diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 00000000..fd476164
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,17 @@
+## Goal
+[Provide a clear the goal of PR]
+
+## Changes
+- [List the key changes or modifications made in the code.]
+- [Highlight any significant refactoring or architectural decisions.]
+
+## Testing
+[Provide clear instructions on how to test the changes locally.]
+
+## Artifacts & Screenshots
+[Provide the screenshots of work (may be in submission file)]
+
+### Checklist:
+- [ ] Clear title and description
+- [ ] Documentation/README updated if needed
+- [ ] No secrets or large temporary files
\ No newline at end of file
diff --git a/assets-for-labs/image-3.1.png b/assets-for-labs/image-3.1.png
new file mode 100644
index 00000000..bd763668
Binary files /dev/null and b/assets-for-labs/image-3.1.png differ
diff --git a/assets-for-labs/image-3.2.png b/assets-for-labs/image-3.2.png
new file mode 100644
index 00000000..b3a89e0d
Binary files /dev/null and b/assets-for-labs/image-3.2.png differ
diff --git a/assets-for-labs/image-3.3.png b/assets-for-labs/image-3.3.png
new file mode 100644
index 00000000..940275ac
Binary files /dev/null and b/assets-for-labs/image-3.3.png differ
diff --git a/assets-for-labs/image-3.4.png b/assets-for-labs/image-3.4.png
new file mode 100644
index 00000000..6826e168
Binary files /dev/null and b/assets-for-labs/image-3.4.png differ
diff --git a/assets-for-labs/image.png b/assets-for-labs/image.png
new file mode 100644
index 00000000..3f9c3c73
Binary files /dev/null and b/assets-for-labs/image.png differ
diff --git a/labs/lab1.md b/labs/lab1.md
deleted file mode 100644
index 43053d85..00000000
--- a/labs/lab1.md
+++ /dev/null
@@ -1,276 +0,0 @@
-# Lab 1 — Setup OWASP Juice Shop & PR Workflow
-
-
-
-
-
-> **Goal:** Run OWASP Juice Shop locally, complete a triage report, and standardize PR submissions.
-> **Deliverable:** A PR from `feature/lab1` to the course repo with `labs/submission1.md` containing triage report and PR template setup. Submit the PR link via Moodle.
-
----
-
-## Overview
-
-In this lab you will practice:
-- Launching **OWASP Juice Shop** for security testing
-- Capturing a **triage report** covering version, URL, health check, exposure, risks, and next actions
-- Bootstrapping a **repeatable PR workflow** with a template
-
-> We **do not** copy Juice Shop code into the repo. You'll run the official Docker image and keep **only lab artifacts** in your fork.
-
----
-
-## Tasks
-
-### Task 1 — OWASP Juice Shop Deployment (5 pts)
-
-**Objective:** Run Juice Shop locally and complete a Triage report capturing deployment, health check, exposure, and top risks.
-
-#### 1.1: Deploy Juice Shop Container
-
-```bash
-docker run -d --name juice-shop \
- -p 127.0.0.1:3000:3000 \
- bkimminich/juice-shop:v19.0.0
-```
-
-#### 1.2: Initial Verification
-
-- Browse to `http://localhost:3000` and confirm the app loads
-- Verify API responds: `curl -s http://127.0.0.1:3000/rest/products | head`
-
-#### 1.3: Complete Triage Report
-
-Create `labs/submission1.md` using this template:
-
-```markdown
-# Triage Report — OWASP Juice Shop
-
-## Scope & Asset
-- Asset: OWASP Juice Shop (local lab instance)
-- Image: bkimminich/juice-shop:v19.0.0
-- Release link/date: —
-- Image digest (optional):
-
-## Environment
-- Host OS:
-- Docker:
-
-## Deployment Details
-- Run command used: `docker run -d --name juice-shop -p 127.0.0.1:3000:3000 bkimminich/juice-shop:v19.0.0`
-- Access URL: http://127.0.0.1:3000
-- Network exposure: 127.0.0.1 only [ ] Yes [ ] No (explain if No)
-
-## Health Check
-- Page load: attach screenshot of home page (path or embed)
-- API check: first 5–10 lines from `curl -s http://127.0.0.1:3000/rest/products | head`
-
-## Surface Snapshot (Triage)
-- Login/Registration visible: [ ] Yes [ ] No — notes: <...>
-- Product listing/search present: [ ] Yes [ ] No — notes: <...>
-- Admin or account area discoverable: [ ] Yes [ ] No — notes: <...>
-- Client-side errors in console: [ ] Yes [ ] No — notes: <...>
-- Security headers (quick look — optional): `curl -I http://127.0.0.1:3000` → CSP/HSTS present? notes: <...>
-
-## Risks Observed (Top 3)
-1)
-2)
-3)
-```
-
-In `labs/submission1.md`, document:
-- Complete triage report using provided template
-- Screenshots or API output demonstrating working deployment
-- Environment details and security observations
-- Analysis of top 3 security risks identified during assessment
-
----
-
-### Task 2 — PR Template Setup (4 pts)
-
-**Objective:** Standardize submissions so every lab PR has the same sections and checks.
-
-#### 2.1: Create PR Template
-
-Create `.github/pull_request_template.md` with:
-- Sections: **Goal**, **Changes**, **Testing**, **Artifacts & Screenshots**
-- Checklist (3 items): clear title, docs updated if needed, no secrets/large temp files
-
-```bash
-# Commit message example:
-git commit -m "docs: add PR template"
-```
-
-#### 2.2: Verify Template Application
-
-```bash
-git checkout -b feature/lab1
-git add labs/submission1.md
-git commit -m "docs(lab1): add submission1 triage report"
-git push -u origin feature/lab1
-```
-
-Verify that:
-- PR description auto-fills with sections & checklist
-- Fill in **Goal / Changes / Testing / Artifacts & Screenshots** and tick checkboxes
-- Screenshots and API snippet are embedded in `labs/submission1.md`
-
-In `labs/submission1.md`, document:
-- PR template creation process and verification
-- Evidence that template auto-fills correctly
-- Analysis of how templates improve collaboration workflow
-
-
-One-time Bootstrap Note
-
-GitHub loads PR templates from the **default branch of your fork (`main`)**. Add the template to `main` first, then open your lab PR from `feature/lab1`.
