{"_id":"yarn-osv-audit","_rev":"15-ecff404fbaa2aa2d4258d01df9c59e3e","name":"yarn-osv-audit","dist-tags":{"latest":"0.1.8"},"versions":{"0.0.1":{"name":"yarn-osv-audit","version":"0.0.1","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.0.1","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"bc8060d251db166ac10c218b0e791b0269a62d0e","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.0.1.tgz","fileCount":2,"integrity":"sha512-Jx/Q929HgsbgoeJyFy8mW/N+g7QviUJTjdleQ6GPWjqVZFElNoZSM10ksRa2u69lZhwJfqNwHoGzxO0WZtE0+Q==","signatures":[{"sig":"MEUCIQDioac+H27/RtwGGUXOAy55IeaE4W35QdjujgfhYhU+3QIgUW686GcYEM8oqCY/rTeuweqj2YxMpYrGiuIShl/YFxo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":28532},"type":"module","engines":{"node":">=18"},"scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.0.1_1776246122961_0.9553375621724305","host":"s3://npm-registry-packages-npm-production"}},"0.0.2":{"name":"yarn-osv-audit","version":"0.0.2","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.0.2","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"b2c310fd26aaf02e3c04fa0a872e08898768a453","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.0.2.tgz","fileCount":2,"integrity":"sha512-61lgr22ldcGZDxC/oUEVwTwYZQnkU+SrrZoRXjk12ANtFXMMG0DuJXu2+QVzbwa1HoVuMIk+my6egJlyB1hCUw==","signatures":[{"sig":"MEUCIQD4XxjCvTyRKZ2sq4OVkURzl3y+WyvVEqWOA1IRiRvBIwIgLCJ2oYx4VgtoP6SqqJ1eldCX+1C2hoj2BWP1+MmpO74=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":28808},"type":"module","engines":{"node":">=18"},"scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.0.2_1776246959449_0.21551644049147867","host":"s3://npm-registry-packages-npm-production"}},"0.0.3":{"name":"yarn-osv-audit","version":"0.0.3","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.0.3","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"ed65c1d3821e93cc46a84ec93ad830acbd87336e","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.0.3.tgz","fileCount":3,"integrity":"sha512-duBoFU6SBtxhsj67uSrZUKUtDz8f843L9zVmesvq4+FNtTiK+J3GKQEwtrozAbX09a3ClPrdAbHkJIc/tyIlZQ==","signatures":[{"sig":"MEYCIQCTO7xJ7zC/PsS5xIqbBfd2icuxb3b+TFxDL1wAu1Ls0QIhAPXxaUTMphxRvrivgqqh0j81UQKG2niLn9uOl7oU2nMf","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":37676},"type":"module","engines":{"node":">=18"},"scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.0.3_1776247218367_0.2286279799672779","host":"s3://npm-registry-packages-npm-production"}},"0.0.4":{"name":"yarn-osv-audit","version":"0.0.4","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.0.4","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"cd0672adeadb5b5ecd79901be20fa05990676760","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.0.4.tgz","fileCount":3,"integrity":"sha512-jfqlepxHRD1FL20wcrg5LaZO4kqtekCYYBLI9HVLICSb/p3daw50od0irAt65zRYXhGJXStd4HReXVsIylpwTw==","signatures":[{"sig":"MEUCIQDPaQIPhsaoJ+F0huNmaZ2rVne/0lJbbBmFEGuKi2BlmAIgXVTOHjaZ7clSU25kTzPbopWT4Vc2wccMqsztRHgHivM=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":39360},"type":"module","engines":{"node":">=18"},"scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.0.4_1776386742969_0.6945918291243469","host":"s3://npm-registry-packages-npm-production"}},"0.0.5":{"name":"yarn-osv-audit","version":"0.0.5","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.0.5","