npm package report

Is kill-port safe?

1 known vulnerability, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

1.9%

chance of exploitation in the next 30 days

xyz score

3.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-pmv6-gf98-p3r5, the advisory selected below

// advisories

GHSA-pmv6-gf98-p3r5

HIGHCVE-2019-5414

Versions of kill-port prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the kill function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function.

Affected: < 1.3.2
Fixed in: 1.3.2
Weakness: CWE-77
Published: 2019-03-25
Source: github

GHSA NVD MITRE reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:44 UTC. The most recent advisory here was published 2019-03-25. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is kill-port safe? npm package security report | CyberXYZ