pinwise
Sign in

Public repo page · re-scanned weekly

danielsivyer4567/xray-by-looplettech-debt free score 10/100

ref
main @ 6017c8f
scanned
29 Oct 2026, 14:48 UTC
safe window
14 days
Get tickets for this repo

Tech-debt free score

10/100

Rotting

12 critical or high advisories, 33 moderate advisories, 2 packages a whole major behind and 2 more behind the safe target.

How we got 10

Critical/high CVEs and moderate/low CVEs cost 74 of 90 lost points. Fix the 12 critical/high CVEs first.

  1. 12 critical/high CVEs12 × 25 = 300capped at 50costs −50 points, 56% of points lost
  2. 33 moderate/low CVEs33 × 8 = 264capped at 24costs −24 points, 27% of points lost
  3. 2 majors behind2 × 6costs −12 points, 13% of points lost
  4. 2 minors behind2 × 2costs −4 points, 4% of points lost

Nothing found in: deprecated packages, Node runtime EOL

Debt-free score100 − 90 =10

100 means no dependency debt; below zero means the debt outweighs the whole scale. Every advisory and every version behind costs points.

Summary

danielsivyer4567/xray-by-looplet scores 10 out of 100 on the tech-debt free score (rotting; 100 means no dependency debt). 1 of its 7 packages carry known advisories, 12 of them critical or high. 2 packages are a whole major version behind and 2 more trail the safe target. The scan covers pypi and npm. Last scanned 29 Oct 2026.

Last scanned 29 Oct 2026 · 2 public scans so far · re-scanned about once a week

Packages & tools
7

4 behind the safe target (57%)

Needs action
2

advisory, deprecated or a major behind

Behind target
2

minor or patch behind

Current
3

at or above the safe target

Advisories
45

across 1 package, from OSV.dev

How the 7 packages splitred needs a ticket, amber a bump, green nothing
01 · Worst first

The 4 packages costing danielsivyer4567/xray-by-looplet the most

Each one links to its row in the table below, with the safe target and the advisories.

  1. electron 31.7.7 → 44.7.2

    npm · 12 critical or high advisories, 33 moderate advisories, a whole major behind

  2. electron-builder 24.13.3 → 26.17.0

    npm · a whole major behind

  3. pikepdf 10.10.0 → 10.17.0

    pypi · a minor version behind

  4. pypdfium2 5.12.1 → 5.14.0

    pypi · a minor version behind

02 · Packages

7 packages, worst first

The safe target is the newest stable release that has been public for at least 14 days. Fresh releases are where supply-chain attacks land.

Showing 7 of 7 packages

Packages with installed, latest and safe target versions
StatusPackageInstalledLatest≥ 14dSafe targetDriftCVEs
Needs actionnpmdevDependencies · ^31.0.031.7.7lockfile45.1.027 Oct 2026Latest release is only 1 days old, inside the 14-day window44.7.214 Oct 2026major45

Upgrade path

major
  1. Installed31.7.7 from the lockfile
  2. Safe target44.7.214 Oct 2026public for 14+ days
  3. Latest45.1.027 Oct 2026only 1d old, inside the 14-day window

