Webcmd AI Agent

Findings (76)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@5.0.6: 6 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.5: 10 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-hrr3-gc8f-f4qj +5 more

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@4.3.1: 1 known vulnerability

  GHSA-2883-xcg3-v3hh

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 3 known vulnerabilities

  GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@6.28.0: 16 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm +11 more

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@7.29.0: 36 known vulnerabilities

  GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +31 more

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@8.5.0: 23 known vulnerabilities

  GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +18 more

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  benchmarks/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  cryptography@46.0.7: 4 known vulnerabilities

  PYSEC-2026-3552, PYSEC-2026-3553, PYSEC-2026-3554, GHSA-537c-gmf6-5ccf

  benchmarks/uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  pyasn1@0.6.4: 4 known vulnerabilities

  GHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39, GHSA-fm9c-5rcf-2q5p, GHSA-mm57-4v3p-rchx

  benchmarks/uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  urllib3@2.7.0: 3 known vulnerabilities

  PYSEC-2026-4175, PYSEC-2026-4176, PYSEC-2026-4177

  benchmarks/uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@4.3.0: 2 known vulnerabilities

  GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.15: 2 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@4.0.3: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  postcss@8.5.16: 2 known vulnerabilities

  GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@6.27.0: 11 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-8xcm-r25x-g524, GHSA-9fm3-97px-rjf6 +6 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@7.28.0: 23 known vulnerabilities

  GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +18 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.0.2: 10 known vulnerabilities

  GHSA-4w7w-66w2-5vf9, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff +5 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@8.20.0: 2 known vulnerabilities

  GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.16: 1 known vulnerability

  GHSA-2v37-7h3g-55p8

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.1.5: 5 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser.test.ts:397
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/article-extract.test.ts:59
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/article-extract.test.ts:60
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/article-extract.test.ts:61
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/compound.test.ts:16
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-helpers.test.ts:12
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-helpers.test.ts:34
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-helpers.test.ts:46
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-helpers.test.ts:61
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-helpers.test.ts:76
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-helpers.test.ts:96
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-helpers.test.ts:114
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-helpers.test.ts:130
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-snapshot.test.ts:24
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-snapshot.test.ts:241
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/dom-snapshot.test.ts:266
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/find.test.ts:13
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/find.test.ts:148
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/html-tree.test.ts:20
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/html-tree.test.ts:30
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/stealth.test.ts:151
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/target-resolver.test.ts:54
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/target-resolver.test.ts:116
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/browser/utils.test.ts:20
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/hosted/programmatic.test.ts:146
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/hosted/programmatic.test.ts:162
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/hosted/programmatic.test.ts:171
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/hosted/programmatic.test.ts:215
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils.test.ts:196
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils.test.ts:200
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils.test.ts:217
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils.test.ts:234
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/observation/redaction.test.ts:49
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  src/observation/redaction.test.ts:8
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.17: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  benchmarks/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@13.0.6: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  benchmarks/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  hono@4.13.1: 5 known vulnerabilities

  GHSA-5r4p-p66f-jhc7, GHSA-crvj-82cr-hjcx, GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv, GHSA-hxh3-vqpv-xpqv

  benchmarks/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.5.0: 5 known vulnerabilities

  GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5

  benchmarks/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.5: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  benchmarks/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  protobufjs@7.6.4: 1 known vulnerability

  GHSA-j3f2-48v5-ccww

  benchmarks/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.3: 3 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx

  benchmarks/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  pytest@8.4.2: 1 known vulnerability

  PYSEC-2026-1845

  benchmarks/uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.1: 2 known vulnerabilities

  GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  esbuild@0.27.4: 1 known vulnerability

  GHSA-g7r4-m6w7-qqqr

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  vitest@4.1.1: 1 known vulnerability

  GHSA-82fw-gwwq-j7x9

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.4: 2 known vulnerabilities

  GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  vitest@4.1.4: 1 known vulnerability

  GHSA-82fw-gwwq-j7x9

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a postinstall script

  node scripts/postinstall.js

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  node scripts/prepare.mjs

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity