npm package report

Is github.com/proglottis/gpgme safe?

2 known vulnerabilities.

cvss

not scored

how bad it is if exploited, out of 10

epss

5.1%

chance of exploitation in the next 30 days

xyz score

3.6

CyberXYZ composite, out of 10

fig. 01 — GHSA-m6wg-2mwg-4rfq, the advisory selected below

// advisories

GHSA-m6wg-2mwg-4rfq

UNKNOWNCVE-2020-8945

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

Affected: >=0, <0.1.1
Fixed in: 0.1.1
Published: 2021-05-18
Source: github

GHSA NVD MITRE

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 00:40 UTC. The most recent advisory here was published 2021-05-18. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is github.com/proglottis/gpgme safe? npm package security report | CyberXYZ