-
-
-
----
-
-### Task 6 — GitHub Community Engagement (1 pt)
-
-**Objective:** Explore GitHub's social features that support collaboration and discovery.
-
-**Actions Required:**
-1. **Star** the course repository
-2. **Star** the [simple-container-com/api](https://github.com/simple-container-com/api) project — a promising open-source tool for container management
-3. **Follow** your professor and TAs on GitHub:
- - Professor: [@Cre-eD](https://github.com/Cre-eD)
- - TA: [@marat-biriushev](https://github.com/marat-biriushev)
- - TA: [@pierrepicaud](https://github.com/pierrepicaud)
-4. **Follow** at least 3 classmates from the course
-
-**Document in labs/submission1.md:**
-
-Add a "GitHub Community" section (after Challenges & Solutions) with 1-2 sentences explaining:
-- Why starring repositories matters in open source
-- How following developers helps in team projects and professional growth
-
-
-💡 GitHub Social Features
-
-**Why Stars Matter:**
-
-**Discovery & Bookmarking:**
-- Stars help you bookmark interesting projects for later reference
-- Star count indicates project popularity and community trust
-- Starred repos appear in your GitHub profile, showing your interests
-
-**Open Source Signal:**
-- Stars encourage maintainers (shows appreciation)
-- High star count attracts more contributors
-- Helps projects gain visibility in GitHub search and recommendations
-
-**Professional Context:**
-- Shows you follow best practices and quality projects
-- Indicates awareness of industry tools and trends
-
-**Why Following Matters:**
-
-**Networking:**
-- See what other developers are working on
-- Discover new projects through their activity
-- Build professional connections beyond the classroom
-
-**Learning:**
-- Learn from others' code and commits
-- See how experienced developers solve problems
-- Get inspiration for your own projects
-
-**Collaboration:**
-- Stay updated on classmates' work
-- Easier to find team members for future projects
-- Build a supportive learning community
-
-**Career Growth:**
-- Follow thought leaders in your technology stack
-- See trending projects in real-time
-- Build visibility in the developer community
-
-**GitHub Best Practices:**
-- Star repos you find useful (not spam)
-- Follow developers whose work interests you
-- Engage meaningfully with the community
-- Your GitHub activity shows employers your interests and involvement
-
-
-
----
-
-## How to Submit
-
-1. Create a branch for this lab and push it to your fork:
-
- ```bash
- git switch -c feature/lab1
- # create labs/submission1.md with your findings
- git add labs/submission1.md
- git commit -m "docs: add lab1 submission"
- git push -u origin feature/lab1
- ```
-
-2. Open a PR from your fork's `feature/lab1` branch → **course repository's main branch**.
-
-3. In the PR description, include:
-
- ```text
- - [x] Task 1 done — OWASP Juice Shop deployment + triage report
- - [x] Task 2 done — PR template setup + verification
- - [x] Task 6 done — GitHub community engagement
- ```
-
-4. **Copy the PR URL** and submit it via **Moodle before the deadline**.
-
----
-
-## Acceptance Criteria
-
-- ✅ Branch `feature/lab1` exists with commits for each task
-- ✅ File `labs/submission1.md` contains required triage report for Tasks 1, 2, and 6
-- ✅ OWASP Juice Shop successfully deployed and documented
-- ✅ File `.github/pull_request_template.md` exists on **main** branch
-- ✅ GitHub community engagement completed (stars and follows)
-- ✅ PR from `feature/lab1` → **course repo main branch** is open
-- ✅ PR link submitted via Moodle before the deadline
-- ✅ **No Juice Shop source code** copied into repo—only lab artifacts
-
----
-
-## Rubric (10 pts)
-
-| Criterion | Points |
-| -------------------------------------------------------- | -----: |
-| Task 1 — OWASP Juice Shop deployment + triage report | **5** |
-| Task 2 — PR template setup + verification | **4** |
-| Task 6 — GitHub community engagement | **1** |
-| **Total** | **10** |
-
----
-
-## Guidelines
-
-- Use clear Markdown headers to organize sections in `submission1.md`
-- Include both command outputs and written analysis for each task
-- Document deployment process and security observations
-- Ensure screenshots and evidence demonstrate working setup
-
-
-Security Notes
-
-- Always bind to `127.0.0.1` to avoid exposing the app beyond localhost
-- Pin specific Docker image versions for reproducibility
-- Never commit application source code—only lab artifacts and reports
-
-
-
-
-Deployment Tips
-
-- Check GitHub Releases page for specific version dates and notes
-- Verify API endpoints respond before completing triage report
-- Document all observed security issues in the triage template
-- Keep deployment commands simple and well-documented
-
-
\ No newline at end of file
diff --git a/labs/lab10.md b/labs/lab10.md
deleted file mode 100644
index 378b56a5..00000000
--- a/labs/lab10.md
+++ /dev/null
@@ -1,209 +0,0 @@
-# Lab 10 — Vulnerability Management & Response with DefectDojo
-
-
-
-
-
-> Goal: Stand up DefectDojo locally, import prior lab findings (ZAP, Semgrep, Trivy/Grype, Nuclei), and produce a stakeholder-ready reporting & metrics package.
-> Deliverable: A PR from `feature/lab10` with `labs/submission10.md` summarizing setup evidence, import results, metrics snapshot highlights, and links to exported artifacts. Submit the PR link via Moodle.
-
----
-
-## Overview
-
-In this lab you will practice:
-- Standing up OWASP DefectDojo locally via Docker Compose
-- Organizing findings across products/engagements/tests
-- Importing findings from multiple tools (ZAP, Semgrep, Trivy, Nuclei)
-- Generating reports that non-technical stakeholders can consume
-- Deriving basic program metrics (open/closed status, severity mix, SLA outlook)
-
-> Primary platform: OWASP DefectDojo (open source, 2025)
-
----
-
-## Prerequisites
-
-- Docker with Compose V2 (`docker compose` available)
-- `git`, `curl`, `jq`
-- Prior lab outputs available locally (paths below)
-
-Create working directories:
-```bash
-mkdir -p labs/lab10/{setup,imports,report}
-```
-
----
-
-## Tasks
-
-### Task 1 — DefectDojo Local Setup (2 pts)
-Objective: Run DefectDojo locally and prepare the structure for managing findings.
