Close Open Privacy Scan

link https://github.com/fastify/fastify
bolt Snapshot: commit 7f6d319
science engine v2
schedule 2026-07-01T17:08:05.295501+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

97 /100
Low privacy risk

Low risk · 100 finding(s)

Dependency score: 77 (Medium risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 2 medium 98 low
First-party packages: 1
Dependency packages: 14
Ecosystem: npm

swap_horiz Application data flows

No high- or medium-confidence application data-flow findings in this scan.

</> First-Party Code

first-party (npm)

npm first-party
expand_more 6 low-confidence finding(s)
low env_fs production #b86cbf72995933c3 — Filesystem access.
repo/examples/http2.js:8 
    key: fs.readFileSync(path.join(__dirname, '../test/https/fastify.key')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #836ba12e66274b36 — Filesystem access.
repo/examples/http2.js:9 
    cert: fs.readFileSync(path.join(__dirname, '../test/https/fastify.cert'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39264b2109050cb4 — Filesystem access.
repo/examples/https.js:7 
    key: fs.readFileSync(path.join(__dirname, '../test/https/fastify.key')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #79fca0d45c53f1d5 — Filesystem access.
repo/examples/https.js:8 
    cert: fs.readFileSync(path.join(__dirname, '../test/https/fastify.cert'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f2a16f1575eb1a4e — Environment-variable access.
repo/scripts/validate-ecosystem-links.js:24 
  return process.env.GITHUB_TOKEN

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c2d50e086612cbd1 — Filesystem access.
repo/scripts/validate-ecosystem-links.js:100 
  const content = fs.readFileSync(ECOSYSTEM_FILE, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

autocannon

npm dependency
medium telemetry dependency Excluded from app score #4a3d3f045dc9a990 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/samples/track-run-workers.js:22 
  autocannon.track(instance)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #ba870e2584954f52 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/samples/track-run.js:19 
  autocannon.track(instance)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 15 low-confidence finding(s)
low env_fs dependency Excluded from app score #50e27196d3c2b053 — Filesystem access.
pkgs/npm/[email protected]/autocannon.js:6 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c2c876b50093f7f — Filesystem access.
pkgs/npm/[email protected]/autocannon.js:141 
    const help = fs.readFileSync(path.join(__dirname, 'help.txt'), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8aaa17aec6414a9c — Environment-variable access.
pkgs/npm/[email protected]/autocannon.js:149 
  if (process.env.PORT) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30611018712c6b02 — Environment-variable access.
pkgs/npm/[email protected]/autocannon.js:150 
    argv.url = ofURL(argv.url).map(url => new URL(url, `http://localhost:${process.env.PORT}`).href)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23bbb88420d67050 — Filesystem access.
pkgs/npm/[email protected]/autocannon.js:181 
    argv.body = fs.readFileSync(argv.input, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c503ea0228bde3f — Filesystem access.
pkgs/npm/[email protected]/autocannon.js:202 
      argv.har = JSON.parse(fs.readFileSync(argv.har))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #419e7765696ec68f — Filesystem access.
pkgs/npm/[email protected]/autocannon.js:220 
      argv.tlsOptions.cert = fs.readFileSync(argv.cert)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #31b92e39b867a115 — Filesystem access.
pkgs/npm/[email protected]/autocannon.js:228 
      argv.tlsOptions.key = fs.readFileSync(argv.key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6b9913a6c43fbc7 — Filesystem access.
pkgs/npm/[email protected]/autocannon.js:242 
      argv.tlsOptions.ca = argv.ca.map(caPath => fs.readFileSync(caPath))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b03973b1e9db386 — Environment-variable access.
pkgs/npm/[email protected]/autocannon.js:285 
    const alterPath = managePath({ PATH: process.env.NODE_PATH })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #005f4691a794524d — Environment-variable access.
pkgs/npm/[email protected]/autocannon.js:292 
          (process.env.NODE_OPTIONS ? ` ${process.env.NODE_OPTIONS}` : ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e90bfdff959ca043 — Filesystem access.
pkgs/npm/[email protected]/lib/multipart.js:4 
const { readFileSync } = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4465462a8b2783e9 — Filesystem access.
pkgs/npm/[email protected]/lib/multipart.js:13 
      const data = readFileSync(path, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bbe46d571e99ed4a — Filesystem access.
pkgs/npm/[email protected]/lib/multipart.js:33 
        const buffer = readFileSync(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9bb13b4c657865b — Environment-variable access.
pkgs/npm/[email protected]/lib/preload/autocannonDetectPort.js:6 
const socket = net.connect(process.env.AUTOCANNON_SOCKET)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@jsumners/line-reporter