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"02cf55e443c719d5651b99dcc25326b5f064a587","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.0.5.tgz","fileCount":3,"integrity":"sha512-t2Z5vjjZH9dWmf/arBoMLh4BAz8pAZHci+En2/vz1lx+bb9PDg7UPb0AbNB/uruVhEKaSfukOO+OO+zYMo1qTw==","signatures":[{"sig":"MEUCIQDW14Xfri+wQ4hJI6aVY+D9HgqUy8v6aEbETPvyUCdXHgIgDS7uYchXzjGZTiSRdObAVnksLmYfizxCEwIad16qR/w=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":40509},"type":"module","engines":{"node":">=18"},"scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.0.5_1776387562217_0.5556861458905205","host":"s3://npm-registry-packages-npm-production"}},"0.0.6":{"name":"yarn-osv-audit","version":"0.0.6","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.0.6","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"2e22c791c3c38bc79eef6b3d1356da3b3e9dfe9a","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.0.6.tgz","fileCount":3,"integrity":"sha512-Fo62jPJJYeeaxtvCGHSaKm0bgjPKwvrQiYpP5dXjL9+DxUfa/QRW8doGrkqg79iDyXtH4M1sVYTdx2a5ZnLxSw==","signatures":[{"sig":"MEQCIEntNZkivb0PI8vYqps62v3a67ERyoSYlvNdQpdCY07IAiATcLYnoLsM/YEH74jvIiPquO8zqzzbSWeRJ+a6s229NQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":40736},"type":"module","engines":{"node":">=18"},"gitHead":"0f2c3a87c574ce2b27490b738a2be84ceb58385c","scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.0.6_1776388182731_0.16616523739210542","host":"s3://npm-registry-packages-npm-production"}},"0.0.7":{"name":"yarn-osv-audit","version":"0.0.7","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.0.7","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"dd8a74000f0435e9c9e0f5e793191d6147ceb3aa","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.0.7.tgz","fileCount":3,"integrity":"sha512-40PE2qiJ3RqGIcqnt1WWsP8jH20wmKUj1K6uRkH5IUINnfICBTq++WzgJltjSLsZK+PgsoE6DzvZO0rfiip0uw==","signatures":[{"sig":"MEYCIQC9jnjK5XRgftKNtRk3uKTvJzub32RfvjC3k60KB7c1PQIhAO7rRpX5x5jqkrL/EpZik+IWGG0uVC9LGD1t4zTDxoTt","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":40931},"type":"module","engines":{"node":">=18"},"gitHead":"0f2c3a87c574ce2b27490b738a2be84ceb58385c","scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.0.7_1776388850546_0.09140564590051659","host":"s3://npm-registry-packages-npm-production"}},"0.0.8":{"name":"yarn-osv-audit","version":"0.0.8","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.0.8","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"3bca89e824ad60ba550d386163cb1d9313181402","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.0.8.tgz","fileCount":3,"integrity":"sha512-inujG2AMroK0n9Iipq4UbHJRiC4WBcAvS18xl/WlDte92bR90mwuf3qY0mkQK7h/sww0ysIyjRrNCdZkI+9nCg==","signatures":[{"sig":"MEUCIAk5mQOX7NqCftyQcyMjfXnQ1SYyoDkKc8e3DO5RinkWAiEAxOtc8zU2xzpDkrc/kV5QKngpynOpWEr4UbonTl3pB60=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":47655},"type":"module","engines":{"node":">=18"},"gitHead":"1b1180ba5a7f230bcc75909434df9c9957f930ba","scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.0.8_1776389582989_0.291838554371151","host":"s3://npm-registry-packages-npm-production"}},"0.1.0":{"name":"yarn-osv-audit","version":"0.1.0","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.1.0","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"713186d656897d2a14adbc7f94959c4305f42444","