-
-#### 1.1: Clone and start DefectDojo
-```bash
-# Clone upstream
-git clone https://github.com/DefectDojo/django-DefectDojo.git labs/lab10/setup/django-DefectDojo
-cd labs/lab10/setup/django-DefectDojo
-
-# Optional: check compose compatibility
-./docker/docker-compose-check.sh || true
-
-# Build and start (first run can take a bit)
-docker compose build
-docker compose up -d
-
-# Verify containers are healthy
-docker compose ps
-# UI: http://localhost:8080
-```
-
-#### 1.2: Get admin credentials (no manual superuser needed)
-```bash
-# Watch initializer logs until the admin password is printed
-docker compose logs -f initializer
-# In a second terminal, extract the password once available:
-docker compose logs initializer | grep "Admin password:"
-
-# Login to the UI at http://localhost:8080 with:
-# Username: admin
-# Password:
-```
----
-
-### Task 2 — Import Prior Findings (4 pts)
-Objective: Import findings from your previous labs into the engagement.
-
-Use the importer script below; no manual API calls are required. The script will auto‑create the product type/product/engagement if missing.
-
-#### 2.1: Get API token and set variables
-```bash
-# In the UI: Profile → API v2 Key → copy your token
-export DD_API="http://localhost:8080/api/v2"
-export DD_TOKEN="REPLACE_WITH_YOUR_API_TOKEN"
-
-# Target context (adjust names if you prefer)
-export DD_PRODUCT_TYPE="Engineering"
-export DD_PRODUCT="Juice Shop"
-export DD_ENGAGEMENT="Labs Security Testing"
-# The import script will auto-detect importer names from your instance.
-```
-
-#### 2.2: Required reports (expected paths)
-- ZAP: `labs/lab5/zap/zap-report-noauth.json`
-- Semgrep: `labs/lab5/semgrep/semgrep-results.json`
-- Trivy: `labs/lab4/trivy/trivy-vuln-detailed.json`
-- Nuclei: `labs/lab5/nuclei/nuclei-results.json`
-- Grype (optional): `labs/lab4/syft/grype-vuln-results.json`
-
-#### 2.3: Run the importer script
-```bash
-bash labs/lab10/imports/run-imports.sh
-```
-The script auto-detects importer names, auto-creates context if missing, imports any reports found at the paths above, and saves responses under `labs/lab10/imports/`.
----
-
-### Task 3 — Reporting & Program Metrics (4 pts)
-Objective: Turn raw imports into an easy-to-understand report and metrics package that a stakeholder can consume without prior Dojo experience.
-
-#### 3.1: Create a baseline progress snapshot
-- From the engagement dashboard, note the counts for Active, Verified, and Mitigated findings.
-- Use the “Filters” sidebar to group by severity; grab a screenshot or jot the numbers.
-- Record the snapshot using the template below:
- ```bash
- mkdir -p labs/lab10/report
- cat > labs/lab10/report/metrics-snapshot.md <<'EOF'
- # Metrics Snapshot — Lab 10
-
- - Date captured:
- - Active findings:
- - Critical:
- - High:
- - Medium:
- - Low:
- - Informational:
- - Verified vs. Mitigated notes:
- EOF
- ```
-
-#### 3.2: Generate governance-ready artifacts
-- In the Engagement → Reports page, choose a human-readable template (Executive, Detailed, or similar) and generate a PDF or HTML report.
- - Save it to `labs/lab10/report/dojo-report.pdf` or `.html`.
-- Download the “Findings list (CSV)” from the same page and store it as `labs/lab10/report/findings.csv` for spreadsheet analysis.
-
-#### 3.3: Extract key metrics for `labs/submission10.md`
-- From the report or dashboard, capture:
- - Open vs. Closed counts by severity.
- - Findings per tool (ZAP, Semgrep, Trivy, Nuclei, and Grype).
- - Any SLA breaches or items due within the next 14 days.
- - Top recurring CWE/OWASP categories.
-- Summarize these in prose (3–5 bullet points) inside `labs/submission10.md`.
-
-Deliverables for this task:
-- `labs/lab10/report/metrics-snapshot.md`
-- `labs/lab10/report/dojo-report.(pdf|html)`
-- `labs/lab10/report/findings.csv`
-- Metric summary bullets in `labs/submission10.md`
-
----
-
-## Acceptance Criteria
-
-- ✅ DefectDojo runs locally and an admin user can log in
-- ✅ Product Type, Product, and Engagement are configured
-- ✅ Imports completed for ZAP, Semgrep, Trivy (plus Nuclei/Grype if available)
-- ✅ Reporting artifacts generated: metrics snapshot, Dojo report, findings CSV, and summary bullets in `labs/submission10.md`
-- ✅ All artifacts saved under `labs/lab10/`
-
----
-
-## How to Submit
-
-1. Create a branch for this lab and push it to your fork:
-```bash
-git switch -c feature/lab10
-# create labs/submission10.md with your findings
-git add labs/lab10/ labs/submission10.md
-git commit -m "docs: lab10 — DefectDojo vuln management"
-git push -u origin feature/lab10
-```
-2. Open a PR from your fork’s `feature/lab10` → course repo’s `main`.
-3. Include this checklist in the PR description:
-```text
-- [x] Task 1 — Dojo setup and structure
-- [x] Task 2 — Imports completed (multi-tool)
-- [x] Task 3 — Report + metrics package
-```
-4. Submit the PR URL via Moodle before the deadline.
