Close Open Privacy Scan

link https://github.com/expressjs/express
bolt Snapshot: commit ba00676
science engine v2
schedule 2026-07-06T21:07:14.108562+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

97 /100
Low privacy risk

Low risk · 102 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 102 low
First-party packages: 1
Dependency packages: 11
Ecosystem: npm

swap_horiz Application data flows

No high- or medium-confidence application data-flow findings in this scan.

</> First-Party Code

first-party (npm)

npm first-party
expand_more 5 low-confidence finding(s)
low env_fs production #0a6bd53c65270aca — Environment-variable access.
repo/examples/cookies/index.js:13 
if (process.env.NODE_ENV !== 'test') app.use(logger(':method :url'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ff1c4d69a0d6f6a — Environment-variable access.
repo/examples/error-pages/index.js:11 
var silent = process.env.NODE_ENV === 'test'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e120591a9325457 — Filesystem access.
repo/examples/markdown/index.js:18 
  fs.readFile(path, 'utf8', function(err, str){
    if (err) return fn(err);
    var html = marked.parse(str).replace(/\{([^}]+)\}/g, function(_, name){
      return escapeHtml(options[name] || '');
    });
    fn(null, html);
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f45d0934bac96f7f — Environment-variable access.
repo/examples/route-map/index.js:10 
var verbose = process.env.NODE_ENV !== 'test'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #118fa1d9568cd2a6 — Environment-variable access.
repo/lib/application.js:91 
  var env = process.env.NODE_ENV || 'development';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

debug

npm dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #82bef63f9c8b4541 — Environment-variable access.
pkgs/npm/[email protected]/src/browser.js:230 
		r = process.env.DEBUG;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7bf0a725e219084a — Environment-variable access.
pkgs/npm/[email protected]/src/node.js:136 
	let val = process.env[key];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b51c007c041927f6 — Environment-variable access.
pkgs/npm/[email protected]/src/node.js:205 
		process.env.DEBUG = namespaces;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #226fe02c3795be0f — Environment-variable access.
pkgs/npm/[email protected]/src/node.js:209 
		delete process.env.DEBUG;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7993e06ec6ac3404 — Environment-variable access.
pkgs/npm/[email protected]/src/node.js:221 
	return process.env.DEBUG;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

depd

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #f86ad4008bff3cd9 — Environment-variable access.
pkgs/npm/[email protected]/index.js:159 
  var str = process.env.NO_DEPRECATION || ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60dc1a3c07751631 — Environment-variable access.
pkgs/npm/[email protected]/index.js:175 
  var str = process.env.TRACE_DEPRECATION || ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ejs

npm dependency
expand_more 20 low-confidence finding(s)
low env_fs dependency Excluded from app score #9eda03b2055cf79a — Filesystem access.
pkgs/npm/[email protected]/bin/cli.js:26 
let fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #121413a14745d480 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.js:28 
let usage = fs.readFileSync(`${__dirname}/../usage.txt`).toString();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c204aaaf2e131220 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.js:193 
    input = fs.readFileSync(pOpts.dataFile).toString();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a51112ef30c181a3 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.js:206 
  let template = fs.readFileSync(opts.filename).toString();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #553fd93d12157853 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.js:209 
    fs.writeFileSync(pOpts.outputFile, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39aa1b274d3f1cca — Filesystem access.
pkgs/npm/[email protected]/ejs.js:24 
var fs_1 = __importDefault(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da6cb0574c2b7c1e — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:1 
let fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a870f1cb90848921 — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:34 
  let source = fs.readFileSync('lib/cjs/ejs.js', 'utf8').toString();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59b5f5aa1a501d3b — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:51 
  fs.writeFileSync('lib/cjs/ejs.js', source);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7222a401fd138f09 — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:52 
  let utilsSource = fs.readFileSync('lib/cjs/utils.js', 'utf8').toString();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fb88f6fe72baaa1 — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:55 
  fs.writeFileSync('lib/cjs/utils.js', utilsSource);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d87e407fc09db158 — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:56 
  let parseargsSource = fs.readFileSync('lib/cjs/parseargs.js', 'utf8').toString();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2453b132a4dc027 — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:59 
  fs.writeFileSync('lib/cjs/parseargs.js', parseargsSource);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #219718b98a849c8b — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:60 
  fs.writeFileSync('lib/cjs/package.json', '{"type":"commonjs"}');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f594f957b8481368 — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:113 
  fs.writeFileSync('out/CNAME', 'api.ejs.co');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f9d0ea661c18362 — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:144 
      fs.writeFileSync(path.join(fixtureDir, 'package.json'), JSON.stringify({
        private: true,
        type: 'module'
      }, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75969af6eb8d786c — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:152 
      fs.writeFileSync(path.join(fixtureDir, 'cjs-smoke.cjs'), [
        'const assert = require("assert");',
        'const ejs = require("ejs");',
        'assert.equal(typeof ejs.render, "function");',
        'assert.equal(ejs.render("<%= name %>", {name: "<>&"}), "&lt;&gt;&amp;");',
        ''
      ].join('\n'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93bbaf22eb3ec16c — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:162 
      fs.writeFileSync(path.join(fixtureDir, 'esm-smoke.mjs'), [
        'import assert from "node:assert/strict";',
        'import ejs from "ejs";',
        'assert.equal(typeof ejs.render, "function");',
        'assert.equal(ejs.render("<%= name %>", {name: "<>&"}), "&lt;&gt;&amp;");',
        ''
      ].join('\n'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #de1e4b2c730b56f6 — Filesystem access.
pkgs/npm/[email protected]/jakefile.js:172 
      fs.writeFileSync(path.join(fixtureDir, 'template.ejs'), 'Hello <%= name %>');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #977409a53199717b — Filesystem access.
pkgs/npm/[email protected]/lib/cjs/ejs.js:23 
var fs_1 = __importDefault(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