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 45

12 high, 25 moderate, 8 low
  • highCVSS 8.1GHSA-532v-xpq5-8h95

    Electron: Use-after-free in offscreen child window paint callback

    CVE-2026-34774fixed in 41.0.0

  • highCVSS 7.5GHSA-8337-3p73-46f4

    Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

    CVE-2026-34771fixed in 41.0.0-beta.8

  • highCVSS 7.2GHSA-9f4c-93c8-jc8g

    Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

    CVE-2026-70608fixed in 39.8.10

  • highCVSS 8.3GHSA-9qh4-3jw8-366w

    Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

    CVE-2026-102676fixed in 44.0.0-beta.5

  • highCVSS 7.7GHSA-9wfr-w7mm-pc7f

    Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

    CVE-2026-34769fixed in 41.0.0-beta.8

  • highCVSS 8.2GHSA-gr2m-v5gq-v685

    Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

    CVE-2026-102674fixed in 44.0.0-beta.5

  • highCVSS 7.5GHSA-h7rp-cf8h-j98x

    Electron: Context isolation bypass via Function.prototype.bind hijack

    CVE-2026-70601fixed in 42.0.0-beta.5

  • highCVSS 8.2GHSA-hq2x-r82h-9wj4

    Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

    CVE-2026-102673fixed in 43.0.0

  • highCVSS 7.4GHSA-j84w-jfhq-vhvj

    Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

    CVE-2026-102675fixed in 44.0.0-beta.5

  • highCVSS 7.0GHSA-jjp3-mq3x-295m

    Electron: Use-after-free in PowerMonitor on Windows and macOS

    CVE-2026-34770fixed in 41.0.0-beta.8

  • highCVSS 7.4GHSA-jr5w-w6x2-84p9

    Electron: Mitigation for compromised eMudhra intermediate certificates

    CVE-2026-115570fixed in 42.11.16

  • highCVSS 7.4GHSA-v3j7-r9gq-3gjw

    Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

    CVE-2026-70604fixed in 39.8.10

  • moderateCVSS 4.2GHSA-2p8c-gr87-2676

    Electron: SameSite cookie restrictions are not applied to windows opened from links

    CVE-2026-113796fixed in 42.11.3

  • moderateCVSS 5.3GHSA-3c8v-cfp5-9885

    Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

    CVE-2026-34776fixed in 41.0.0

  • moderateCVSS 5.7GHSA-4f78-qhmw-8j8m

    Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

    CVE-2026-70609fixed in 42.0.0-beta.1

  • moderateCVSS 5.9GHSA-4p4r-m79c-wq3v

    Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

    CVE-2026-34767fixed in 41.0.3

  • moderateCVSS 6.0GHSA-5c9j-mhmv-5xgx

    Electron: shell.openPath path validation bypass via embedded null byte

    CVE-2026-70603fixed in 39.8.6

  • moderateCVSS 6.5GHSA-5rqw-r77c-jp79

    Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

    CVE-2026-34779fixed in 41.0.0-beta.8

  • moderateCVSS 5.4GHSA-997q-gvvc-jwmx

    Electron: openExternal permission requests can be attributed to the wrong origin

    CVE-2026-114121fixed in 45.0.0-alpha.5

  • moderateCVSS 5.9GHSA-9pf5-hg6p-4pwp

    Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

    CVE-2026-70599fixed in 42.0.0-beta.1

  • moderateCVSS 5.8GHSA-9w97-2464-8783

    Electron: Use-after-free in download save dialog callback

    CVE-2026-34772fixed in 41.0.0-beta.7

  • moderateCVSS 6.9GHSA-f2r8-jv7c-xqmp

    Electron: DevTools embedder handler executes arbitrary files via shell open

    CVE-2026-70611fixed in 42.0.0-beta.3

  • moderateCVSS 6.0GHSA-f3pv-wv63-48x8

    Electron: Named window.open targets not scoped to the opener's browsing context

    CVE-2026-34765fixed in 42.0.0-alpha.5

  • moderateCVSS 5.4GHSA-ff2p-hmqr-hxm4

    Electron: contextBridge object copy honors prototype setters

    CVE-2026-70610fixed in 42.0.0-beta.4

  • moderateCVSS 5.4GHSA-fw47-9c62-h3vw

    Electron: HID and USB permission checks can be attributed to the wrong origin

    CVE-2026-113800fixed in 42.11.3

  • moderateCVSS 6.3GHSA-jm7p-cc5g-qwxx

    Electron: Parent process code-sign check is spoofable

    CVE-2026-70597fixed in 42.0.0-beta.3

  • moderateCVSS 6.6GHSA-m55f-7gqj-fr98

    Electron: Extension tab APIs operate across session boundaries

    CVE-2026-70602fixed in 42.0.0-beta.3

  • moderateCVSS 4.7GHSA-mwmh-mq4g-g6gr

    Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

    CVE-2026-34773fixed in 41.0.0

  • moderateCVSS 5.4GHSA-p2rr-rvmm-c5fp

    Electron: Sandboxed iframes can launch external protocol handlers

    CVE-2026-70612fixed in 42.0.0-beta.3

  • moderateCVSS 5.4GHSA-r5p7-gp4j-qhrx

    Electron: Incorrect origin passed to permission request handler for iframe requests

    CVE-2026-34777fixed in 41.0.0

  • moderateCVSS 5.9GHSA-v64r-4m7r-3mvq

    Electron: HTTP redirect followed into local file loader

    CVE-2026-70605fixed in 42.0.0-beta.3

  • moderateCVSS 5.3GHSA-v93f-fgjr-hjrj

    Electron: window.open features string controls some window options considered privileged

    CVE-2026-70607fixed in 42.0.0-beta.3

  • moderateCVSS 6.1GHSA-vmqv-hx8q-j7mg

    Electron has ASAR Integrity Bypass via resource modification

    CVE-2025-55305fixed in 38.0.0-beta.6

  • moderateCVSS 6.7GHSA-vv43-5jgx-7qv8

    Electron: Local race condition in Squirrel.Mac update installation on macOS

    CVE-2026-102672fixed in 42.0.0-beta.2

  • moderateCVSS 5.4GHSA-x562-297c-g43g

    Electron: Pointer lock permission requests can be attributed to the wrong frame

    CVE-2026-113798fixed in 42.11.9

  • moderateCVSS 5.9GHSA-xj5x-m3f3-5x3h

    Electron: Service worker can spoof executeJavaScript IPC replies

    CVE-2026-34778fixed in 41.0.0

  • moderateCVSS 6.8GHSA-xwr5-m59h-vwqr

    Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

    CVE-2026-34775fixed in 41.0.0

  • lowCVSS 3.9GHSA-3qxv-5xgr-q7w9

    Electron: Frame subscription trusts GPU-supplied frame geometry

    CVE-2026-114122fixed in 45.0.0-alpha.9

  • lowCVSS 3.3GHSA-9899-m83m-qhpj

    Electron: USB device selection not validated against filtered device list

    CVE-2026-34766fixed in 41.0.0-beta.8

  • lowCVSS 3.1GHSA-98mx-cjp9-gchm

    Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

    CVE-2026-113797fixed in 42.11.1

  • lowCVSS 2.8GHSA-f37v-82c4-4x64

    Electron: Crash in clipboard.readImage() on malformed clipboard image data

    CVE-2026-34781fixed in 42.0.0-alpha.5

  • lowCVSS 3.9GHSA-h3v5-h239-pg29

    Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

    CVE-2026-114124fixed in 45.0.0-alpha.9

  • lowCVSS 3.9GHSA-jfqx-fxh3-c62j

    Electron: Unquoted executable path in app.setLoginItemSettings on Windows

    CVE-2026-34768fixed in 41.0.0-beta.8

  • lowCVSS 3.9GHSA-pfmc-3mgc-p6fp

    Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

    CVE-2026-70598fixed in 42.0.0-beta.3

  • lowCVSS 3.1GHSA-x8rc-wpg4-grpf

    Electron: Cross-origin iframe can position native autofill popup

    CVE-2026-70600fixed in 42.0.0-beta.3

Research not included on this scan

Breaking changes, the work involved and the new features between 31.7.7 → 44.7.2 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
^31.0.0
Deprecated
No
Needs actionnpmdevDependencies · ^24.13.324.13.3lockfile26.18.020 Oct 2026Latest release is only 8 days old, inside the 14-day window26.17.026 Sep 2026major0

Upgrade path

major
  1. Installed24.13.3 from the lockfile
  2. Safe target26.17.026 Sep 2026public for 14+ days
  3. Latest26.18.020 Oct 2026only 8d old, inside the 14-day window