-
----
-
-## Rubric (10 pts)
-
-| Criterion | Points |
-| ------------------------------------------------------------ | -----: |
-| Task 1 — DefectDojo local setup | 2.0 |
-| Task 2 — Import prior findings (multi-tool) | 4.0 |
-| Task 3 — Reporting & metrics package | 4.0 |
-| Total | 10.0 |
-
----
-
-## Guidelines
-
-- Keep sensitive data out of uploads; use lab outputs only
-- Prefer JSON formats for robust importer support
-- If you explore deduplication, note the algorithm choice (helps explain numbers)
-- Be explicit when marking false positives (add justification)
-- Keep SLAs realistic but time-bound; reference calendar dates
-
-
-References
-
-- DefectDojo: https://github.com/DefectDojo/django-DefectDojo
-- Importers list: check your UI Import Scan page for exact `scan_type` names
-- Local API v2 docs: http://localhost:8080/api/v2/doc/ (after startup)
-- Official docs (Open Source): https://docs.defectdojo.com/en/open_source/
-- CVSS v3.1 Calculator: https://www.first.org/cvss/calculator/3.1
-
-
diff --git a/labs/lab10/imports/run-imports.sh b/labs/lab10/imports/run-imports.sh
deleted file mode 100644
index 0f0e33c9..00000000
--- a/labs/lab10/imports/run-imports.sh
+++ /dev/null
@@ -1,134 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Batch import helper for Lab 10
-# - Auto-detects scan_type names from your Dojo instance
-# - Imports whichever files exist among ZAP, Semgrep, Trivy, Nuclei (and optional Grype)
-#
-# Usage:
-# export DD_API="http://localhost:8080/api/v2"
-# export DD_TOKEN=""
-# # Optional overrides (defaults shown)
-# export DD_PRODUCT_TYPE="${DD_PRODUCT_TYPE:-Engineering}"
-# export DD_PRODUCT="${DD_PRODUCT:-Juice Shop}"
-# export DD_ENGAGEMENT="${DD_ENGAGEMENT:-Labs Security Testing}"
-# bash labs/lab10/imports/run-imports.sh
-
-here_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-out_dir="$here_dir"
-
-require_env() {
- local name="$1"
- if [[ -z "${!name:-}" ]]; then
- echo "ERROR: env var $name is required" >&2
- exit 1
- fi
-}
-
-require_env DD_API
-require_env DD_TOKEN
-
-DD_PRODUCT_TYPE="${DD_PRODUCT_TYPE:-Engineering}"
-DD_PRODUCT="${DD_PRODUCT:-Juice Shop}"
-DD_ENGAGEMENT="${DD_ENGAGEMENT:-Labs Security Testing}"
-
-echo "Using context:"
-echo " DD_API=$DD_API"
-echo " DD_PRODUCT_TYPE=$DD_PRODUCT_TYPE"
-echo " DD_PRODUCT=$DD_PRODUCT"
-echo " DD_ENGAGEMENT=$DD_ENGAGEMENT"
-
-have_jq=true
-command -v jq >/dev/null 2>&1 || have_jq=false
-if ! $have_jq; then
- echo "WARN: jq not found; falling back to defaults for scan_type names." >&2
-fi
-
-# Discover scan type names from your instance if jq is available
-SCAN_ZAP="${SCAN_ZAP:-}"
-SCAN_SEMGREP="${SCAN_SEMGREP:-}"
-SCAN_TRIVY="${SCAN_TRIVY:-}"
-SCAN_NUCLEI="${SCAN_NUCLEI:-}"
-
-if $have_jq; then
- echo "Discovering importer names from /test_types/ ..."
- mapfile -t types < <(curl -sS -H "Authorization: Token $DD_TOKEN" "$DD_API/test_types/?limit=2000" | jq -r '.results[].name')
- choose_type() {
- local pat="$1"
- local fallback="$2"
- local val=""
- for t in "${types[@]}"; do
- if [[ "$t" =~ $pat ]]; then val="$t"; break; fi
- done
- if [[ -z "$val" ]]; then val="$fallback"; fi
- echo "$val"
- }
- SCAN_ZAP="${SCAN_ZAP:-$(choose_type '^ZAP' 'ZAP Scan')}"
- SCAN_SEMGREP="${SCAN_SEMGREP:-$(choose_type '^Semgrep' 'Semgrep JSON Report')}"
- SCAN_TRIVY="${SCAN_TRIVY:-$(choose_type '^Trivy' 'Trivy Scan')}"
- SCAN_NUCLEI="${SCAN_NUCLEI:-$(choose_type '^Nuclei' 'Nuclei Scan')}"
- # Grype importer (commonly named "Anchore Grype")
- if [[ -z "${SCAN_GRYPE:-}" ]]; then
- SCAN_GRYPE=$(printf '%s\n' "${types[@]}" | grep -i '^Anchore Grype' | head -n1)
- if [[ -z "$SCAN_GRYPE" ]]; then
- SCAN_GRYPE=$(printf '%s\n' "${types[@]}" | grep -i 'Grype' | head -n1)
- fi
- fi
-else
- SCAN_ZAP="${SCAN_ZAP:-ZAP Scan}"
- SCAN_SEMGREP="${SCAN_SEMGREP:-Semgrep JSON Report}"
- SCAN_TRIVY="${SCAN_TRIVY:-Trivy Scan}"
- SCAN_NUCLEI="${SCAN_NUCLEI:-Nuclei Scan}"
-fi
-SCAN_GRYPE="${SCAN_GRYPE:-Anchore Grype}"
-
-echo "Importer names:"
-echo " ZAP = $SCAN_ZAP"
-echo " Semgrep = $SCAN_SEMGREP"
-echo " Trivy = $SCAN_TRIVY"
-echo " Nuclei = $SCAN_NUCLEI"
-echo " Grype = $SCAN_GRYPE"
-
-import_scan() {
- local scan_type="$1"; shift
- local file="$1"; shift
- if [[ ! -f "$file" ]]; then
- echo "SKIP: $scan_type file not found: $file"
- return 0
- fi
- local base out
- base="$(basename "$file")"
- out="$out_dir/import-${base//[^A-Za-z0-9_.-]/_}.json"
- echo "Importing $scan_type from $file"
- curl -sS -X POST "$DD_API/import-scan/" \
- -H "Authorization: Token $DD_TOKEN" \
- -F "scan_type=$scan_type" \
- -F "file=@$file" \
- -F "product_type_name=$DD_PRODUCT_TYPE" \
- -F "product_name=$DD_PRODUCT" \
- -F "engagement_name=$DD_ENGAGEMENT" \
- -F "auto_create_context=true" \
- -F "minimum_severity=Info" \
- -F "close_old_findings=false" \
- -F "push_to_jira=false" \
- | tee "$out"
-}
-
-# Candidate paths per tool
-zap_file="labs/lab5/zap/zap-report-noauth.json"
-semgrep_file="labs/lab5/semgrep/semgrep-results.json"
-trivy_file="labs/lab4/trivy/trivy-vuln-detailed.json"
-nuclei_file="labs/lab5/nuclei/nuclei-results.json"
-
-# Grype
-grype_file="labs/lab4/syft/grype-vuln-results.json"
-
-import_scan "$SCAN_ZAP" "$zap_file"
-import_scan "$SCAN_SEMGREP" "$semgrep_file"
-import_scan "$SCAN_TRIVY" "$trivy_file"
-import_scan "$SCAN_NUCLEI" "$nuclei_file"
-
-# Grype
-import_scan "$SCAN_GRYPE" "$grype_file"
-
-echo "Done. Import responses saved under $out_dir"
diff --git a/labs/lab11.md b/labs/lab11.md
deleted file mode 100644
index 4ada0627..00000000
--- a/labs/lab11.md
+++ /dev/null
@@ -1,285 +0,0 @@
-# Lab 11 — Reverse Proxy Hardening: Nginx Security Headers, TLS, and Rate Limiting
-
-
-
-
-
-> Goal: Place OWASP Juice Shop behind an Nginx reverse proxy and harden it with security headers, TLS, and request rate limiting — without changing app code.
-> Deliverable: A PR from `feature/lab11` with `labs/submission11.md` including command evidence, header/TLS scans, rate-limit test results, and a short analysis of trade-offs.
-
----
-
-## Overview
-
-You will:
-- Deploy Juice Shop behind a reverse proxy using Docker Compose
-- Add and verify essential security headers (XFO, XCTO, HSTS, Referrer-Policy, Permissions-Policy, COOP/CORP)
-- Enable TLS with a local self-signed certificate and verify configuration
-- Implement request rate limiting and timeouts to reduce brute-force/DoS risk
-
-This lab is designed to be practical and educational, focusing on changes operations teams can make without touching application code.
-
----
-
-## Prerequisites
-
-Before starting, ensure you have:
-- ✅ Docker installed and running (`docker --version`)
-- ✅ Docker Compose installed (`docker compose version`)
-- ✅ `curl` and `jq` for testing and JSON parsing
-- ✅ At least 2GB free disk space
-- ✅ ~45-60 minutes available
-
-**Quick Setup Check:**
-```bash
-# Pull images in advance (optional)
-docker pull bkimminich/juice-shop:v19.0.0
-docker pull nginx:stable-alpine
-docker pull alpine:latest
-docker pull drwetter/testssl.sh:latest
-
-# Create working directories
-mkdir -p labs/lab11/{reverse-proxy/certs,logs,analysis}
-```
-
-**Files provided in this repo:**
-- `labs/lab11/docker-compose.yml` - Stack configuration
-- `labs/lab11/reverse-proxy/nginx.conf` - Pre-configured with security headers, TLS, rate limiting
-
----
-
-## Tasks
-
-### Task 1 — Reverse Proxy Compose Setup (2 pts)
-⏱️ **Estimated time:** 10 minutes
-
-**Objective:** Run Juice Shop behind Nginx (no app port exposed directly).
-
-#### 1.1: Prepare certs and start the stack
-```bash
-# Navigate to lab11 directory
-cd labs/lab11
-
-# Generate a local self-signed cert with SAN for localhost so Nginx can start
-docker run --rm -v "$(pwd)/reverse-proxy/certs":/certs \
- alpine:latest \
- sh -c "apk add --no-cache openssl && cat > /tmp/san.cnf << 'EOF' && \
-cat /tmp/san.cnf && \
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
- -keyout /certs/localhost.key -out /certs/localhost.crt \
- -config /tmp/san.cnf -extensions v3_req
-[ req ]
-default_bits = 2048
-distinguished_name = req_distinguished_name
-x509_extensions = v3_req
-prompt = no
-
-[ req_distinguished_name ]
-CN = localhost
-
-[ v3_req ]
-subjectAltName = @alt_names
-
-[ alt_names ]
-DNS.1 = localhost
-IP.1 = 127.0.0.1
-IP.2 = ::1
-EOF"
-
-# Start services
-docker compose up -d
-docker compose ps
-
-# Verify HTTP (should redirect to HTTPS)
-curl -s -o /dev/null -w "HTTP %{http_code}\n" http://localhost:8080/
-```
-
-Expected: `HTTP 308` (redirect to HTTPS).
-
-#### 1.2: Confirm no direct app exposure
-```bash
-# Only Nginx should have published host ports; Juice Shop should have none
-docker compose ps
-```
-
-In `labs/submission11.md`, document:
-
-**Task 1 Requirements:**
- - Explain why reverse proxies are valuable for security (TLS termination, security headers injection, request filtering, single access point)
- - Explain why hiding direct app ports reduces attack surface
- - Include the `docker compose ps` output showing only Nginx has published host ports (Juice Shop shows none)
-
----
-
-### Task 2 — Security Headers (3 pts)
-⏱️ **Estimated time:** 10 minutes
-
-**Objective:** Review the essential headers at the proxy and verify they’re present over HTTP/HTTPS.
-
-Headers configured in `nginx.conf`:
- - `X-Frame-Options: DENY`
- - `X-Content-Type-Options: nosniff`
- - `Referrer-Policy: strict-origin-when-cross-origin`
- - `Permissions-Policy: camera=(), geolocation=(), microphone=()`
- - `Cross-Origin-Opener-Policy: same-origin`
- - `Cross-Origin-Resource-Policy: same-origin`
- - `Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'`
-
-Note: CSP is set in Report-Only mode to avoid breaking Juice Shop functionality.