eslint

npm dependency
expand_more 18 low-confidence finding(s)
low env_fs dependency Excluded from app score #274aca44d6b2d3cd — Filesystem access.
pkgs/npm/[email protected]/lib/cli-engine/cli-engine.js:18 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35b27175e840a8c0 — Filesystem access.
pkgs/npm/[email protected]/lib/cli-engine/cli-engine.js:725 
            fs.writeFileSync(result.filePath, result.output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54d76a78da85e47d — Filesystem access.
pkgs/npm/[email protected]/lib/cli-engine/cli-engine.js:835 
                text: fs.readFileSync(filePath, "utf8"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b665057fb704d9bf — Filesystem access.
pkgs/npm/[email protected]/lib/cli-engine/file-enumerator.js:37 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0240a58b164f20de — Filesystem access.
pkgs/npm/[email protected]/lib/cli-engine/lint-result-cache.js:12 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a1e9963c5d6c262 — Filesystem access.
pkgs/npm/[email protected]/lib/cli-engine/lint-result-cache.js:137 
            fileDescriptor.meta.results.source = fs.readFileSync(filePath, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f03f9242ab90275 — Filesystem access.
pkgs/npm/[email protected]/lib/cli-engine/load-rules.js:12 
const fs = require("fs"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae37b12d3dfd2dcb — Filesystem access.
pkgs/npm/[email protected]/lib/cli.js:18 
const fs = require("fs"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a56c65ca9a7a8de7 — Filesystem access.
pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:13 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e4dfb103868f917 — Filesystem access.
pkgs/npm/[email protected]/lib/eslint/eslint.js:14 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8df6f2bcecea9ac — Filesystem access.
pkgs/npm/[email protected]/lib/eslint/flat-eslint.js:13 
const fs = require("fs").promises;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6ab5e8aa0b06089c — Filesystem access.
pkgs/npm/[email protected]/lib/eslint/flat-eslint.js:630 
                .map(r => fs.writeFile(r.filePath, r.output))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #62c9a05fa27ea352 — Filesystem access.
pkgs/npm/[email protected]/lib/eslint/flat-eslint.js:844 
                return fs.readFile(filePath, "utf8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7c34d21fceacbbd — Environment-variable access.
pkgs/npm/[email protected]/lib/eslint/flat-eslint.js:1118 
    switch (process.env.ESLINT_USE_FLAT_CONFIG) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88dcc75bd87eb84b — Environment-variable access.
pkgs/npm/[email protected]/lib/linter/timing.js:42 
const enabled = !!process.env.TIMING;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29dfc40e6d184bca — Environment-variable access.
pkgs/npm/[email protected]/lib/linter/timing.js:54 
    if (typeof process.env.TIMING !== "string") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5135c1db7e14a30 — Environment-variable access.
pkgs/npm/[email protected]/lib/linter/timing.js:58 
    if (process.env.TIMING.toLowerCase() === "all") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0db8d0b07459970 — Environment-variable access.
pkgs/npm/[email protected]/lib/linter/timing.js:62 
    const TIMING_ENV_VAR_AS_INTEGER = Number.parseInt(process.env.TIMING, 10);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

etag

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #f257c28852434d60 — Filesystem access.
pkgs/npm/[email protected]/index.js:22 
var Stats = require('fs').Stats

