Close Open Privacy Scan

link https://github.com/node-fetch/node-fetch
bolt Snapshot: commit 8b3320d
science engine v1
schedule 2026-06-26T09:04:40.677173+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

App Privacy Score

85 /100
Low privacy risk

Low risk · 156 finding(s)

Dependency score: 67 (Medium risk)

bar_chart Score Breakdown

egress −15

list Scan Summary

1 high 0 medium 155 low
First-party packages: 1
Dependency packages: 6
Ecosystem: npm

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (1)
high coveralls dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/npm/[email protected]/lib/sendToCoveralls.js:9 → pkgs/npm/[email protected]/lib/sendToCoveralls.js:19

</> First-Party Code

first-party (npm)

npm first-party
expand_more 7 low-confidence finding(s)
low egress production #d5229d9268030387 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/@types/index.test-d.ts:9 
	const getResponse = await fetch('https://bigfile.com/test.zip');

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #804206f530860a79 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/@types/index.test-d.ts:10 
	await fetch(new URL('https://bigfile.com/test.zip'));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2da5bd0e3b6d5e22 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/@types/index.test-d.ts:40 
		new Request(new URL('http://byjka.com/buka'));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1b59fa9977d95272 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/example.js:10 
const response = await fetch('https://github.com/');

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #dc2c2773f4c520c8 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/example.js:16 
const response = await fetch('https://github.com/');

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c5a936abee0b53ba — Hardcoded external endpoint. Review what data is sent to this destination.
repo/example.js:22 
const response = await fetch('https://httpbin.org/post', {method: 'POST', body: 'a=1'});

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #59631df47ad84e1d — Hardcoded external endpoint. Review what data is sent to this destination.
repo/example.js:30 
const response = await fetch('https://httpbin.org/post', {
	method: 'post',
	body: JSON.stringify(body),
	headers: {'Content-Type': 'application/json'}
});

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

</> Dependencies

coveralls

npm dependency
high pii_flow dependency Excluded from app score #a7ab8f9f29b74561 — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.
pkgs/npm/[email protected]/lib/sendToCoveralls.js:19 · flow /tmp/closeopen-ff82rsnn/pkgs/npm/[email protected]/lib/sendToCoveralls.js:9 → /tmp/closeopen-ff82rsnn/pkgs/npm/[email protected]/lib/sendToCoveralls.js:19 
    request.post({
      url,
      form: {
        json: str
      }
    }, (err, response, body) => {
      cb(err, response, body);
    });

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 114 low-confidence finding(s)
low env_fs dependency Excluded from app score #f0fac9aae6c29837 — Filesystem access.
pkgs/npm/[email protected]/lib/convertLcovToCoveralls.js:3 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0fac9aae6c29837 — Filesystem access.
pkgs/npm/[email protected]/lib/convertLcovToCoveralls.js:3 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d99e48bc712fc3e0 — Filesystem access.
pkgs/npm/[email protected]/lib/convertLcovToCoveralls.js:33 
  const source = fs.readFileSync(filepath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61ccb498536d5843 — Filesystem access.
pkgs/npm/[email protected]/lib/detectLocalGit.js:3 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61ccb498536d5843 — Filesystem access.
pkgs/npm/[email protected]/lib/detectLocalGit.js:3 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f3c45a53d0af48d — Filesystem access.
pkgs/npm/[email protected]/lib/detectLocalGit.js:26 
  const head = fs.readFileSync(path.join(dir, '.git', 'HEAD'), 'utf-8').trim();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aafd7d4486c48a48 — Filesystem access.
pkgs/npm/[email protected]/lib/detectLocalGit.js:43 
    return fs.readFileSync(ref, 'utf-8').trim();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #811aa57023cfc759 — Filesystem access.
pkgs/npm/[email protected]/lib/detectLocalGit.js:49 
  const packedRefsText = fs.readFileSync(packedRefs, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4101ddfe81e3c11e — Filesystem access.
pkgs/npm/[email protected]/lib/getOptions.js:3 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4101ddfe81e3c11e — Filesystem access.
pkgs/npm/[email protected]/lib/getOptions.js:3 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7cead765517ffd0a — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:13 
  let git_commit = process.env.COVERALLS_GIT_COMMIT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a34a6eae431e64d9 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:14 
  let git_branch = process.env.COVERALLS_GIT_BRANCH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9d69e23f68f52ca — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:19 
  const match = (process.env.CI_PULL_REQUEST || '').match(/(\d+)$/);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d75b5c256c5d3ed3 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:25 
  if (process.env.TRAVIS) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #532a0bc76c69a0c0 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:27 
    options.service_number = process.env.TRAVIS_BUILD_NUMBER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57d406e6673731d5 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:28 
    options.service_job_id = process.env.TRAVIS_JOB_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c6fa856f56f2c25 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:29 
    options.service_pull_request = process.env.TRAVIS_PULL_REQUEST;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21f1fa28f91332c4 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:31 
    git_branch = process.env.TRAVIS_BRANCH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6ce16e8eaf3eeca — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:34 
  if (process.env.DRONE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27ce6d1091972cdd — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:36 
    options.service_job_id = process.env.DRONE_BUILD_NUMBER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af721e126582170f — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:37 
    options.service_pull_request = process.env.DRONE_PULL_REQUEST;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50da12542fa237cb — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:38 
    git_committer_name = process.env.DRONE_COMMIT_AUTHOR;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20977e4ed9701fa1 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:39 
    git_committer_email = process.env.DRONE_COMMIT_AUTHOR_EMAIL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a8ae77fe2c166f8 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:40 
    git_commit = process.env.DRONE_COMMIT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcdc224d8a889574 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:41 
    git_branch = process.env.DRONE_BRANCH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c1c6a3cba981fd0 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:42 
    git_message = process.env.DRONE_COMMIT_MESSAGE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4567fc07abf066c — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:45 
  if (process.env.JENKINS_URL || process.env.JENKINS_HOME) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4567fc07abf066c — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:45 
  if (process.env.JENKINS_URL || process.env.JENKINS_HOME) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3898907ebe0943a1 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:47 
    options.service_job_id = process.env.BUILD_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40d22d934a90d336 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:48 
    options.service_pull_request = process.env.CHANGE_ID || process.env.ghprbPullId;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40d22d934a90d336 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:48 
    options.service_pull_request = process.env.CHANGE_ID || process.env.ghprbPullId;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bfe21f83fd294f6 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:49 
    git_committer_name = process.env.CHANGE_AUTHOR;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0af05613bbebdc02 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:50 
    git_committer_email = process.env.CHANGE_AUTHOR_EMAIL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d275a19add1c140 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:51 
    git_commit = process.env.GIT_COMMIT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62f016421365c880 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:52 
    git_branch = process.env.CHANGE_BRANCH || process.env.GIT_BRANCH || process.env.BRANCH_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62f016421365c880 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:52 
    git_branch = process.env.CHANGE_BRANCH || process.env.GIT_BRANCH || process.env.BRANCH_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62f016421365c880 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:52 
    git_branch = process.env.CHANGE_BRANCH || process.env.GIT_BRANCH || process.env.BRANCH_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed736d7d069ead48 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:55 
