npm package report

Is cli safe?

1 known vulnerability, worst severity LOW.

// reach

0 direct dependencies

none carry a known advisory

    6 packages depend on it

    an advisory here reaches each of them

    Create a free accountfor every dependency path, dependent and what to upgrade
    // ai model usage

    Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

    cvss
    2.5
    low

    severity band, no base score published

    epss
    0.98%
    medium

    chance of exploitation in 30 days, 62nd percentile of all CVEs

    xyz score
    1.8
    low

    CyberXYZ composite out of 10

    fig. 01 — GHSA-6cpc-mj5c-m9rq, the advisory selected below

    // 1 advisories

    GHSA-6cpc-mj5c-m9rq

    LOWGitHub ratingCVE-2016-10538

    Affected versions of cli use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the cli process has permission to write to.

    // proof of concept

    By creating Symbolic Links at the following locations, the target of the link can be written to.

    lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';
    // recommendation

    Update to version 1.0.0 or later.

    Checked 2026-11-06 at 21:39 UTC. The most recent advisory here was published 2019-02-18. Updated continuously from NVD, GHSA, OSV and CNA feeds.

    Think a verdict here is wrong? Tell us — we respond within 2 business days.