Problemsby Glyphnpm vulnerabilities are hard to triage and patch
4 posts from 4 people4d activeRising, +2 this week
Posts per day
The posts behind it
bug(core): detectPowerShellSubstitution false positives on quoted commands containing parentheses
### What happened? On Windows, legitimate PowerShell commands that contain parentheses inside quoted strings get flagged as command injection attempts by `detectPowerShellSubstitution` (`packages/core/src/utils/shell-utils.ts`). The quote tracking desyncs whenever quotes appear...
Bundled chrome-devtools-mcp 0.19.0 (browser agent) ships fast-uri 3.1.0, ip-address 10.1.0 and ws 8.19.0, invisible to npm audit
### What happened? While scanning published npm packages for bundled third-party code we found that `@google/gemini-cli@0.66.0` (`bundle/bundled/chrome-devtools-mcp.mjs`) and `@google/gemini-cli-core@0.66.0` (`dist/bundled/chrome-devtools-mcp.mjs`, plus...
Two widely used npm packages had their security advisories withdrawn. How should we handle false positives in dependency audits?
Both the braces and sprintf-js security advisories have been withdrawn, despite previously being marked as GitHub Reviewed.. braces: CVE-2026-93687 / GHSA-vfj7-8cjw-p6xm . sprintf-js: CVE-2026-97058 / GHSA-hp3w-g68c-fv3c . I understand that third-party security risks are a...
How do I actually scan for CVEs for Javascript?
Hello friends.. I am implementing CI security scanning with Syft generating the SBOMs and uploading them to Dependency Track. . Two disclaimers:. 1- I hate frontend work and have a poor understanding of it. 2- I am not a cybersecurity guy. This is just a new avenue I am...
Companies and products named
About this problem
Evidence
4 posts from 4 people in 2 places, about 1 a week over 20 days. Mostly on r/devops, google-gemini/gemini-cli. Tools named alongside: Gemini, GitHub, Model Context Protocol.
Frustration Frustration 2 of 3· Seen on Reddit, GitHub issues
How it was grouped
Posts that state a pain and match the "vuln-noise" rule about npm. First post Oct 18, 2026, latest Nov 6, 2026. Corroborated: 3 or more posts from 2 or more people or places. Method
The same problem elsewhere
Vulnerability scanners flood teams with noise
273 posts from 273 people on Glyph Ibis, GitHub issues, Reddit.
NVIDIA vulnerabilities are hard to triage and patch
77 posts from 77 people on Glyph Ibis.
AWS vulnerabilities are hard to triage and patch
65 posts from 65 people on Glyph Ibis.
IBM vulnerabilities are hard to triage and patch
35 posts from 35 people on Glyph Ibis.
GitHub vulnerabilities are hard to triage and patch
12 posts from 11 people on GitHub issues, Glyph Ibis, Hacker News.
JetBrains vulnerabilities are hard to triage and patch
12 posts from 12 people on Glyph Ibis.
vLLM vulnerabilities are hard to triage and patch
9 posts from 9 people on Glyph Ibis.
Red Hat vulnerabilities are hard to triage and patch
8 posts from 8 people on Glyph Ibis.
Model Context Protocol vulnerabilities are hard to triage and patch
6 posts from 6 people on Glyph Ibis, GitHub issues.
Apache Software Foundation vulnerabilities are hard to triage and patch
6 posts from 6 people on Glyph Ibis.
Claude Code vulnerabilities are hard to triage and patch
5 posts from 5 people on GitHub issues.
ServiceNow vulnerabilities are hard to triage and patch
5 posts from 5 people on Glyph Ibis.
Other npm problems
npm users keep filing bugs
Top post: "Unrecognized node type for community packages with a dot in the npm scope", one of 8 posts from 7 people on GitHub issues, Reddit.
npm upgrades break working setups
4 posts from 3 people on GitHub issues, Reddit.
npm outages and slowdowns disrupt work
3 posts from 3 people on Glyph Ibis, GitHub issues.
npm dependency conflicts break installs
3 posts from 3 people on GitHub issues.
npm deprecations force unplanned migrations
2 posts from 2 people on GitHub issues. Unverified.
npm lock-in makes switching costly
2 posts from 1 person on GitHub issues. Unverified.
History