-
-⏱️ ~10 minutes
-
-#### 2.1: Verify headers (HTTP)
-```bash
-curl -sI http://localhost:8080/ | tee analysis/headers-http.txt
-```
-
-#### 2.2: Verify headers (after TLS in Task 3)
-```bash
-curl -skI https://localhost:8443/ | tee analysis/headers-https.txt
-```
-
-In `labs/submission11.md`, document:
-
-**Task 2 Requirements:**
- - Paste relevant security headers from `headers-https.txt`
- - For each header, explain what it protects against:
- - **X-Frame-Options**: ---
- - **X-Content-Type-Options**: ---
- - **Strict-Transport-Security (HSTS)**: ---
- - **Referrer-Policy**: ---
- - **Permissions-Policy**: ---
- - **COOP/CORP**: ---
- - **CSP-Report-Only**: ---
----
-
-### Task 3 — TLS, HSTS, Rate Limiting & Timeouts (5 pts)
-⏱️ **Estimated time:** 20 minutes
-
-**Objective:** Confirm HTTPS and HSTS behavior, scan TLS, and validate rate limiting and timeouts to reduce brute-force and slowloris risks.
-
-#### 3.1: Scan TLS (testssl.sh)
-Use one of the following, depending on your OS:
-```bash
-# Linux: use host networking to reach localhost:8443
-docker run --rm --network host drwetter/testssl.sh:latest https://localhost:8443 \
- | tee analysis/testssl.txt
-
-# Mac/Windows (Docker Desktop): target host.docker.internal
-docker run --rm drwetter/testssl.sh:latest https://host.docker.internal:8443 \
- | tee analysis/testssl.txt
-```
-
----
-
-#### 3.2: Validate rate limiting on login
-Login rate limit is configured on `/rest/user/login` with Nginx `limit_req` and `limit_req_status 429`.
-
-##### Trigger rate limiting
-```bash
-for i in $(seq 1 12); do \
- curl -sk -o /dev/null -w "%{http_code}\n" \
- -H 'Content-Type: application/json' \
- -X POST https://localhost:8443/rest/user/login \
- -d '{"email":"a@a","password":"a"}'; \
-done | tee analysis/rate-limit-test.txt
-```
-Expected: Some responses return `429` once the burst+rate thresholds are exceeded.
-
-In `labs/submission11.md`, document:
-
-**Task 3 Requirements:**
-- TLS/testssl summary:
- - Summarize TLS protocol support from testssl scan (which versions are enabled)
- - List cipher suites that are supported
- - Explain why TLSv1.2+ is required (prefer TLSv1.3)
- - Note any warnings or vulnerabilities from testssl output
- - Confirm HSTS header appears only on HTTPS responses (not HTTP)
-
-Note on dev certificates: On localhost you should still expect these “NOT ok” items with a self‑signed cert: chain of trust (self‑signed), OCSP/CRL/CT/CAA, and OCSP stapling not offered. To eliminate them, either trust a local CA (e.g., mkcert) or use a real domain and a public CA (e.g., Let’s Encrypt) and then enable OCSP stapling (comments in nginx.conf).
-
-- Rate limiting & timeouts:
- - Show rate-limit test output (how many 200s vs 429s)
- - Explain the rate limit configuration: `rate=10r/m`, `burst=5`, and why these values balance security vs usability
- - Explain timeout settings in nginx.conf: `client_body_timeout`, `client_header_timeout`, `proxy_read_timeout`, `proxy_send_timeout`, with trade-offs
- - Paste relevant lines from access.log showing 429 responses
-
----
-
-## Acceptance Criteria
-
-- ✅ Nginx reverse proxy running; Juice Shop not directly exposed
-- ✅ Security headers present over HTTP/HTTPS; HSTS only on HTTPS
-- ✅ TLS enabled and scanned; HSTS verified; outputs captured
-- ✅ Rate limiting returns 429 on excessive login attempts; logs captured; timeouts discussed
-- ✅ All outputs committed under `labs/lab11/`
-
----
-
-## Cleanup
-
-After completing the lab:
-
-```bash
-# Stop and remove containers
-cd labs/lab11 # if not already there
-docker compose down
-
-# Optional: Remove generated certificates
-# rm -rf labs/lab11/reverse-proxy/certs/*
-
-# Check disk space
-docker system df
-```
-
----
-
-## How to Submit
-
-1. Create a branch and push it to your fork:
-```bash
-git switch -c feature/lab11
-# create labs/submission11.md with your findings
-git add labs/lab11/ labs/submission11.md
-git commit -m "docs: add lab11 — nginx reverse proxy hardening"
-git push -u origin feature/lab11
-```
-2. Open a PR from your fork’s `feature/lab11` → course repo’s `main`.
-3. In the PR description include:
-```text
-- [x] Task 1 — Reverse proxy compose setup
-- [x] Task 2 — Security headers verification
-- [x] Task 3 — TLS + HSTS + rate limiting + timeouts (+ testssl)
-```
-4. Submit the PR URL via Moodle before the deadline.