  if (process.env.CIRCLECI) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3eaf902d6ea73bf3 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:57 
    options.service_number = process.env.CIRCLE_WORKFLOW_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e34dc81bcc58938 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:58 
    options.service_job_number = process.env.CIRCLE_BUILD_NUM;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #602cadf8cc2189e3 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:60 
    if (process.env.CI_PULL_REQUEST) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1dc106a63a5caf9f — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:61 
      const pr = process.env.CI_PULL_REQUEST.split('/pull/');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c3f7dd8bcbdbfa2 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:65 
    git_commit = process.env.CIRCLE_SHA1;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3786526ce8b1e861 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:66 
    git_branch = process.env.CIRCLE_BRANCH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bc27fb5aa69f41e — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:69 
  if (process.env.CI_NAME && process.env.CI_NAME === 'codeship') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bc27fb5aa69f41e — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:69 
  if (process.env.CI_NAME && process.env.CI_NAME === 'codeship') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7dc5daa15412a846 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:71 
    options.service_job_id = process.env.CI_BUILD_NUMBER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f198594509dfa11 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:72 
    git_commit = process.env.CI_COMMIT_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5bff83aa2ae00ea — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:73 
    git_branch = process.env.CI_BRANCH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #007706750e75eb87 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:74 
    git_committer_name = process.env.CI_COMMITTER_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f40c05a20639a544 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:75 
    git_committer_email = process.env.CI_COMMITTER_EMAIL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64b376b63bf28b5f — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:76 
    git_message = process.env.CI_COMMIT_MESSAGE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c76767a6888b1a0b — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:79 
  if (process.env.WERCKER) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #01ab498060a917f8 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:81 
    options.service_job_id = process.env.WERCKER_BUILD_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93ba1ec74093cf14 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:82 
    git_commit = process.env.WERCKER_GIT_COMMIT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1baf74cf4ae1e33 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:83 
    git_branch = process.env.WERCKER_GIT_BRANCH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f4f78a5eaec9991 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:86 
  if (process.env.GITLAB_CI) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9ac0a2bf57b6e33 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:88 
    options.service_job_number = process.env.CI_BUILD_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19b6ab56054b86c1 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:89 
    options.service_job_id = process.env.CI_BUILD_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #311cd334a1f0b0fb — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:90 
    options.service_pull_request = process.env.CI_MERGE_REQUEST_IID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #058a7057875de347 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:91 
    git_commit = process.env.CI_BUILD_REF;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c778a5d9f35ca86 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:92 
    git_branch = process.env.CI_BUILD_REF_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20b7076467848f70 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:95 
  if (process.env.APPVEYOR) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #28013d4c0315a49e — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:97 
    options.service_job_number = process.env.APPVEYOR_BUILD_NUMBER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d63d5f293aca6f1d — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:98 
    options.service_job_id = process.env.APPVEYOR_BUILD_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20eac1e63bda8ab9 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:99 
    git_commit = process.env.APPVEYOR_REPO_COMMIT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eac002015769f7d2 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:100 
    git_branch = process.env.APPVEYOR_REPO_BRANCH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08f1785f1d4b94b8 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:103 
  if (process.env.SURF_SHA1) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd6945306bf66c40 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:105 
    git_commit = process.env.SURF_SHA1;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e311ef6e76526805 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:106 
    git_branch = process.env.SURF_REF;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #adf6d75253721f95 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:109 
  if (process.env.BUILDKITE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #931719099770904f — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:111 
    options.service_job_number = process.env.BUILDKITE_BUILD_NUMBER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f36e0974321410a1 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:112 
    options.service_job_id = process.env.BUILDKITE_BUILD_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68004efbad63a356 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:113 
    options.service_pull_request = process.env.BUILDKITE_PULL_REQUEST;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #652b393cb0119a5f — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:114 
    git_commit = process.env.BUILDKITE_COMMIT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17fb1ee547515ad3 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:115 
    git_branch = process.env.BUILDKITE_BRANCH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38b83330ce041bfe — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:116 
