npm package report

Is chownr safe?

1 known vulnerability, worst severity LOW.

// reach

0 direct dependencies

none carry a known advisory

7 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss

2.5

low

CVSS v3.1 base score out of 10

epss

0.33%

low

chance of exploitation in 30 days, 27th percentile of all CVEs

xyz score

2.2

low

CyberXYZ composite out of 10

fig. 01 — GHSA-c6rq-rjc2-86v2, the advisory selected below

// 1 advisories

GHSA-c6rq-rjc2-86v2

LOWGitHub ratingCVE-2017-18869

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

// cvss v3.1 vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack vector: Local
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Checked 2026-11-06 at 21:15 UTC. The most recent advisory here was published 2022-02-10. Updated continuously from NVD, GHSA, OSV and CNA feeds.