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.1.0.tgz","fileCount":3,"integrity":"sha512-UWuyOaN0OJhnaNUPv5kSKsrnkrzDaO6nfqk7ju/PBu9aZEOwqAGoMEaF3Tn2n/3buDS1zKkrnAmDdiXroLCILQ==","signatures":[{"sig":"MEYCIQDWtlmERrygGfg6a0HWKzUcs76N1UAlwiGFKgDedYL5uQIhAKFiX/tBuFDkuyidfsRWSoHF/4T37NLUTT3rbhMGivUH","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":53937},"type":"module","engines":{"node":">=18"},"gitHead":"56fad366c4301e0b583557fdad5b4f736974439d","scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.1.0_1776393687467_0.6123523497550887","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"yarn-osv-audit","version":"0.1.1","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.1.1","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"75abb75c2d177868d54f2384b5813b14eaf3551e","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.1.1.tgz","fileCount":3,"integrity":"sha512-SN1vpose6cmYpy/4zmtvt81Jl0uBf/wvvYQbBvzRjOvUP6/+s4qIz4U0f+PkUFZEBI/ZPd7HAs6MKVSSy15IGQ==","signatures":[{"sig":"MEUCIQDD9BvU7KBJpZ2e8etpAv3lgj3vM0vYohueNM8xnxB6vgIgbaLZ+1ZZi9YQdQEC7d9I2yn/RB/e2r8Jar38c0nv06M=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":54576},"type":"module","engines":{"node":">=18"},"gitHead":"56fad366c4301e0b583557fdad5b4f736974439d","scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.1.1_1776394553616_0.08365823560915175","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"name":"yarn-osv-audit","version":"0.1.2","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.1.2","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"f3d2fa0fbf1df62d5003d3a807b8ec6b0a13a61e","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.1.2.tgz","fileCount":3,"integrity":"sha512-2k6+jPkeuKv0Rgp4ajrgEMoIl/gswtsJrXsUl3+rj1xQimciTLqoWH//E/afAmpjtD1gbsy1AFjd/HOIeyvJyw==","signatures":[{"sig":"MEUCIQDEQMOZBLgz/jgbXpNlhSxbEJtWNpmlRRjEpcah5f/EcgIgbFKLY2xVU0f58tCn+gE/bLJutQP/J+aGVyLyD+kR4IY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":71897},"type":"module","engines":{"node":">=18"},"gitHead":"951087d1f8f3a1bb5b6aa4c73a3a9743ccf98bab","scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.1.2_1776406712839_0.3065625326039916","host":"s3://npm-registry-packages-npm-production"}},"0.1.3":{"name":"yarn-osv-audit","version":"0.1.3","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.1.3","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"}],"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"262ceda01050cfb1d3f4970bca026d9355f18a5b","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.1.3.tgz","fileCount":3,"integrity":"sha512-pZvOLBvOkM52Z0oIFZJw401K3A9BAxFKVCg1Z8vcFxF54DcmZhFBJ3zzoQEj1lv3fhf5FKyTB1VfuvzMzIeANQ==","signatures":[{"sig":"MEUCIE29ZpIiNMI0duCdMmWdxXTXofSnP2W6HxSkOXTMCe8KAiEAy+nVPOICWyjCJgXtnVMAxNOe8jmnRKgxehan+lkyx1A=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":72212},"type":"module","engines":{"node":">=18"},"gitHead":"951087d1f8f3a1bb5b6aa4c73a3a9743ccf98bab","scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.1.3_1776410524717_0.2949969920821649","host":"s3://npm-registry-packages-npm-production"}},"0.1.7":{"name":"yarn-osv-audit","version":"0.1.7","keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","_id":"yarn-osv-audit@0.1.7","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},{"name":"duncanluca","email