    git_committer_name = process.env.BUILDKITE_BUILD_CREATOR;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6912cfd3c7f63e1 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:117 
    git_committer_email = process.env.BUILDKITE_BUILD_CREATOR_EMAIL;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdae302d52082842 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:118 
    git_message = process.env.BUILDKITE_MESSAGE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1f3db448c76500b — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:121 
  if (process.env.SEMAPHORE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ebf236d96519940 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:123 
    options.service_job_id = process.env.SEMAPHORE_BUILD_NUMBER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8d21a954e7d3758 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:124 
    git_commit = process.env.REVISION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93b90b6856a4cb96 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:125 
    git_branch = process.env.BRANCH_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e70a4b9851087fcd — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:128 
  if (process.env.TF_BUILD) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4856c29ae283dc51 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:130 
    options.service_job_id = process.env.BUILD_BUILDID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a2fc282a35689c3 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:131 
    options.service_pull_request = process.env.SYSTEM_PULLREQUEST_PULLREQUESTNUMBER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2aa5aa585a5afd6 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:132 
    git_commit = process.env.BUILD_SOURCEVERSION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #608f2728f5f95ce5 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:133 
    git_branch = process.env.BUILD_SOURCEBRANCHNAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4568b16eadef583a — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:136 
  if (process.env.CF_BRANCH) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc5b3cd9bef4e94e — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:138 
    options.service_job_id = process.env.CF_BUILD_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db232fcd89707697 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:139 
    options.service_pull_request = process.env.CF_PULL_REQUEST_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ddd7b879f1d238c4 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:140 
    git_commit = process.env.CF_REVISION;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8767b339bfe0a6b — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:141 
    git_branch = process.env.CF_BRANCH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #411c60879c4500fd — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:142 
    git_committer_name = process.env.CF_COMMIT_AUTHOR;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd3b16c1715b9895 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:143 
    git_message = process.env.CF_COMMIT_MESSAGE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f825476c3659af5 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:146 
  options.run_at = process.env.COVERALLS_RUN_AT || JSON.stringify(new Date()).slice(1, -1);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f49ead074efac48 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:148 
  if (process.env.COVERALLS_SERVICE_NUMBER) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09eaa829766aa136 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:149 
    options.service_number = process.env.COVERALLS_SERVICE_NUMBER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #941d972bb54d7ce7 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:152 
  if (process.env.COVERALLS_SERVICE_JOB_NUMBER) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e09b53ae09a27e21 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:153 
    options.service_job_number = process.env.COVERALLS_SERVICE_JOB_NUMBER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11edd5085cb888a2 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:156 
  if (process.env.COVERALLS_SERVICE_JOB_ID) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55296b6458554f41 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:157 
    options.service_job_id = process.env.COVERALLS_SERVICE_JOB_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f8abd5699f425b5 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:168 
  if (process.env.COVERALLS_PARALLEL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3918eed67afc95fc — Filesystem access.
pkgs/npm/[email protected]/lib/getOptions.js:177 
        return yaml.safeLoad(fs.readFileSync(yml, 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1469c4c09c028e25 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:196 
  if (process.env.COVERALLS_REPO_TOKEN) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc20d4fafa3b6c1c — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:197 
    options.repo_token = process.env.COVERALLS_REPO_TOKEN;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3604b69b9a48964c — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:206 
  if (process.env.COVERALLS_SERVICE_NAME) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ba9591eed85274f — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:207 
    options.service_name = process.env.COVERALLS_SERVICE_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58364e01ef9f0cc1 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:210 
  if (process.env.COVERALLS_FLAG_NAME) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0948ed2b0738328 — Environment-variable access.
pkgs/npm/[email protected]/lib/getOptions.js:211 
    options.flag_name = process.env.COVERALLS_FLAG_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb852d35f1a7648c — Environment-variable access.
pkgs/npm/[email protected]/lib/logger.js:9 
  if (index.options.verbose || process.env.NODE_COVERALLS_DEBUG === 1 || process.env.NODE_COVERALLS_DEBUG === '1') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb852d35f1a7648c — Environment-variable access.
pkgs/npm/[email protected]/lib/logger.js:9 
  if (index.options.verbose || process.env.NODE_COVERALLS_DEBUG === 1 || process.env.NODE_COVERALLS_DEBUG === '1') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c6b80392a952254 — Environment-variable access.
pkgs/npm/[email protected]/lib/sendToCoveralls.js:8 
  if (process.env.COVERALLS_ENDPOINT) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a0272ceb6a0439c — Environment-variable access.
pkgs/npm/[email protected]/lib/sendToCoveralls.js:9 
    urlBase = process.env.COVERALLS_ENDPOINT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