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

express-session

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #49766cfd6b693a3d — Environment-variable access.
pkgs/npm/[email protected]/index.js:33 
var env = process.env.NODE_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

finalhandler

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #40f0b20c980a2566 — Environment-variable access.
pkgs/npm/[email protected]/index.js:73 
  var env = opts.env || process.env.NODE_ENV || 'development'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

hbs

npm dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #8444407202bb97c3 — Filesystem access.
pkgs/npm/[email protected]/lib/hbs.js:1 
var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1677cbb7f873bacb — Filesystem access.
pkgs/npm/[email protected]/lib/hbs.js:82 
    fs.readFile(filename, 'utf8', function(err, str){
      if (err) {
        return cb(err);
      }

      var template = handlebars.compile(str);
      if (locals.cache) {
        cache[filename] = template;
      }

      try {
        var res = template(locals, handlebarsOpts);
        self.async.done(function(values) {
          Object.keys(values).forEach(function(id) {
            res = res.replace(id, values[id]);
          });

          cb(null, res);
        });
      } catch (err) {
        cb(prependFilenameToError(filename, err))
      }
    });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08b77e2295beae7b — Filesystem access.
pkgs/npm/[email protected]/lib/hbs.js:189 
    fs.readFile(template, 'utf8', function(err, str) {
      if (err) {
        if (layout && templates.length === 0) {
          // Only return error if user explicitly asked for layout.
          return cb(err);
        }

        if (templates.length > 0) {
          return tryReadFileAndCache(templates);
        }

        return render_file(options, cb);
      }

      cacheAndCompile(template, str);
    });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dff83535ded51db6 — Filesystem access.
pkgs/npm/[email protected]/lib/hbs.js:269 
    fs.readFile(filepath, 'utf8', function(err, data) {
      if (!err) {
        var extname = path.extname(filepath)
        var name = path.relative(directory, filepath)
          .slice(0, -(extname.length))
          .replace(/\\/g, '/')

        handlebars.registerPartial(rename(name).replace(/ /g, '_'), data)
      }

      done(err);
    });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mocha

npm dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #f6ff8517008f06ad — Filesystem access.
pkgs/npm/[email protected]/lib/cli/config.js:39 
    require("js-yaml").load(fs.readFileSync(filepath, "utf8")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee9f764bd689b294 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/config.js:55 
      require("strip-json-comments")(fs.readFileSync(filepath, "utf8")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43b980cd6b0f6c9f — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:27 
  const css = fs.readFileSync(path.join(srcdir, "mocha.css"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc48bdb6c4d9f8e0 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:28 
  const js = fs.readFileSync(path.join(srcdir, "mocha.js"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c6b97302d201da7 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:29 
  const tmpl = fs.readFileSync(
    path.join(srcdir, "lib", "browser", "template.html"),
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1ad2a4ee1ee7a86 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:32 
  fs.writeFileSync(path.join(destdir, "mocha.css"), css);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2cf40845eef5a8c — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:33 
  fs.writeFileSync(path.join(destdir, "mocha.js"), js);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8153f98c484ae430 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:34 
  fs.writeFileSync(path.join(destdir, "tests.spec.js"), "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9df3d4a29be675e8 — Filesystem access.
pkgs/npm/[email protected]/lib/cli/init.js:35 
  fs.writeFileSync(path.join(destdir, "index.html"), tmpl);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6abcc4cbc63730ab — Filesystem access.
pkgs/npm/[email protected]/lib/cli/options.js:240 
      configData = fs.readFileSync(filepath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c4c85d7c4339134 — Environment-variable access.
pkgs/npm/[email protected]/lib/cli/options.js:302 
  const envConfig = parse(process.env.MOCHA_OPTIONS || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b3279d6bc48eb14 — Environment-variable access.
pkgs/npm/[email protected]/lib/reporters/base.js:58 
  (supportsColor.stdout || process.env.MOCHA_COLORS !== undefined);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7961b359eca3ca4 — Filesystem access.
pkgs/npm/[email protected]/lib/reporters/json.js:90 
        fs.writeFileSync(output, json);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #816e0f5e04156a92 — Environment-variable access.
pkgs/npm/[email protected]/mocha.js:13123 
  		r = process.env.DEBUG;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4174cccb76ce6d27 — Environment-variable access.
pkgs/npm/[email protected]/mocha.js:16339 
    (supportsColor.stdout || process.env.MOCHA_COLORS !== undefined);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8884c72c4b34b91d — Filesystem access.
pkgs/npm/[email protected]/mocha.js:17472 
          fs.writeFileSync(output, json);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