":"duncan.hoggan.extern@luca-app.de"}],"homepage":"https://github.com/duncanhoggan/yarn-osv-audit#readme","bugs":{"url":"https://github.com/duncanhoggan/yarn-osv-audit/issues"},"bin":{"yarn-osv-audit":"dist/index.js"},"dist":{"shasum":"2ae89fc2ff206e3ffbe232c8e20578b40fac9753","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.1.7.tgz","fileCount":3,"integrity":"sha512-2gxM4nfyQ7nOBuDbtLpz6NAg3oUa2qbrZHAb40+BWX8f1DU3c3KC3jITzgzQR0bRSQynPPtMyaRaArBYsVsSDA==","signatures":[{"sig":"MEUCIQClGWhEvPydpU+NwJsdrECkIIWJ7012aDx9xq+1inozjgIgGscP+73SLhwyFdqy7MeI+ZPUPrDU+CBOi33Z70O2b/g=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/yarn-osv-audit@0.1.7","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":73121},"type":"module","engines":{"node":">=18"},"gitHead":"8d4f1f5c429acccf1d0b92d81c7f7e84297bc69e","scripts":{"test":"vitest","build":"tsup src/index.ts --format esm","prepublishOnly":"npm run build"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:01bc71a2-42ed-4591-8532-22fb17cfc21b"}},"repository":{"url":"git+https://github.com/duncanhoggan/yarn-osv-audit.git","type":"git"},"_npmVersion":"11.11.0","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","vitest":"^4.1.4","typescript":"^6.0.2","@types/node":"^25.6.0"},"_npmOperationalInternal":{"tmp":"tmp/yarn-osv-audit_0.1.7_1777246902121_0.7376283217339608","host":"s3://npm-registry-packages-npm-production"}},"0.1.8":{"name":"yarn-osv-audit","version":"0.1.8","description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","bin":{"yarn-osv-audit":"dist/index.js"},"type":"module","scripts":{"build":"tsup src/index.ts --format esm","test":"vitest","prepublishOnly":"npm run build"},"engines":{"node":">=18"},"keywords":["yarn","audit","security","osv","vulnerability"],"license":"MIT","repository":{"type":"git","url":"git+https://github.com/duncanhoggan/yarn-osv-audit.git"},"homepage":"https://github.com/duncanhoggan/yarn-osv-audit#readme","bugs":{"url":"https://github.com/duncanhoggan/yarn-osv-audit/issues"},"devDependencies":{"@types/node":"^25.6.0","tsup":"^8.5.1","typescript":"^6.0.2","vitest":"^4.1.4"},"gitHead":"c88c9eb32e8d0c052f1d886e44dd41c438728385","_id":"yarn-osv-audit@0.1.8","_nodeVersion":"24.14.1","_npmVersion":"11.11.0","dist":{"integrity":"sha512-k+ND0K0nbSnEGblbn4MXJmwGEt7kQDO2zDBmQ19LiETePMW80Qm4acIshLGdWkGSRW/ZUXK4KjZuX6oWM3Yn1Q==","shasum":"4d2b7f95c7c3da090e7e55aead77c9c3a334b78e","tarball":"https://registry.npmjs.org/yarn-osv-audit/-/yarn-osv-audit-0.1.8.tgz","fileCount":3,"unpackedSize":73396,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/yarn-osv-audit@0.1.8","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIEcaPeiu7uJDIaI96j8LNWsmu+JmhJacT7xmzylB4zlAAiAaH/PUMZee9xQqYR28fa6TsUyPo0Ki8WmVDBnRt1Ydcw=="}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:01bc71a2-42ed-4591-8532-22fb17cfc21b"}},"directories":{},"maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},{"name":"duncanluca","email":"duncan.hoggan.extern@luca-app.de"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/yarn-osv-audit_0.1.8_1777248670479_0.693492146173234"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-15T09:42:02.959Z","modified":"2026-04-27T00:11:10.894Z","0.0.1":"2026-04-15T09:42:03.088Z","0.0.2":"2026-04-15T09:55:59.723Z","0.0.3":"2026-04-15T10:00:18.491Z","0.0.4":"2026-04-17T00:45:43.092Z","0.0.5":"2026-04-17T00:59:22.375Z","0.0.6":"2026-04-17T01:09:42.895Z","0.0.7":"2026-04-17T01:20:50.691Z","0.0.8":"2026-04-17T01:33:03.148Z","0.1.0":"2026-04-17T02:41:27.602Z","0.1.1":"2026-04-17T02:55:53.742Z","0.1.2":"2026-04-17T06:18:32.973Z","0.1.3":"2026-04-17T07:22:04.850Z","0.1.7":"2026-04-26T23:41:42.247Z","0.1.8":"2026-04-27T00:11:10.599Z"},"bugs":{"url":"https://github.com/duncanhoggan/yarn-osv-audit/issues"},"license":"MIT","homepage":"https://github.com/duncanhoggan/yarn-osv-audit#readme","keywords":["yarn","audit","security","osv","vulnerability"],"repository":{"type":"git","url":"git+https://github.com/duncanhoggan/yarn-osv-audit.git"},"description":"Audit Yarn v1 lockfiles against the OSV vulnerability database","maintainers":[{"name":"duncanhoggan","email":"duncan.hoggan@gmail.com"},{"name":"duncanluca","email":"duncan.hoggan.extern@luca-app.de"}],"readme":"# yarn-osv-audit\n\n[![npm version](https://img.shields.io/npm/v/yarn-osv-audit.svg?label=npm%20package&color=success)](https://www.npmjs.com/package/yarn-osv-audit)\n[![Build and test](https://github.com/duncanhoggan/yarn-osv-audit/actions/workflows/ci.yml/badge.svg)](https://github.com/duncanhoggan/yarn-osv-audit/actions/workflows/ci.yml)\n\nA lightweight, zero-dependency CLI tool that audits **Yarn Classic (v1)** lockfiles against the [OSV.dev](https://osv.dev) vulnerability database.\n\n## Install\n\n```bash\n# Project-local (recommended)\nyarn add -D yarn-osv-audit\n\n# Global\nnpm install -g yarn-osv-audit\n```\n\n## Quick Start\n\n```bash\n# Run with defaults (all severities, no allowlist)\nyarn-osv-audit\n\n# Use a config file\nyarn-osv-audit --config=.osv-audit.ci.jsonc\n```\n\nAdd it to your `package.json`:\n\n```json\n{\n  \"scripts\": {\n    \"audit\": \"yarn-osv-audit\",\n    \"audit:ci\": \"yarn-osv-audit --config=.osv-audit.ci.jsonc\"\n  }\n}\n```\n\n## Output Formats\n\nFour formats are supported: `compact`, `table`, `json`, `summary`. Pick one via CLI flag or config field — the CLI flag wins.\n\n| Source | Example |\n|--------|---------|\n| CLI flag (highest precedence) | `yarn-osv-audit --format=compact` |\n| Config field | `\"output-format\": \"compact\"` in `.osv-audit.jsonc` |\n| Auto (default) | `compact` when `CI` env is set, else `table` |\n\nColour auto-enables on a TTY and auto-disables under `CI=true`, `NO_COLOR`, or when stdout isn't a TTY.\n\n### compact (default under CI)\n\nCI-friendly — one vulnerability per block, no column wrapping, no box-drawing characters. Reads well at any terminal width.\n\n```bash\nyarn-osv-audit --format=compact\n```\n\n```jsonc\n// .osv-audit.jsonc\n{ \"output-format\": \"compact\" }\n```\n\n```\nyarn-osv-audit vX.X.X — scanning yarn.lock\n\nFound 2 vulnerabilities in 847 packages\n\n[HIGH · cvss 7.5] socket.io@4.5.0\n  GHSA-677m-j7p3-52f9 — Unbounded binary attachments DoS\n  Path: app > socket.io\n  Fixed in: 4.2.6\n  https://osv.dev/vulnerability/GHSA-677m-j7p3-52f9\n\n[MODERATE · cvss 5.3] semver@7.5.2\n  GHSA-c2qf-rxjj-qqgw — Regular expression DoS\n  Path: app > semver\n  Fixed in: 7.5.4\n  https://osv.dev/vulnerability/GHSA-c2qf-rxjj-qqgw\n\nSummary: 2 vulnerabilities (0 critical · 1 high · 1 moderate · 0 low)\n```\n\n### table (default locally)\n\nBordered Unicode table. Long vulnerability descriptions wrap inside the table at ~70 characters so the row stays readable on a normal terminal. Still assumes a wide terminal — `compact` is preferred under CI.