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #ea34eea276f4863e — Environment-variable access.
pkgs/npm/@[email protected]/index.mjs:3 
const OUTPUT_MODE = process.env.LINE_REPORTER_MODE?.toLowerCase() ?? ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0bb28d9228bd06ed — Environment-variable access.
pkgs/npm/@[email protected]/index.mjs:6 
const locale = process.env.LINE_REPORTER_LOCALE ?? 'en-US'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

borp

npm dependency
expand_more 12 low-confidence finding(s)
low env_fs dependency Excluded from app score #d9fe3d37c6a69cec — Environment-variable access.
pkgs/npm/[email protected]/borp.js:21 
delete process.env.NODE_TEST_CONTEXT

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57e9fb77c4460ee0 — Environment-variable access.
pkgs/npm/[email protected]/borp.js:123 
    process.env.NODE_OPTIONS = (process.env.NODE_OPTIONS ? process.env.NODE_OPTIONS + ' ' : '') + '--expose-gc'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39a048e06ea25707 — Environment-variable access.
pkgs/npm/[email protected]/borp.js:156 
  process.env.NODE_V8_COVERAGE = covDir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #994b426eacfc7011 — Environment-variable access.
pkgs/npm/[email protected]/borp.js:169 
  if (process.env.GITHUB_ACTION) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ec34bd4d0b3b2b0 — Filesystem access.
pkgs/npm/[email protected]/borp.js:223 
    const nycrcConfig = nycrc ? JSON.parse(await readFile(nycrc, 'utf8')) : {}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc67a10fd894809d — Environment-variable access.
pkgs/npm/[email protected]/lib/conf.js:9 
  if (process.env.BORP_CONF_FILE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #454246dd13874c3d — Environment-variable access.
pkgs/npm/[email protected]/lib/conf.js:10 
    target = process.env.BORP_CONF_FILE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae9e70332e92a67b — Filesystem access.
pkgs/npm/[email protected]/lib/conf.js:36 
    fileData = await readFile(fd, { encoding: 'utf8' })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #beee7a211a80335d — Environment-variable access.
pkgs/npm/[email protected]/lib/run.js:7 
  delete process.env.NODE_TEST_CONTEXT

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a3ee39b75ca4a379 — Filesystem access.
pkgs/npm/[email protected]/scripts/sync-version.mjs:5 
let { version } = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3c8798020094dea4 — Filesystem access.
pkgs/npm/[email protected]/scripts/sync-version.mjs:14 
    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #45297274c4367d61 — Filesystem access.
pkgs/npm/[email protected]/scripts/sync-version.mjs:16 
    fs.writeFileSync(path.resolve('./package.json'), JSON.stringify(packageJson, null, 2) + '\n', { encoding: 'utf-8' })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

branch-comparer

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #717edacc821169c1 — Filesystem access.
pkgs/npm/[email protected]/index.js:9 
const Fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