-
----
-
-## Rubric (10 pts)
-
-| Criterion | Points |
-| ----------------------------------------------------- | -----: |
-| Task 1 — Reverse proxy compose setup | 2.0 |
-| Task 2 — Security headers (HTTP/HTTPS) | 3.0 |
-| Task 3 — TLS, HSTS, rate limiting & timeouts | 5.0 |
-| Total | 10.0 |
-
----
-
-## Guidelines
-
-- Keep app container internal; only expose Nginx ports to host
-- Use `add_header ... always;` so headers appear even on errors/redirects
-- Place HSTS only on HTTPS server blocks
-- Start CSP in Report-Only and iterate; Juice Shop is JS-heavy and can break under strict CSP
-- Choose rate limits that balance security and usability; document your rationale
-
-
-Resources
-
-- Nginx security headers: https://nginx.org/en/docs/http/ngx_http_headers_module.html
-- TLS config guidelines: https://ssl-config.mozilla.org/
-- testssl.sh: https://github.com/drwetter/testssl.sh
-- Permissions Policy: https://www.w3.org/TR/permissions-policy-1/
-
-
diff --git a/labs/lab11/docker-compose.yml b/labs/lab11/docker-compose.yml
deleted file mode 100644
index da5002c1..00000000
--- a/labs/lab11/docker-compose.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-services:
- juice:
- image: bkimminich/juice-shop:v19.0.0
- restart: unless-stopped
- expose:
- - "3000"
-
- nginx:
- image: nginx:stable-alpine
- restart: unless-stopped
- depends_on:
- - juice
- ports:
- - "8080:8080" # HTTP (will redirect to HTTPS)
- - "8443:8443" # HTTPS
- volumes:
- - ./reverse-proxy/nginx.conf:/etc/nginx/nginx.conf:ro
- - ./reverse-proxy/certs:/etc/nginx/certs:ro
- - ./logs:/var/log/nginx:rw
diff --git a/labs/lab11/reverse-proxy/nginx.conf b/labs/lab11/reverse-proxy/nginx.conf
deleted file mode 100644
index b90f6c47..00000000
--- a/labs/lab11/reverse-proxy/nginx.conf
+++ /dev/null
@@ -1,127 +0,0 @@
-user nginx;
-worker_processes auto;
-
-events { worker_connections 1024; }
-
-http {
- include /etc/nginx/mime.types;
- default_type application/octet-stream;
- sendfile on;
- keepalive_timeout 10;
- server_tokens off;
- gzip off;
-
- # Security-focused logs
- log_format security '$remote_addr - $remote_user [$time_local] '
- '"$request" $status $body_bytes_sent '
- '"$http_referer" "$http_user_agent" '
- 'rt=$request_time uct=$upstream_connect_time '
- 'urt=$upstream_response_time';
- access_log /var/log/nginx/access.log security;
- error_log /var/log/nginx/error.log warn;
-
- # Upstream app
- upstream juice {
- server juice:3000;
- keepalive 32;
- }
-
- # Rate limit zone for login
- # ~10 req/min per IP, burst of 5
- limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
- limit_req_status 429;
-
- map $http_upgrade $connection_upgrade { default upgrade; '' close; }
-
- # Common proxy settings
- proxy_set_header Host $host;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- proxy_set_header X-Forwarded-Proto $scheme;
- proxy_http_version 1.1;
- proxy_set_header Connection $connection_upgrade;
- proxy_set_header Upgrade $http_upgrade;
- # Prevent upstream TLS BREACH vector by disabling compression from upstream
- proxy_set_header Accept-Encoding "";
- proxy_read_timeout 30s;
- proxy_send_timeout 30s;
- proxy_connect_timeout 5s;
- proxy_hide_header X-Powered-By;
- # Hide upstream headers to avoid duplicates and enforce policy at the proxy
- proxy_hide_header X-Frame-Options;
- proxy_hide_header X-Content-Type-Options;
- proxy_hide_header Referrer-Policy;
- proxy_hide_header Permissions-Policy;
- proxy_hide_header Cross-Origin-Opener-Policy;
- proxy_hide_header Cross-Origin-Resource-Policy;
- proxy_hide_header Content-Security-Policy;
- proxy_hide_header Content-Security-Policy-Report-Only;
- proxy_hide_header Access-Control-Allow-Origin;
-
- # HTTP server (redirect to HTTPS)
- server {
- listen 8080;
- listen [::]:8080;
- server_name _;
-
- # Core headers (also on redirects)
- add_header X-Frame-Options "DENY" always;
- add_header X-Content-Type-Options "nosniff" always;
- add_header Referrer-Policy "strict-origin-when-cross-origin" always;
- add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
- add_header Cross-Origin-Opener-Policy "same-origin" always;
- add_header Cross-Origin-Resource-Policy "same-origin" always;
- add_header Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" always;
-
- return 308 https://$host:8443$request_uri;
- }
-
- # HTTPS server
- server {
- listen 8443 ssl;
- listen [::]:8443 ssl;
- http2 on;
- server_name _;
-
- ssl_certificate /etc/nginx/certs/localhost.crt;
- ssl_certificate_key /etc/nginx/certs/localhost.key;
- ssl_session_timeout 10m;
- ssl_session_cache shared:SSL:10m;
- ssl_protocols TLSv1.2 TLSv1.3;
- ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:EECDH+AESGCM:EDH+AESGCM";
- ssl_prefer_server_ciphers on;
- ssl_stapling off;
- # If using a publicly-trusted certificate, you may enable OCSP stapling:
- # ssl_stapling on;
- # ssl_stapling_verify on;
- # resolver 1.1.1.1 8.8.8.8 valid=300s;
- # resolver_timeout 5s;
- # ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
-
- client_max_body_size 2m;
- client_body_timeout 10s;
- client_header_timeout 10s;
- keepalive_timeout 10s;
- send_timeout 10s;
-
- # Security headers (include HSTS here only)
- add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
- add_header X-Frame-Options "DENY" always;
- add_header X-Content-Type-Options "nosniff" always;
- add_header Referrer-Policy "strict-origin-when-cross-origin" always;
- add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
- add_header Cross-Origin-Opener-Policy "same-origin" always;
- add_header Cross-Origin-Resource-Policy "same-origin" always;
- add_header Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" always;
-
- location = /rest/user/login {
- limit_req zone=login burst=5 nodelay;
- limit_req_log_level warn;
- proxy_pass http://juice;
- }
-
- location / {
- proxy_pass http://juice;
- }
- }
-}
diff --git a/labs/lab12.md b/labs/lab12.md
deleted file mode 100644
index 1bf1af41..00000000
--- a/labs/lab12.md
+++ /dev/null
@@ -1,401 +0,0 @@
-# Lab 12 — Kata Containers: VM-backed Container Sandboxing (Local)
-
-
-
-
-
-> Goal: Run OWASP Juice Shop under Kata Containers to experience VM-backed container isolation, compare it with the default runc runtime, and document security/operational trade-offs.
-> Deliverable: A PR from `feature/lab12` with `labs/submission12.md` containing setup evidence, runtime comparisons (runc vs kata), isolation tests, and a brief performance summary with recommendations.
-
----
-
-## Overview
-
-In this lab you will practice:
-- Installing/Configuring Kata Containers as a Docker/containerd runtime (Linux)
-- Running the same workload (Juice Shop) with `runc` vs `kata-runtime`
-- Observing isolation differences (guest kernel, process visibility, restricted operations)
-- Measuring basic performance characteristics and trade-offs
-
-> VM-backed sandboxes like Kata place each container/pod inside a lightweight VM, adding a strong isolation boundary while preserving container UX.