\n\n```bash\nyarn-osv-audit --format=table\n```\n\n```jsonc\n// .osv-audit.jsonc\n{ \"output-format\": \"table\" }\n```\n\n```\nFound 2 vulnerabilities in 847 packages\n\n┌──────────┬───────────┬─────────┬───────────────────────────────────────────────────┬───────┬──────┐\n│ Severity │ Package   │ Version │ Vulnerability                                     │ Fixed │ CVSS │\n├──────────┼───────────┼─────────┼───────────────────────────────────────────────────┼───────┼──────┤\n│ HIGH     │ socket.io │ 4.5.0   │ GHSA-677m-j7p3-52f9                               │ 4.2.6 │ 7.5  │\n│          │           │         │ Unbounded binary attachments DoS                  │       │      │\n│          │           │         │ https://osv.dev/vulnerability/GHSA-677m-j7p3-52f9 │       │      │\n└──────────┴───────────┴─────────┴───────────────────────────────────────────────────┴───────┴──────┘\n```\n\n### json\n\nMachine-readable — pipe into tooling, dashboards, or reporting scripts.\n\n```bash\nyarn-osv-audit --format=json\n```\n\n```jsonc\n// .osv-audit.jsonc\n{ \"output-format\": \"json\" }\n```\n\n```json\n{\n  \"vulnerabilities\": [\n    {\n      \"id\": \"GHSA-677m-j7p3-52f9\",\n      \"aliases\": [\"CVE-2026-33151\"],\n      \"summary\": \"socket.io allows an unbounded number of binary attachments\",\n      \"severity\": \"HIGH\",\n      \"cvss\": 7.5,\n      \"package\": \"socket.io\",\n      \"installedVersion\": \"4.5.0\",\n      \"fixedVersion\": \"4.2.6\",\n      \"url\": \"https://osv.dev/vulnerability/GHSA-677m-j7p3-52f9\"\n    }\n  ],\n  \"metadata\": {\n    \"packagesScanned\": 847,\n    \"vulnerabilitiesFound\": 1,\n    \"severityCounts\": { \"critical\": 0, \"high\": 1, \"moderate\": 0, \"low\": 0 }\n  }\n}\n```\n\n### summary\n\nOne-line output — useful for pre-commit hooks or status lines.\n\n```bash\nyarn-osv-audit --format=summary\n```\n\n```jsonc\n// .osv-audit.jsonc\n{ \"output-format\": \"summary\" }\n```\n\n```\nyarn-osv-audit: 3 vulnerabilities (0 critical, 1 high, 1 moderate, 1 low) in 847 packages\n```\n\n## Configuration\n\nAll configuration lives in `.osv-audit.jsonc` (JSON with comments). No flags to remember, no duplication across scripts.\n\n```jsonc\n{\n  \"$schema\": \"https://raw.githubusercontent.com/duncanpharvey/yarn-osv-audit/main/docs/schema.json\",\n\n  // Severity threshold — set ONE to true.\n  // Fails on that level and everything above it.\n  // Default: \"low\": true (all vulnerabilities fail the audit)\n  \"high\": true,\n\n  // Allowlist vulnerabilities to ignore\n  \"allowlist\": [\n    // Simple — just the ID\n    \"GHSA-xxxx-yyyy-zzzz\",\n\n    // With a reason (shown in output, great for auditors)\n    {\n      \"id\": \"GHSA-aaaa-bbbb-cccc\",\n      \"package\": \"lodash\",\n      \"reason\": \"Not exploitable — we don't use the affected code path\"\n    },\n\n    // Path-specific — only ignore when reached through this dependency chain\n    {\n      \"id\": \"GHSA-mmmm-nnnn-oooo\",\n      \"package\": \"qs\",\n      \"path\": \"express>body-parser>qs\",\n      \"reason\": \"Only affects query string parsing which we handle upstream\"\n    }\n  ],\n\n  // Output: \"compact\" | \"table\" | \"json\" | \"summary\"\n  // If unset: auto — \"compact\" when CI env var is set, else \"table\".