c8

npm dependency
expand_more 14 low-confidence finding(s)
low env_fs dependency Excluded from app score #0b641deb3e0417d0 — Environment-variable access.
pkgs/npm/[email protected]/bin/c8.js:27 
    process.env.NODE_V8_COVERAGE = argv.tempDirectory

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #900bfcf52f8cc09f — Environment-variable access.
pkgs/npm/[email protected]/lib/commands/report.js:40 
    monocartArgv: (argv.experimentalMonocart || process.env.EXPERIMENTAL_MONOCART) ? argv : null

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #549774e69fdcd9b5 — Filesystem access.
pkgs/npm/[email protected]/lib/parse-args.js:4 
const { readFileSync } = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #549774e69fdcd9b5 — Filesystem access.
pkgs/npm/[email protected]/lib/parse-args.js:4 
const { readFileSync } = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dbce966bfb5d1ff2 — Filesystem access.
pkgs/npm/[email protected]/lib/parse-args.js:18 
        const config = JSON.parse(readFileSync(path))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2af138d401b20850 — Environment-variable access.
pkgs/npm/[email protected]/lib/parse-args.js:129 
      default: process.env.NODE_V8_COVERAGE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12a8bee3b2446455 — Filesystem access.
pkgs/npm/[email protected]/lib/report.js:9 
  ;({ readFile } = require('fs').promises)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c49bbde1c6caf4d7 — Filesystem access.
pkgs/npm/[email protected]/lib/report.js:11 
const { readdirSync, readFileSync, statSync } = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c49bbde1c6caf4d7 — Filesystem access.
pkgs/npm/[email protected]/lib/report.js:11 
const { readdirSync, readFileSync, statSync } = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1d663d84cdcc357 — Filesystem access.
pkgs/npm/[email protected]/lib/report.js:452 
        reports.push(JSON.parse(readFileSync(
          resolve(this.tempDirectory, file),
          'utf8'
        )))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #505d13d9b6d3ea8f — Filesystem access.
pkgs/npm/[email protected]/lib/source-map-from-file.js:27 
const { readFileSync } = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #505d13d9b6d3ea8f — Filesystem access.
pkgs/npm/[email protected]/lib/source-map-from-file.js:27 
const { readFileSync } = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9dedb2e337037264 — Filesystem access.
pkgs/npm/[email protected]/lib/source-map-from-file.js:40 
  const fileBody = readFileSync(filename).toString()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21896e043b282f84 — Filesystem access.
pkgs/npm/[email protected]/lib/source-map-from-file.js:71 
    const content = readFileSync(fileURLToPath(mapURL), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

fetch-blob

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #25a728ada8f96d51 — Filesystem access.
pkgs/npm/[email protected]/from.js:76 
  await fs.writeFile(destination, data, { signal })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

form-data

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #919b23102a1454e0 — Filesystem access.
pkgs/npm/[email protected]/lib/form_data.js:9 
var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #919b23102a1454e0 — Filesystem access.
pkgs/npm/[email protected]/lib/form_data.js:9 
var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

formdata-node

npm dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #99c5c0c847340d28 — Filesystem access.
pkgs/npm/[email protected]/lib/file-from-path.cjs:46 
var import_node_fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99c5c0c847340d28 — Filesystem access.
pkgs/npm/[email protected]/lib/file-from-path.cjs:46 
var import_node_fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18a8dcdecdf87ec5 — Filesystem access.
pkgs/npm/[email protected]/lib/file-from-path.js:21 
import { statSync, createReadStream } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1df6e2f35aef198 — Filesystem access.
pkgs/npm/[email protected]/lib/file-from-path.js:22 
import { stat } from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mocha

npm dependency
expand_more 13 low-confidence finding(s)
low env_fs dependency Excluded from app score #b8dbac23887ce2ea — Filesystem access.
pkgs/npm/[email protected]/lib/cli/config.js:39 
    require("js-yaml").load(fs.readFileSync(filepath, "utf8")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ade84644954959c — Filesystem access.
pkgs/npm/[email protected]/lib/cli/config.js:55 
      require("strip-json-comments")(fs.readFileSync(filepath, "utf8")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76ba2185f340643b — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:27 
  const css = fs.readFileSync(path.join(srcdir, "mocha.css"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a7bf871f4c0f81c2 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:28 
  const js = fs.readFileSync(path.join(srcdir, "mocha.js"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3683b7cf4da5ad24 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:29 
  const tmpl = fs.readFileSync(
    path.join(srcdir, "lib", "browser", "template.html"),
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #612b94e453d4af83 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:32 
  fs.writeFileSync(path.join(destdir, "mocha.css"), css);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96b4eddb653a22bf — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:33 
  fs.writeFileSync(path.join(destdir, "mocha.js"), js);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06bac8627e7c20fd — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:34 
  fs.writeFileSync(path.join(destdir, "tests.spec.js"), "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2559ae5a7b3385a — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:35 
  fs.writeFileSync(path.join(destdir, "index.html"), tmpl);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37e0c8d15b94add4 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/options.js:240 
      configData = fs.readFileSync(filepath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58f3edf221aa21aa — Environment-variable access.
pkgs/npm/[email protected]/lib/cli/options.js:302 
  const envConfig = parse(process.env.MOCHA_OPTIONS || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa15489f6990de57 — Environment-variable access.
pkgs/npm/[email protected]/lib/reporters/base.js:58 
  (supportsColor.stdout || process.env.MOCHA_COLORS !== undefined);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88a37bbced0b363a — Filesystem access.
pkgs/npm/[email protected]/lib/reporters/json.js:90 
        fs.writeFileSync(output, json);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • data-uri-to-buffer prod — dist-only: no readable source

Development

  • tsd dev — dist-only: no readable source
  • xo dev — dist-only: no readable source