eslint

npm dependency
expand_more 13 low-confidence finding(s)
low env_fs dependency Excluded from app score #741ded1cc76d83cc — Filesystem access.
pkgs/npm/[email protected]/lib/cli-engine/lint-result-cache.js:129 
			results.source = fs.readFileSync(filePath, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bda88fb02aaa01d9 — Filesystem access.
pkgs/npm/[email protected]/lib/cli.js:133 
			await writeFile(filePath, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4fef67533c77fa0 — Filesystem access.
pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:1281 
		const text = await fsp.readFile(filePath, {
			encoding: "utf8",
			signal: controller?.signal,
		});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #661f80807c53cf15 — Environment-variable access.
pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:1326 
	if (!process.env.ESLINT_FLAGS) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #415d9e5e443995b8 — Environment-variable access.
pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:1330 
	const envFlags = process.env.ESLINT_FLAGS.trim().split(/\s*,\s*/gu);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #97b29701313fa83d — Filesystem access.
pkgs/npm/[email protected]/lib/eslint/eslint.js:825 
					retrier.retry(() => fs.writeFile(r.filePath, r.output)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a833c984c70d3cef — Environment-variable access.
pkgs/npm/[email protected]/lib/linter/timing.js:44 
const enabled = !!process.env.TIMING;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e46fd5b826f2e7e5 — Environment-variable access.
pkgs/npm/[email protected]/lib/linter/timing.js:56 
	if (typeof process.env.TIMING !== "string") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #708654067773817c — Environment-variable access.
pkgs/npm/[email protected]/lib/linter/timing.js:60 
	if (process.env.TIMING.toLowerCase() === "all") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #468b17385ca1485f — Environment-variable access.
pkgs/npm/[email protected]/lib/linter/timing.js:64 
	const TIMING_ENV_VAR_AS_INTEGER = Number.parseInt(process.env.TIMING, 10);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ef0d4ab3d3cdd25 — Filesystem access.
pkgs/npm/[email protected]/lib/rule-tester/rule-tester.js:697 
				let content = readFileSync(sourceFile, "utf8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a2d8c293f53eff3 — Filesystem access.
pkgs/npm/[email protected]/lib/services/suppressions-service.js:217 
			const data = await fs.promises.readFile(this.filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a9370d1dcf1d9f1 — Filesystem access.
pkgs/npm/[email protected]/lib/services/suppressions-service.js:240 
		return fs.promises.writeFile(
			this.filePath,
			stringify(suppressions, { space: 2 }),
		);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

h2url

npm dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #c9ea83e62616be11 — Filesystem access.
pkgs/npm/[email protected]/h2url.js:10 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f6a99b5081b5a4b — Filesystem access.
pkgs/npm/[email protected]/server.js:3 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #880e1e9742c4bf1a — Filesystem access.
pkgs/npm/[email protected]/server.js:11 
  key: fs.readFileSync(path.join(__dirname, 'test', 'test.key')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59c1ce1ea3eb39c7 — Filesystem access.
pkgs/npm/[email protected]/server.js:12 
  cert: fs.readFileSync(path.join(__dirname, 'test', 'test.cert'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

markdownlint-cli2

npm dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #f23bfea6d7a81179 — Filesystem access.
pkgs/npm/[email protected]/markdownlint-cli2.mjs:39 
const readJsonc = (/** @type {string} */ file, /** @type {FsLike} */ fs) => fs.promises.readFile(file, utf8).then(jsoncParse);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f81d98dbc9f466a4 — Filesystem access.
pkgs/npm/[email protected]/markdownlint-cli2.mjs:42 
const readToml = (/** @type {string} */ file, /** @type {FsLike} */ fs) => fs.promises.readFile(file, utf8).then(tomlParse);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7af5323082696ff — Filesystem access.
pkgs/npm/[email protected]/markdownlint-cli2.mjs:45 
const readYaml = (/** @type {string} */ file, /** @type {FsLike} */ fs) => fs.promises.readFile(file, utf8).then(yamlParse);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3e1223388f8822f — Filesystem access.
pkgs/npm/[email protected]/markdownlint-cli2.mjs:802 
            subTasks.push(fs.promises.readFile(fileName, utf8).