\n  \"output-format\": \"table\",\n\n  // Show details of found vulnerabilities\n  \"show-found\": true,\n\n  // Show allowlisted IDs that weren't found (helps clean up stale entries)\n  \"show-not-found\": true,\n\n  // Exclude devDependencies from the audit\n  \"skip-dev\": false,\n\n  // File paths (defaults shown)\n  \"lockfile\": \"yarn.lock\",\n  \"package-json\": \"package.json\",\n\n  // Retry count for OSV API requests\n  \"retry-count\": 3\n}\n```\n\nThe `$schema` field gives you autocompletion and validation in VS Code, JetBrains, and any editor with JSON Schema support.\n\n### Severity Thresholds\n\nOnly one should be `true`. The tool fails on that level **and above**.\n\n| Setting | Fails on |\n|---------|----------|\n| `\"low\": true` (default) | Low, Moderate, High, Critical |\n| `\"moderate\": true` | Moderate, High, Critical |\n| `\"high\": true` | High, Critical |\n| `\"critical\": true` | Critical only |\n\nSeverity is derived from CVSS v3 scores: Low (0.1-3.9), Moderate (4.0-6.9), High (7.0-8.9), Critical (9.0-10.0).\n\n### Config Reference\n\n| Field | Type | Default | Description |\n|-------|------|---------|-------------|\n| `$schema` | `string` | — | JSON Schema URL for IDE support |\n| `low` | `boolean` | `true` | Fail on low+ severity |\n| `moderate` | `boolean` | `false` | Fail on moderate+ severity |\n| `high` | `boolean` | `false` | Fail on high+ severity |\n| `critical` | `boolean` | `false` | Fail on critical only |\n| `allowlist` | `(string \\| object)[]` | `[]` | Vuln IDs to ignore |\n| `output-format` | `string` | auto | `\"compact\"`, `\"table\"`, `\"json\"`, or `\"summary\"`. Auto: `compact` if `CI` is set, else `table`. |\n| `show-found` | `boolean` | `true` | Show vulnerability details |\n| `show-not-found` | `boolean` | `true` | Show stale allowlist entries |\n| `skip-dev` | `boolean` | `false` | Exclude devDependencies (production tree follows `dependencies` + `optionalDependencies`) |\n| `lockfile` | `string` | `\"yarn.lock\"` | Path to yarn.lock |\n| `package-json` | `string` | `\"package.json\"` | Path to package.json |\n| `retry-count` | `number` | `3` | API retry count |\n\n## CLI Flags\n\nIntentionally minimal. Configuration belongs in the config file.\n\n| Flag | Description |\n|------|-------------|\n| `--config=<path>`, `-c=<path>` | Path to config file (default: `.osv-audit.jsonc`) |\n| `--format=<fmt>` | Output format: `compact`, `table`, `json`, `summary`. Overrides config. |\n| `--ignore-all`, `-i` | Append every reported vulnerability to the config's `allowlist` (no prompts) |\n| `--fix` | Read the allowlist, find same-major fix versions, and rewrite `package.json` / `resolutions`. See [Fixing vulnerabilities](#fixing-vulnerabilities). |\n| `--verbose`, `-v` | Log diagnostic details to stderr |\n| `--help` | Show help |\n| `--version` | Show version |\n\n### Bulk Allowlisting (`-i` / `--ignore-all`)\n\nRunning with `-i` appends every reported vulnerability to the `allowlist` in one shot — no prompts. Comments and formatting in `.osv-audit.jsonc` are preserved. Duplicate occurrences of the same vulnerability ID are collapsed into a single entry, and the OSV vulnerability URL is recorded as the entry's `reason`.