arjunkmrm

Data comes from public registry entries and manifests of packages that were actually published. Each row opens a standalone evidence page.

Repository source is outside this index’s scan scope. Run the CLI locally for source scanning.

A finding is a matched shape, not a conclusion. It does not prove exploitability. Unmeasured work is listed on each server page and is never treated as clean.