Vendor history
npm
Cumulative CVEs
5,708
across 135 monthly snapshots
Peak rank
#1
Mar 26
First seen
Jun 10
Latest seen
Jun 26
CVEs per month
Newest period on the right. Hover a point for detail · click to open that monthly report.
Jul 21Jun 26
Monthly history
Last 60 months · newest first.
| Period | Rank | Δ | CVEs | Critical | KEV | Nuclei | avg CVSS | Top products |
|---|---|---|---|---|---|---|---|---|
| Jun 26 | #193 | — | 1 | · | · | · | — | @agenticmail/mcp (1) |
| May 26 | #6 | ↓4 | 86 | · | · | · | — | openclaw (33) · flowise (15) · @hulumi/policies (4) |
| Apr 26 | #2 | — | 309 | · | · | · | — | openclaw (204) · flowise (24) · flowise-components (11) |
| Mar 26 | #1 | — | 562 | 29 | · | 5 | 7.2 | openclaw (370) · parse-server (32) · nocodb (10) |
| Feb 26 | #1 | — | 227 | 48 | · | 3 | 7.4 | openclaw (42) · n8n (24) · fuxa-server (12) |
| Jan 26 | #3 | — | 142 | 20 | · | 4 | 7.1 | pnpm (8) · hono (6) · renovate (6) |
| Dec 25 | #12 | — | 75 | 9 | 2 | 3 | 7.3 | n8n (5) · @vitejs/plugin-rsc (5) · react-server-dom-webpack (4) |
| Nov 25 | #12 | — | 57 | 8 | 1 | 2 | 7.1 | astro (6) · directus (4) · node-forge (3) |
| Oct 25 | #22 | — | 55 | 4 | · | 1 | 7.3 | flowise (11) · @strapi/core (3) · @anthropic-ai/claude-code (2) |
| Sep 25 | #12 | — | 100 | 12 | · | 5 | 7.5 | flowise (6) · @anthropic-ai/claude-code (4) · express-xss-sanitizer (2) |
| Aug 25 | #21 | — | 51 | 9 | · | 5 | 7.1 | @anthropic-ai/claude-code (3) · next (3) · flowise (3) |
| Jul 25 | #27 | — | 59 | 4 | 1 | 2 | 6.9 | @haxtheweb/haxcms-nodejs (6) · directus (4) · @finos/git-proxy (4) |
| Jun 25 | #33 | — | 34 | 7 | · | 1 | 6.4 | erxes (3) · webpack-dev-server (2) · @haxtheweb/haxcms-nodejs (2) |
| May 25 | #40 | — | 32 | 1 | · | 2 | 6.3 | @cloudflare/workers-oauth-provider (4) · passport-wsfed-saml2 (2) · mcp-markdownify-server (2) |
| Apr 25 | #25 | — | 47 | 2 | · | 2 | 6.3 | tarteaucitronjs (3) · react-router (2) · mathlive (2) |
| Mar 25 | #21 | — | 52 | 7 | 1 | 5 | 6.5 | directus (5) · open-webui (3) · flowise (3) |
| Feb 25 | #17 | — | 47 | 5 | · | 3 | 6.8 | mongosh (4) · better-auth (3) · @ckeditor/ckeditor5-real-time-collaboration (1) |
| Jan 25 | #39 | — | 23 | 1 | · | 1 | 5.9 | directus (2) · @lodestar/reqresp (2) · @fastify/multipart (1) |
| Dec 24 | #34 | — | 22 | 4 | · | 3 | 7.1 | directus (2) · astro (2) · cookie-encrypter (1) |
| Nov 24 | #51 | — | 22 | · | · | · | 6.8 | @sveltejs/kit (2) · vue-i18n (2) · petite-vue-i18n (2) |
| Oct 24 | #25 | — | 53 | 9 | · | 2 | 6.9 | @saltcorn/server (5) · dompurify (2) · @openc3/tool-common (2) |
| Sep 24 | #16 | ↑15 | 47 | 2 | · | · | 6.3 | lunary (4) · mattermost-desktop (3) · agnai (3) |
| Aug 24 | #31 | — | 32 | 4 | · | 3 | 6.9 | directus (3) · elliptic (3) · flowise (2) |
| Jul 24 | #24 | — | 47 | 7 | · | 1 | 7.1 | flowise (6) · bootstrap (3) · directus (2) |
| Jun 24 | #26 | — | 33 | 6 | · | 3 | 6.8 | @janhq/core (3) · lunary (3) · tinymce (2) |
| May 24 | #40 | — | 40 | 4 | · | 4 | 7.2 | nocodb (3) · directus (2) · libxmljs2 (2) |
| Apr 24 | #35 | — | 32 | 5 | · | 1 | 7.0 | mysql2 (4) · undici (2) · psitransfer (2) |
| Mar 24 | #25 | — | 43 | 7 | · | 2 | 6.8 | directus (4) · katex (4) · rsshub (2) |
