs/fetch-mcp

v0.3.6 · 11 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Comprehensive HTTP fetch MCP server: SSRF protection, HTML-to-markdown, reader-mode, metadata / link / sitemap / RSS-Atom extraction, robots.txt verdicts

316Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.3.6 (the latest release), from the OSV.dev database.

@terraza/safe-fetch

v0.1.0 · 28 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

SSRF-safe HTTP(S) fetch for Terraza: manual redirect handling, per-hop host validation, and DNS-pinned connections that reject private/loopback/link-local targets

2Downloads across all versions in the last 7 days, from the official npm downloads API.

No known vulnerabilities

Known vulnerabilities affecting v0.1.0 (the latest release), from the OSV.dev database.

@openkuke/fs-safe

v0.3.0 · 1 month ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.

3Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.3.0 (the latest release), from the OSV.dev database.

@coderifts/agent-guard

v1.6.2 · 1 day ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Fail-closed guard for AI agent tool calls — preflight contract changes before they execute. Security core frozen (agent-guard-api v1.0); v1.1 adds client-side enforcement: receipt→envelope binding, decision↔action reconciliation, safe_for_agent + degraded

963Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v1.6.2 (the latest release), from the OSV.dev database.

@dwk/solid-pod

v1.0.0-beta.2 · 2 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Edge-native Solid Pod: LDP verbs, content negotiation, N3 Patch, WAC, notifications. Ships the per-pod Durable Object.

424Downloads across all versions in the last 7 days, from the official npm downloads API.ISCLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v1.0.0-beta.2 (the latest release), from the OSV.dev database.

@ictechgy/lterm

v1.0.32 · 17 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Lightweight tmux-compatible terminal session daemon with cmux-friendly notifications.

139Downloads across all versions in the last 7 days, from the official npm downloads API.MIT OR Apache-2.0License declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v1.0.32 (the latest release), from the OSV.dev database.

server-fetch

v1.0.10 · 3 months ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

SSRF-safe fetch() for server-side use — validates IPs, enforces scheme/port, eliminates DNS rebinding via undici connect.lookup

38Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v1.0.10 (the latest release), from the OSV.dev database.

@classytic/crm

v0.9.0 · 17 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Engine-factory CRM package — leads, accounts, contacts, opportunities, pipelines, campaigns, subscriptions, activities, notes, email engagement. PACKAGE_RULES compliant; built on Mongoose + mongokit + arc primitives.

22Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.9.0 (the latest release), from the OSV.dev database.

@de-otio/repo-aegis-llm

v0.7.1 · 6 days ago

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

LLM-assisted helpers for repo-aegis: prose extraction, token suggestion, embedding profiles. Off the deterministic gate path.

203Downloads across all versions in the last 7 days, from the official npm downloads API.GPL-3.0-or-laterLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.7.1 (the latest release), from the OSV.dev database.
1 / 3Next