nyc

npm dependency
expand_more 28 low-confidence finding(s)
low env_fs dependency Excluded from app score #dcf392c2a5b5e1bb — Filesystem access.
pkgs/npm/[email protected]/bin/nyc.js:10 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b13d0f4e442612e8 — Environment-variable access.
pkgs/npm/[email protected]/bin/nyc.js:53 
    env.BABEL_DISABLE_CACHE = process.env.BABEL_DISABLE_CACHE = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51769b995c81aaa8 — Environment-variable access.
pkgs/npm/[email protected]/bin/nyc.js:81 
    env.SPAWN_WRAP_SHIM_ROOT = process.env.SPAWN_WRAP_SHIM_ROOT || process.env.XDG_CACHE_HOME || require('os').homedir()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #20c410a715159359 — Filesystem access.
pkgs/npm/[email protected]/index.js:190 
        const source = await fs.readFile(filename, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #932d1be5c4f54c4e — Filesystem access.
pkgs/npm/[email protected]/index.js:218 
      const inCode = await fs.readFile(inFile, 'utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ec61e216f7ff86d — Filesystem access.
pkgs/npm/[email protected]/index.js:226 
        await fs.writeFile(outFile, outCode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #091909c39bf7c307 — Environment-variable access.
pkgs/npm/[email protected]/index.js:353 
    if (!process.env.NYC_CWD) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #223102f9efa2a451 — Environment-variable access.
pkgs/npm/[email protected]/index.js:375 
    process.env.NYC_PROCESS_ID = this.processInfo.uuid

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef3514939c018aa3 — Filesystem access.
pkgs/npm/[email protected]/index.js:409 
    fs.writeFileSync(
      coverageFilename,
      JSON.stringify(coverage),
      'utf-8'
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2506843c2839df57 — Filesystem access.
pkgs/npm/[email protected]/index.js:514 
      const report = JSON.parse(await fs.readFile(path.resolve(baseDirectory, filename)), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d97613da791661df — Environment-variable access.
pkgs/npm/[email protected]/lib/commands/check-coverage.js:19 
  process.env.NYC_CWD = process.cwd()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a04eb0ac607f17f — Environment-variable access.
pkgs/npm/[email protected]/lib/commands/merge.js:33 
  process.env.NYC_CWD = process.cwd()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4adeea9abec1d760 — Filesystem access.
pkgs/npm/[email protected]/lib/commands/merge.js:44 
  await fs.writeFile(argv.outputFile, JSON.stringify(map), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d63a4b1089191f2 — Environment-variable access.
pkgs/npm/[email protected]/lib/commands/report.js:19 
  process.env.NYC_CWD = process.cwd()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d61156c67f776103 — Environment-variable access.
pkgs/npm/[email protected]/lib/config-util.js:12 
  cwd = cwd || process.env.NYC_CWD || process.cwd()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16557a665b747de4 — Filesystem access.
pkgs/npm/[email protected]/lib/fs-promises.js:3 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0c33e37f61bca97 — Environment-variable access.
pkgs/npm/[email protected]/lib/register-env.js:21 
    envToCopy[env] = process.env[env]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99e787f4ef178847 — Environment-variable access.
pkgs/npm/[email protected]/lib/register-env.js:26 
  envToCopy[envName] = process.env[envName]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b4b4474bdfd77c9 — Filesystem access.
pkgs/npm/[email protected]/lib/source-maps.js:43 
      fs.writeFileSync(mapPath, JSON.stringify(sourceMap))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ddc057f86653560 — Filesystem access.
pkgs/npm/[email protected]/lib/source-maps.js:68 
            this.loadedMaps[hash] = JSON.parse(await fs.readFile(mapPath, 'utf8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fed931a1ef2e903 — Environment-variable access.
pkgs/npm/[email protected]/lib/wrap.js:6 
  process.env.NYC_CONFIG ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43fb531361108535 — Environment-variable access.
pkgs/npm/[email protected]/lib/wrap.js:15 
  parent: process.env.NYC_PROCESS_ID || null

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9b1b1a7d25773be — Environment-variable access.
pkgs/npm/[email protected]/lib/wrap.js:18 
if (process.env.NYC_PROCESSINFO_EXTERNAL_ID) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c071b5be2be3df5 — Environment-variable access.
pkgs/npm/[email protected]/lib/wrap.js:19 
  config._processInfo.externalId = process.env.NYC_PROCESSINFO_EXTERNAL_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #975b0f110b6c511e — Environment-variable access.
pkgs/npm/[email protected]/lib/wrap.js:20 
  delete process.env.NYC_PROCESSINFO_EXTERNAL_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #827fe941c0ebcd9c — Environment-variable access.
pkgs/npm/[email protected]/lib/wrap.js:23 
if (process.env.NYC_CONFIG_OVERRIDE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2ddeb66b8364c001 — Environment-variable access.
pkgs/npm/[email protected]/lib/wrap.js:24 
  Object.assign(config, JSON.parse(process.env.NYC_CONFIG_OVERRIDE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #884b71d814a22a4a — Environment-variable access.
pkgs/npm/[email protected]/lib/wrap.js:25 
  process.env.NYC_CONFIG = JSON.stringify(config)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

send

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #5cbc1c7a4653e302 — Filesystem access.
pkgs/npm/[email protected]/index.js:21 
var fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • content-disposition prod — dist-only: no readable source
  • content-type prod — dist-only: no readable source
  • cookie prod — dist-only: no readable source