| Feb 24 | #35 | — | 29 | 4 | · | 1 | 7.0 | stimulsoft-dashboards-js (3) · ckeditor4 (2) · undici (2) |
| Jan 24 | #36 | — | 33 | 6 | · | 1 | 7.1 | tinymce (6) · meshcentral (2) · @evershop/evershop (2) |
| Dec 23 | #22 | — | 37 | 3 | · | 1 | 6.5 | @evershop/evershop (7) · uptime-kuma (2) · nuxt-api-party (2) |
| Nov 23 | #35 | — | 23 | 2 | · | · | 6.5 | ckeditor4 (2) · openmct (2) · bootbox (1) |
| Oct 23 | #38 | — | 27 | 5 | · | 1 | 7.4 | @vrite/sdk (3) · tinymce (2) · browserify-sign (1) |
| Sep 23 | #38 | — | 29 | 3 | 2 | 7 | 7.1 | electron (5) · fuxa-server (3) · @frangoteam/fuxa (2) |
| Aug 23 | #28 | — | 36 | 4 | · | 1 | 6.5 | @excalidraw/excalidraw (2) · matrix-appservice-irc (2) · find-exec (1) |
| Jul 23 | #40 | — | 28 | 6 | · | 2 | 7.2 | @fastify/oauth2 (2) · uptime-kuma (2) · nodebb (2) |
| Jun 23 | #33 | — | 30 | 3 | · | 2 | 6.6 | @openzeppelin/contracts (2) · @openzeppelin/contracts-upgradeable (2) · joplin (2) |
| May 23 | #32 | — | 27 | 4 | · | 2 | 7.3 | n8n (3) · vm2 (2) · ghost (2) |
| Apr 23 | #27 | — | 37 | 9 | · | 2 | 7.0 | vm2 (3) · @strapi/plugin-users-permissions (3) · @openzeppelin/contracts-upgradeable (2) |
| Mar 23 | #23 | — | 36 | 5 | · | 1 | 7.1 | directus (4) · vega (3) · angular (3) |
| Feb 23 | #17 | — | 45 | 4 | · | 2 | 6.8 | sequelize (5) · @sequelize/core (5) · undici (2) |
| Jan 23 | #19 | — | 47 | 2 | · | 2 | 6.3 | papaparse (2) · serve-lite (2) · @builder.io/qwik (1) |
| Dec 22 | #25 | — | 48 | 7 | · | 2 | 6.7 | jsonwebtoken (4) · nadesiko3 (3) · oils (1) |
| Nov 22 | #23 | — | 35 | 4 | 1 | 2 | 6.6 | hummus (4) · muhammara (4) · sweetalert2 (4) |
| Oct 22 | #38 | — | 33 | 13 | · | 4 | 8.1 | browserify-shim (3) · feathers-sequelize (3) · loader-utils (3) |
| Sep 22 | #23 | — | 43 | 10 | · | · | 7.4 | steal (8) · matrix-js-sdk (4) · parse-server (3) |
| Aug 22 | #18 | — | 53 | 14 | · | · | 7.1 | @openzeppelin/contracts (4) · @openzeppelin/contracts-upgradeable (4) · raneto (3) |
| Jul 22 | #22 | — | 49 | 9 | · | 1 | 7.2 | undici (3) · llhttp (2) · @openzeppelin/contracts (2) |
| Jun 22 | #16 | — | 55 | 8 | · | 4 | 7.1 | parse-url (4) · nocodb (4) · parse-server (3) |
| May 22 | #20 | — | 44 | 5 | · | 1 | 7.3 | strapi (3) · @strapi/strapi (3) · convict (2) |
| Apr 22 | #29 | — | 29 | 9 | · | 5 | 7.7 | urijs (2) · ghost (2) · fullpage.js (2) |
| Mar 22 | #23 | — | 48 | 8 | · | 4 | 7.0 | node-forge (3) · node-ipc (3) · vditor (2) |
| Feb 22 | #31 | — | 30 | 7 | · | 2 | 7.5 | url-parse (4) · karma (2) · fastify-multipart (1) |
| Jan 22 | #29 | — | 41 | 5 | · | 2 | 7.2 | node-forge (4) · marked (2) · shelljs (2) |
| Dec 21 | #29 | — | 26 | 5 | · | · | 7.1 | jsx-slack (2) · @backstage/plugin-scaffolder-backend (1) · comb (1) |
| Nov 21 | #16 | — | 44 | 7 | · | 1 | 7.0 | aws-iot-device-sdk-v2 (4) · nodebb (3) · apostrophe (2) |
| Oct 21 | #36 | — | 24 | 8 | · | 2 | 8.0 | aaptjs (6) · jquery-ui (3) · kindeditor (2) |
| Sep 21 | #18 | — | 47 | 6 | · | 1 | 7.2 | ghost (3) · parse-server (3) · immer (2) |
| Aug 21 | #23 | — | 42 | 4 | · | · | 7.4 | tar (5) · node-tar (5) · ckeditor4 (3) |
| Jul 21 | #26 | — | 24 | 4 | · | 1 | 6.7 | xlsx (3) · curly-bracket-parser (1) · deepmergefn (1) |