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 24.13.3. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 24.13.3 → 26.17.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
^24.13.3
Deprecated
No
Behindpypidependencies · ==10.10.010.10.0declared10.17.011 Oct 2026Latest release is 17 days old, past the 14-day window10.17.011 Oct 2026minor0

Upgrade path

minor
  1. Installed10.10.0 declared, no lockfile
  2. Safe target · latest10.17.011 Oct 2026public for 14+ days

A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 10.10.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 10.10.0 → 10.17.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
pypi
Section
dependencies
Declared
==10.10.0
Deprecated
No
Behindpypidependencies · ==5.12.15.12.1declared5.14.04 Oct 2026Latest release is 24 days old, past the 14-day window5.14.04 Oct 2026minor0

Upgrade path

minor
  1. Installed5.12.1 declared, no lockfile
  2. Safe target · latest5.14.04 Oct 2026public for 14+ days

A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 5.12.1. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 5.12.1 → 5.14.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
pypi
Section
dependencies
Declared
==5.12.1
Deprecated
No
Currentpypidependencies · ==1.4.41.4.4declared1.4.516 Oct 2026Latest release is only 13 days old, inside the 14-day window1.4.414 May 2026current0

Upgrade path

current
  1. Installed1.4.4 declared, no lockfile
  2. Safe target1.4.414 May 2026public for 14+ days
  3. Latest1.4.516 Oct 2026only 13d old, inside the 14-day window

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.4.4. Checked against OSV.

Nothing to research: ezdxf is at its safe target with no known advisories.

Ecosystem
pypi
Section
dependencies
Declared
==1.4.4
Deprecated
No
Currentpypidependencies · ==4.26.04.26.0declared4.26.07 Jan 2026Latest release is 295 days old, past the 14-day window4.26.07 Jan 2026current0

Upgrade path

current
  1. Installed4.26.0 declared, no lockfile
  2. Safe target · latest4.26.07 Jan 2026public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 4.26.0. Checked against OSV.

Nothing to research: jsonschema is at its safe target with no known advisories.

Ecosystem
pypi
Section
dependencies
Declared
==4.26.0
Deprecated
No
Currentpypidependencies · ==9.1.19.1.1declared9.2.027 Oct 2026Latest release is only 1 days old, inside the 14-day window9.1.119 Jun 2026current0

Upgrade path

current
  1. Installed9.1.1 declared, no lockfile
  2. Safe target9.1.119 Jun 2026public for 14+ days
  3. Latest9.2.027 Oct 2026only 1d old, inside the 14-day window

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 9.1.1. Checked against OSV.

Nothing to research: pytest is at its safe target with no known advisories.

Ecosystem
pypi
Section
dependencies
Declared
==9.1.1
Deprecated
No
03 · Tickets

18 tickets, in the order to do them

Each one is a complete brief your coding agent can execute. A ticket only turns green when a rescan proves the lockfile moved.

What is in a ticket
  1. P0cve
    TDB-0001L1 electron

    Fix 45 advisories in electron: 31.7.7 → 32.3.3 (hop 1 of 14)

    electron31.7.732.3.3

    electron 31.7.7 in danielsivyer4567/xray-by-looplet has 45 known advisories (25 moderate, 8 low, 12 high). Upgrade 31.7.7 → 32.3.3 so the installed version is no longer affected. This is hop 1 of 14: go from 31.7.7 → 32.3.3 only; the other hops are separate tickets chained with blockers.