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d00acc2c0d68f3d — Filesystem access.
pkgs/npm/[email protected]/markdownlint-cli2.mjs:805 
                return fs.promises.writeFile(fileName, fixed, utf8);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

neostandard

npm dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #0f7a41f9b2f960f8 — Filesystem access.
pkgs/npm/[email protected]/cli.mjs:12 
const pkg = JSON.parse(await readFile(packagePath, { encoding: 'utf8' }))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11298fd564e26271 — Filesystem access.
pkgs/npm/[email protected]/cli.mjs:111 
    sourcePkg = JSON.parse(await readFile(join(process.cwd(), 'package.json'), 'utf8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9e3e72e5b8b7eca — Filesystem access.
pkgs/npm/[email protected]/lib/resolve-gitignore.js:45 
    const content = readFileSync(path.join(path.dirname(configFile), '.gitignore'), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pino

npm dependency
expand_more 6 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #ed20733fc6c37bcb — Environment-variable access.
pkgs/npm/[email protected]/benchmarks/basic.bench.js:17 
process.env.DEBUG = 'dlog'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #02c313b1cfbc910e — Filesystem access.
pkgs/npm/[email protected]/benchmarks/utils/wrap-log-level.js:6 
const code = readFileSync(
  join(__dirname, '..', '..', 'node_modules', 'loglevel', 'lib', 'loglevel.js')
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa24a26f74b2003d — Environment-variable access.
pkgs/npm/[email protected]/lib/transport-stream.js:22 
      } else if (process.env && process.env.TS_NODE_DEV) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2c893804feaf094 — Environment-variable access.
pkgs/npm/[email protected]/lib/transport.js:122 
  if (!workerOpts.env && process.env.NODE_OPTIONS) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32d6cd86f1454af7 — Environment-variable access.
pkgs/npm/[email protected]/lib/transport.js:123 
    const nodeOptions = sanitizeNodeOptions(process.env.NODE_OPTIONS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #382fff7ca959dc7f — Environment-variable access.
pkgs/npm/[email protected]/lib/transport.js:124 
    if (nodeOptions !== process.env.NODE_OPTIONS) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

proxyquire

npm dependency
expand_more 6 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #39c3e6c77106cf28 — Filesystem access.
pkgs/npm/[email protected]/examples/async/foo.js:1 
var fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #cba174fb6a508578 — Filesystem access.
pkgs/npm/[email protected]/examples/example-utils.js:1 
var fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a40895034325f999 — Filesystem access.
pkgs/npm/[email protected]/examples/example-utils.js:8 
    fs.readFileSync(module).toString()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a4fd6f7491f8d133 — Filesystem access.
pkgs/npm/[email protected]/examples/example-utils.js:15 
    fs.readFileSync(tests).toString()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #df7d2a01624c16fe — Filesystem access.
pkgs/npm/[email protected]/examples/sinon/foo-tests.js:12 
var fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9af653db4d11d984 — Filesystem access.
pkgs/npm/[email protected]/examples/sinon/foo.js:1 
var fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

semver

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #e0393d211a898a6d — Environment-variable access.
pkgs/npm/[email protected]/internal/debug.js:6 
  process.env.NODE_DEBUG &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #492c8bba36192d39 — Environment-variable access.
pkgs/npm/[email protected]/internal/debug.js:7 
  /\bsemver\b/i.test(process.env.NODE_DEBUG)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

split2

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #a88daaf98368e0d5 — Filesystem access.
pkgs/npm/[email protected]/bench.js:6 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