\n\n```bash\nyarn-osv-audit -i\n```\n\nUse this when you want to acknowledge the current backlog of findings as a baseline, then triage / remove entries from `.osv-audit.jsonc` later. Because there's no prompting, this works in CI / non-TTY environments.\n\n## Fixing vulnerabilities\n\n```bash\nyarn-osv-audit --fix\n```\n\nOnce vulnerabilities are in the allowlist (via `-i` or manual edits), `--fix` walks the allowlist, queries OSV for a fix version, and rewrites `package.json` so the next `yarn install` picks it up:\n\n- **Direct deps** — the entry in `dependencies` / `devDependencies` / `optionalDependencies` is rewritten to the exact `<fixed>` version (no `^` or `~` range — deterministic pin).\n- **Transitive deps** — a top-level `resolutions` entry is added (or updated) to the exact `<fixed>` version.\n- **Semver safety** — only same-major bumps are applied. When OSV publishes fixes on multiple major lines (e.g. `1.1.12`, `2.0.2`, `5.0.5`), the smallest same-major fix greater than the installed version is chosen.\n- **Cross-major only** — reported under `Skipped` with the list of available fix versions. You'll need to upgrade manually.\n- **Allowlist cleanup** — every successfully fixed entry is spliced out of `.osv-audit.jsonc`. Comments outside the allowlist array are preserved; the array body is rebuilt from the kept entries, so any standalone comments inside the allowlist are dropped.\n- **Package annotation** — any skipped (cross-major / no-fix) entries get a `package` field added in place so the residual allowlist self-documents which npm package each ID relates to. Entries added via `-i` already include `package`.\n\nThe tool only edits files — run `yarn install` afterwards to update the lockfile.\n\n```\nyarn-osv-audit v0.1.1 — fixing allowlisted vulns from .osv-audit.jsonc\n\nApplied 1 fix:\n  lodash → 4.17.21 [dependencies] (was ^4.17.10)\n    GHSA-p6mc-m468-83gw — https://osv.dev/vulnerability/GHSA-p6mc-m468-83gw\n\nRun `yarn install` to apply these changes.\n\nSkipped 1:\n  brace-expansion@1.1.11 — no same-major fix (installed 1.1.11, available 2.0.2, 5.0.5)\n    GHSA-f886-m6hf-6m8v — https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\n\nRemoved 1 allowlist entry: GHSA-p6mc-m468-83gw\n```\n\n## Exit Codes\n\n| Code | Meaning |\n|------|---------|\n| `0` | No vulnerabilities found (at or above threshold) |\n| `1` | Vulnerabilities found (at or above threshold) |\n| `2` | Runtime error (network failure, parse error, invalid config) |\n\n## CI Examples\n\n### GitHub Actions\n\n```yaml\n- name: Audit dependencies\n  run: yarn-osv-audit --config=.osv-audit.ci.jsonc\n```\n\n### Pre-commit Hook\n\n```json\n{\n  \"scripts\": {\n    \"precommit\": \"yarn-osv-audit\"\n  }\n}\n```\n\n## How It Works\n\n1. **Parse** `yarn.lock` — extracts unique (package, version) pairs\n2. **Query** the [OSV batch API](https://osv.dev/docs/#tag/api/post/v1/querybatch) — up to 1000 packages per request\n3. **Hydrate** vulnerability details — fetches CVSS scores, summaries, fix versions\n4. **Filter** — applies allowlist, severity threshold, and skip-dev rules\n5. **Report** — outputs results in your chosen format\n\n## Requirements\n\n- **Node.js** >= 18 (uses native `fetch`)\n- **Yarn v1** lockfile (`yarn.lock`)\n\n## License\n\nMIT\n","readmeFilename":"README.md"}