npm package report

Is async safe?

1 known vulnerability, worst severity HIGH.

// reach

3 direct dependencies

3 carry known advisories, worst CRITICAL

528 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss

7.8

high

CVSS v3.1 base score out of 10

epss

3.3%

medium

chance of exploitation in 30 days, 89th percentile of all CVEs

xyz score

5.0

medium

CyberXYZ composite out of 10

fig. 01 — GHSA-fwr7-v2mv-hh25, the advisory selected below

// 1 advisories

GHSA-fwr7-v2mv-hh25

HIGHGitHub ratingCVE-2021-43138

A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the mapValues() method.

// cvss v3.1 vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Checked 2026-11-06 at 19:14 UTC. The most recent advisory here was published 2022-04-07. Updated continuously from NVD, GHSA, OSV and CNA feeds.