typescript

npm dependency
expand_more 10 low-confidence finding(s)
low env_fs dependency Excluded from app score #acdc5f917946ef81 — Filesystem access.
pkgs/npm/[email protected]/lib/_tsserver.js:51 
var import_fs = __toESM(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1ebf5c00011a4fa — Environment-variable access.
pkgs/npm/[email protected]/lib/_tsserver.js:309 
    const envLogOptions = parseLoggingEnvironmentString(process.env.TSS_LOG);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f9179b92243cc1e — Environment-variable access.
pkgs/npm/[email protected]/lib/_tsserver.js:535 
  const traceDir = commandLineTraceDir ? (0, typescript_exports.stripQuotes)(commandLineTraceDir) : process.env.TSS_TRACE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a49cfb0d4803834 — Environment-variable access.
pkgs/npm/[email protected]/lib/_tsserver.js:548 
        const basePath = process.env.LOCALAPPDATA || process.env.APPDATA || import_os.default.homedir && import_os.default.homedir() || process.env.USERPROFILE || process.env.HOMEDRIVE && process.env.HOMEPATH && (0, typescript_exports.normalizeSlashes)(process.env.HOMEDRIVE + process.env.HOMEPATH) || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ecbca52612dda736 — Environment-variable access.
pkgs/npm/[email protected]/lib/_tsserver.js:565 
    if (process.env.XDG_CACHE_HOME) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7b243c07eb6f866e — Environment-variable access.
pkgs/npm/[email protected]/lib/_tsserver.js:566 
      return process.env.XDG_CACHE_HOME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51a3594504ce3bdd — Environment-variable access.
pkgs/npm/[email protected]/lib/_tsserver.js:569 
    const homePath = import_os.default.homedir && import_os.default.homedir() || process.env.HOME || (process.env.LOGNAME || process.env.USER) && `/${usersDir}/${process.env.LOGNAME || process.env.USER}` || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a3883d8f3a8ff34 — Filesystem access.
pkgs/npm/[email protected]/lib/_typingsInstaller.js:44 
var fs = __toESM(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20781b4619b9c718 — Filesystem access.
pkgs/npm/[email protected]/lib/_typingsInstaller.js:88 
    const content = JSON.parse(host.readFile(typesRegistryFilePath));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #67860ad438e10647 — Filesystem access.
pkgs/npm/[email protected]/lib/watchGuard.js:42 
var fs = __toESM(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

undici

npm dependency
expand_more 12 low-confidence finding(s)
low env_fs dependency Excluded from app score #38e4016d6d800971 — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/client-h1.js:67 
  const llhttpWasmData = process.env.JEST_WORKER_ID ? require('../llhttp/llhttp-wasm.js') : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8181f5c374b1135 — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/client-h1.js:74 
  if (process.env.UNDICI_NO_WASM_SIMD === '1') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7777ceabc3240c0f — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/client-h1.js:76 
  } else if (process.env.UNDICI_NO_WASM_SIMD === '0') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f22d65e35d27998a — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/env-http-proxy-agent.js:26 
    const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2515b31641d12cfb — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/env-http-proxy-agent.js:33 
    const HTTPS_PROXY = httpsProxy ?? process.env.https_proxy ?? process.env.HTTPS_PROXY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83c50e66662a5e57 — Environment-variable access.
pkgs/npm/[email protected]/lib/dispatcher/env-http-proxy-agent.js:142 
    return process.env.no_proxy ?? process.env.NO_PROXY ?? ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4e6f025c01a6815 — Environment-variable access.
pkgs/npm/[email protected]/lib/mock/pending-interceptors-formatter.js:23 
        colors: !disableColors && !process.env.CI

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bf551efb182eeba — Filesystem access.
pkgs/npm/[email protected]/lib/mock/snapshot-recorder.js:424 
      const data = await readFile(resolve(path), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #30ee1e827badff39 — Filesystem access.
pkgs/npm/[email protected]/lib/mock/snapshot-recorder.js:470 
    await writeFile(resolvedPath, JSON.stringify(data, null, 2), { flush: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9974bba34cccce95 — Filesystem access.
pkgs/npm/[email protected]/scripts/strip-comments.js:7 
  ? transcode(readFileSync('./undici-fetch.js'), 'utf8', 'latin1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7535ae899b5918dc — Filesystem access.
pkgs/npm/[email protected]/scripts/strip-comments.js:8 
  : readFileSync('./undici-fetch.js')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7cab7815ee8318c8 — Filesystem access.
pkgs/npm/[email protected]/scripts/strip-comments.js:10 
writeFileSync('./undici-fetch.js', buffer.toString('latin1'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Development

  • @stylistic/eslint-plugin dev — dist-only: no readable source
  • @stylistic/eslint-plugin-js dev — dist-only: no readable source
  • concurrently dev — dist-only: no readable source
  • cross-env dev — dist-only: no readable source
  • fastify-tsconfig dev — no javascript source
  • tstyche dev — dist-only: no readable source