OSS Security KBlive

OSS Security Knowledge Base

Tracking whether popular open-source packages have been security audited. Not just “what went wrong” — but “has anyone looked?”

15packages tracked

4audited

11unaudited

dotnet1 packages

Package	Status	Downloads	Findings	Updated
Newtonsoft.Json	advisory-mapped	unknown (as of 2026-04-11)	1 publicly disclosed package vulnerability curated from OSV, GHSA, CVE, and upstream issue / fix history	2026-04-11

homebrew1 packages

Package	Status	Downloads	Findings	Updated
openssl@3	baseline stub	~112,175 installs/week equivalent from 30-day analytics (as of 2026-04-11)	none on record	2026-04-11

kubernetes1 packages

Package	Status	Downloads	Findings	Updated
kube-apiserver	audit-ingested	unknown (as of 2026-04-10)	9 findings (4 medium, 5 low)	2026-04-10

linux1 packages

Package	Status	Downloads	Findings	Updated
openssl	baseline stub	unknown (as of 2026-04-11)	none on record	2026-04-11

npm9 packages

Package	Status	Downloads	Findings	Updated
axios	advisory-mapped	unknown (as of 2026-04-08)	none on record	2026-04-08
express	audit-ingested	~84,000,000 (as of 2026-04-10)	14 findings (2 high, 4 medium-high, 2 medium, 6 confirmed safe)	2026-04-10
js-yaml	audit-ingested	~130,000,000 (as of 2026-04-12)	6 findings (1 high, 3 medium, 2 low)	2026-04-12
jsonwebtoken	advisory-mapped	~14,000,000 (as of 2026-04-07)	4 public advisory records reviewed, including 3 package vulnerabilities fixed in 9.0.0 and 1 later-retracted claim that should not be treated as a valid library CVE	2026-04-11
koa-router	baseline stub	~652,000 (as of 2026-04-08)	none on record	2026-04-08
lodash	audit-ingested	~25,000,000 (as of 2026-04-12)	3 new findings + all CVE patches verified	2026-04-12
minimist	advisory-mapped	unknown (as of 2026-04-07)	none on record	2026-04-07
path-to-regexp	unknown	~80,000,000 (as of 2026-04-07)	2 bugs found (2 filed)	2026-04-07
semver	advisory-mapped	unknown (as of 2026-04-07)	none on record	2026-04-07

python1 packages

Package	Status	Downloads	Findings	Updated
requests	advisory-mapped	~311,677,866 (as of 2026-04-09)	4 publicly disclosed package vulnerabilities curated from OSV, GHSA, CVE, and upstream release notes	2026-04-11

rust1 packages

Package	Status	Downloads	Findings	Updated
serde	baseline stub	~149,770,495 recent downloads (as of 2026-04-09)	none on record	2026-04-09