Streaming JSON / NDJSON parser with backpressure support.
Tar/zip extraction with streaming API.
Color helpers — typo-squat of tinycolor2.
Drop-in JWT verification middleware for Express.
| ID | Severity | Title | AI Score | Found | Status |
|---|---|---|---|---|---|
| ZDS-2025-0142 | CRITICAL9.8 | Prototype pollution via crafted JSON chunk EPSS 96%POC NOKEVEXPLOITED NOW CWE-1321· 1 affected | 97 | 12h ago | DISCLOSED |
| ZDS-2025-0138 | MEDIUM6.3 | Typo-squat shipping postinstall miner EPSS 57%POC NONO-KEVNOT EXPLOITED CWE-506· 1 affected | 88 | 6d ago | DISCLOSED |
| ZDS-2025-0133 | HIGH8.1 | JWT 'none' algorithm accepted under fallback path EPSS 63%POC NONO-KEVNOT EXPLOITED CWE-327· 1 affected | 74 | 15d ago | PATCHED |
| ZDS-2025-0131 | HIGH8.0 | Zip-slip path traversal during extraction EPSS 74%POC NOKEVNOT EXPLOITED CWE-22· 1 affected | 91 | 19d ago | DISCLOSED |