    • The manifest pins electron at exactly 32.3.3: no ^, ~ or range.
    • The lockfile is regenerated with the project's package manager, resolves electron to the target, and nothing newer than the target slipped in.
    • A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
    • Tests, lint, typecheck and build all pass, and your report contains their real output.
    • No API that the release notes mark as removed remains in the code.
    • A rescan of your branch shows no advisories for this package.
    • No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.
  2. P0cve
    TDB-0002L1 electron

    Fix 45 advisories in electron: 32.3.3 → 33.4.11 (hop 2 of 14)

    electron32.3.333.4.11

    electron 32.3.3 in danielsivyer4567/xray-by-looplet has 45 known advisories (25 moderate, 8 low, 12 high). Upgrade 32.3.3 → 33.4.11 so the installed version is no longer affected. This is hop 2 of 14: go from 32.3.3 → 33.4.11 only; the other hops are separate tickets chained with blockers.

    • The manifest pins electron at exactly 33.4.11: no ^, ~ or range.
    • The lockfile is regenerated with the project's package manager, resolves electron to the target, and nothing newer than the target slipped in.
    • A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
    • Tests, lint, typecheck and build all pass, and your report contains their real output.
    • No API that the release notes mark as removed remains in the code.
    • A rescan of your branch shows no advisories for this package.
    • No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.

    after TDB-0001

  3. P0cve
    TDB-0003L1 electron

    Fix 45 advisories in electron: 33.4.11 → 34.5.8 (hop 3 of 14)

    electron33.4.1134.5.8

    electron 33.4.11 in danielsivyer4567/xray-by-looplet has 45 known advisories (25 moderate, 8 low, 12 high). Upgrade 33.4.11 → 34.5.8 so the installed version is no longer affected. This is hop 3 of 14: go from 33.4.11 → 34.5.8 only; the other hops are separate tickets chained with blockers.

    • The manifest pins electron at exactly 34.5.8: no ^, ~ or range.
    • The lockfile is regenerated with the project's package manager, resolves electron to the target, and nothing newer than the target slipped in.
    • A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
    • Tests, lint, typecheck and build all pass, and your report contains their real output.
    • No API that the release notes mark as removed remains in the code.
    • A rescan of your branch shows no advisories for this package.
    • No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.

    after TDB-0002

15 more tickets in this queue

Sign in to see every ticket with its research, then point Claude Code or Cursor at the queue over MCP.

See all 18 tickets

Free, no card needed

04 · Questions

About danielsivyer4567/xray-by-looplet's dependencies

Does danielsivyer4567/xray-by-looplet have known vulnerabilities?

Yes. The latest scan found 45 known advisories across 1 package, 12 rated critical or high. Advisories come from OSV and are matched against the installed versions in the lockfile.

How outdated are danielsivyer4567/xray-by-looplet’s dependencies?

4 of its packages are behind the safe target (the newest stable release that has been public for at least 14 days). 2 packages are a whole major version behind. The tech-debt free score is 10/100. 100 means no dependency debt; below zero means the debt outweighs the whole scale.

Which package ecosystems does danielsivyer4567/xray-by-looplet use?

pypi and npm (7 packages in the manifests and lockfiles pinwise read).

When was danielsivyer4567/xray-by-looplet last scanned?

29 Oct 2026. Public repo pages are re-scanned about once a week, and anyone can request a fresh scan from the free scanner.

05 · Share

Put the score where people look

For maintainers

Is this your repo?

Claim danielsivyer4567/xray-by-looplet to turn this report into a working plan, or decide whether this public page stays up.

  • Watch itWeekly re-scans and a nudge when a fix lands or a CVE appears.
  • TicketsEvery finding as a ready-to-ship ticket your coding agent can close.
  • Private scansScan branches and private repos inside your workspace.
  • BadgeA live debt-free score badge for your README.
Sign in with GitHub to claimHide or remove this page

Only the repo's owner can claim or change this page. We verify through your GitHub login, a connected workspace or the GitHub App installation, never a form.

Search visibility and removal

Pinwise scans public repositories from their manifests and lockfiles only. If you own danielsivyer4567/xray-by-looplet, you can keep this page out of search engines or remove it. Private scans inside the app are not affected.

Sign in with the GitHub account that owns the repo to hide or remove this page yourself.