Security News
RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.
By Sarah Gooding - Jun 05, 2026
Big News: Socket raises $60M Series C at a $1B valuation to secure software supply chains for AI-driven development.Announcement →
@cyberhub/trust-nitropack
Advanced tools
@cyberhub/trust-nitropack
Security Trust Report for nitropack — 67/100 (B, standard). Maintainer risk and vulnerability analysis from 8 security databases.
Security Trust Report: nitropack
Score: 67/100 | Grade: B | Tier: STANDARD
This package has notable risk factors. Review flags below.
Score Breakdown
| Category | Score |
|---|---|
| Maintainer Trust | 72/100 |
| Package Health | 85/100 |
| Supply Chain | 56/100 |
| Community | 43/100 |
Vulnerabilities
No known vulnerabilities.
Flags
- HIGH: Maintainer(s) removed in v2.9.7: pi0
- HIGH: Burst publishing detected — 5+ versions in a single day
- HIGH: 70 direct dependencies — large attack surface
- HIGH: Depends on historically compromised package: semver
- HIGH: 1 direct dependencies have known security issues
- HIGH: Depends on "semver" which has ReDoS CVE-2022-25883
- MEDIUM: New maintainer(s) added in v2.10.0: pi0
- MEDIUM: Single maintainer — bus factor risk
- MEDIUM: 70 direct dependencies
- MEDIUM: No GitHub repo found — community signals unavailable
Maintainers
- pi0 (2FA)
FAQs
Security Trust Report for nitropack — 67/100 (B, standard). Maintainer risk and vulnerability analysis from 8 security databases.
The npm package @cyberhub/trust-nitropack receives a total of 14 weekly downloads. As such, @cyberhub/trust-nitropack popularity was classified as not popular.
We found that @cyberhub/trust-nitropack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Package last updated on 02 Apr 2026
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
By Sarah Gooding - Jun 04, 2026
Security News
Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.
By Sarah Gooding - Jun 03, 2026