npm package report

Is darkreader safe?

1 known vulnerability, worst severity LOW.

cvss

3.4

how bad it is if exploited, out of 10

epss

0.10%

chance of exploitation in the next 30 days

xyz score

1.1

CyberXYZ composite, out of 10

fig. 01 — GHSA-x369-mcw8-8rvj, the advisory selected below

// advisories

GHSA-x369-mcw8-8rvj

LOWCVE-2025-68467

Dark Reader versions prior to 4.9.117 included a behavior where a website could request a style sheet from a locally running web server, for example http://localhost:8080/style.css, If an address was available and returned a text/css content type.

Affected: < 4.9.117
Fixed in: 4.9.117
Weakness: CWE-200
Published: 2026-03-04
Source: github

GHSA NVD MITRE reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:38 UTC. The most recent advisory here was published 2026-03-04. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is darkreader safe? npm package security report | CyberXYZ