npm package report

Is notebook safe?

2 known vulnerabilities, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

1.1%

chance of exploitation in the next 30 days

xyz score

4.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-m87f-39q9-6f55, the advisory selected below

// advisories

GHSA-m87f-39q9-6f55

HIGHCVE-2022-24758

Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.

Affected: >=0, <6.4.10
Fixed in: 6.4.10
Published: 2022-04-05
Source: github

GHSA NVD MITRE

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 03:30 UTC. The most recent advisory here was published 2022-06-16. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is notebook safe? npm package security report | CyberXYZ