npm package report

Is github.com/notaryproject/notation safe?

2 known vulnerabilities, worst severity MEDIUM.

cvss

4.0

how bad it is if exploited, out of 10

epss

0.30%

chance of exploitation in the next 30 days

xyz score

not scored

CyberXYZ composite, out of 10

fig. 01 — GHSA-57wx-m636-g3g8, the advisory selected below

// advisories

GHSA-57wx-m636-g3g8

MEDIUMCVE-2024-23332

An external actor with control of a compromised container registry can provide outdated versions of OCI artifacts, such as Images. This could lead artifact consumers with relaxed trust policies (such as permissive instead of strict) to potentially use artifacts with signatures that are no longer valid, making them susceptible to any exploits those artifacts may contain.

Affected: >=0
Fixed in: not stated
Published: 2024-01-19
Source: github

GHSA NVD MITRE

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:32 UTC. The most recent advisory here was published 2024-01-19. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is github.com/notaryproject/notation safe? npm package security report | CyberXYZ