-
----
-
-## Prerequisites
-
-Before starting, ensure you have:
-- ✅ Linux host with hardware virtualization enabled (Intel VT-x or AMD-V)
- - Check: `egrep -c '(vmx|svm)' /proc/cpuinfo` (should return > 0)
- - Nested virtualization required if running inside a VM
-- ✅ containerd (1.7+) and nerdctl (1.7+) with root/sudo privileges
-- ✅ `jq`, `curl`, and `awk` installed
-- ✅ At least 4GB RAM and 10GB free disk space
-- ✅ ~60-90 minutes available (installation can take time)
-
-Install containerd + nerdctl (example on Debian/Ubuntu):
-```bash
-sudo apt-get update && sudo apt-get install -y containerd
-sudo containerd config default | sudo tee /etc/containerd/config.toml >/dev/null
-sudo systemctl enable --now containerd
-
-# Install nerdctl (binary)
-VER=2.2.0
-curl -fL -o /tmp/nerdctl.tgz "https://github.com/containerd/nerdctl/releases/download/v${VER}/nerdctl-${VER}-linux-amd64.tar.gz"
-sudo tar -C /usr/local/bin -xzf /tmp/nerdctl.tgz nerdctl && rm /tmp/nerdctl.tgz
-
-containerd --version
-sudo nerdctl --version
-
-# Prepare working directories
-mkdir -p labs/lab12/{setup,runc,kata,isolation,bench,analysis}
-```
-
-If you plan to use the Kata assets installer, ensure `zstd` is available for extracting the release tarball:
-```bash
-sudo apt-get install -y zstd jq
-```
-
----
-
-## Tasks
-
-### Task 1 — Install and Configure Kata (2 pts)
-⏱️ **Estimated time:** 20-30 minutes
-
-**Objective:** Install Kata and make it available to containerd (nerdctl) as `io.containerd.kata.v2`.
-
-#### 1.1: Install Kata
-
-- Build the Kata Rust runtime in a container and copy the shim to your host:
-
-```bash
-# Build inside a Rust container; output goes to labs/lab12/setup/kata-out/
-bash labs/lab12/setup/build-kata-runtime.sh
-
-# Install the shim onto your host PATH (requires sudo)
-sudo install -m 0755 labs/lab12/setup/kata-out/containerd-shim-kata-v2 /usr/local/bin/
-command -v containerd-shim-kata-v2 && containerd-shim-kata-v2 --version | tee labs/lab12/setup/kata-built-version.txt
-```
-
-Notes:
-- The runtime alone is not sufficient; Kata also needs a guest kernel + rootfs image. Prefer your distro packages for these artifacts, or follow the upstream docs to obtain them. If you already have Kata installed, replacing just the shim binary is typically sufficient for this lab.
-
-- Install Kata assets and default config (runtime-rs):
-```bash
-sudo bash labs/lab12/scripts/install-kata-assets.sh # downloads kata-static and wires configuration
-```
- - If you see an error like "load TOML config failed" when running a Kata container, it means the default configuration file is missing. The script above creates `/etc/kata-containers/runtime-rs/configuration.toml` pointing to the installed defaults.
-
-#### 1.2: Configure containerd + nerdctl
-- Enable `io.containerd.kata.v2` per Kata docs (Kata 3’s shim is `containerd-shim-kata-v2`).
-- Minimal config example for config version 3 (most current containerd):
-```toml
-[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.kata]
- runtime_type = 'io.containerd.kata.v2'
-```
- - Legacy configs may use:
-```toml
-[plugins.'io.containerd.grpc.v1.cri'.containerd.runtimes.kata]
- runtime_type = 'io.containerd.kata.v2'
-```
-
-Automated update (recommended):
-```bash
-sudo bash labs/lab12/scripts/configure-containerd-kata.sh # updates /etc/containerd/config.toml
-```
-- Restart and verify a test container:
-```bash
-sudo systemctl restart containerd
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 uname -a
-```
-
-In `labs/submission12.md`, document:
-
-**Task 1 Requirements:**
-- Show the shim `containerd-shim-kata-v2 --version`
-- Show a successful test run with `sudo nerdctl run --runtime io.containerd.kata.v2 ...`
-
----
-
-### Task 2 — Run and Compare Containers (runc vs kata) (3 pts)
-⏱️ **Estimated time:** 15-20 minutes
-
-**Objective:** Run workloads with both runtimes and compare their environments.
-
-#### 2.1: Start runc container (Juice Shop)
-```bash
-# runc (default under nerdctl) - full application
-sudo nerdctl run -d --name juice-runc -p 3012:3000 bkimminich/juice-shop:v19.0.0
-
-# Wait for readiness
-sleep 10
-curl -s -o /dev/null -w "juice-runc: HTTP %{http_code}\n" http://localhost:3012 | tee labs/lab12/runc/health.txt
-```
-
-#### 2.2: Run Kata containers (Alpine-based tests)
-
-> **Note:** Due to a known issue with nerdctl + Kata runtime-rs v3 and long-running detached containers,
-> we'll use short-lived Alpine containers for Kata demonstrations.
-
-```bash
-echo "=== Kata Container Tests ==="
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 uname -a | tee labs/lab12/kata/test1.txt
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 uname -r | tee labs/lab12/kata/kernel.txt
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 sh -c "grep 'model name' /proc/cpuinfo | head -1" | tee labs/lab12/kata/cpu.txt
-```
-
-#### 2.3: Kernel comparison (Key finding)
-
-```bash
-echo "=== Kernel Version Comparison ===" | tee labs/lab12/analysis/kernel-comparison.txt
-echo -n "Host kernel (runc uses this): " | tee -a labs/lab12/analysis/kernel-comparison.txt
-uname -r | tee -a labs/lab12/analysis/kernel-comparison.txt
-
-echo -n "Kata guest kernel: " | tee -a labs/lab12/analysis/kernel-comparison.txt
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 cat /proc/version | tee -a labs/lab12/analysis/kernel-comparison.txt
-```
-
-#### 2.4: CPU virtualization check
-
-```bash
-echo "=== CPU Model Comparison ===" | tee labs/lab12/analysis/cpu-comparison.txt
-echo "Host CPU:" | tee -a labs/lab12/analysis/cpu-comparison.txt
-grep "model name" /proc/cpuinfo | head -1 | tee -a labs/lab12/analysis/cpu-comparison.txt
-
-echo "Kata VM CPU:" | tee -a labs/lab12/analysis/cpu-comparison.txt
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 sh -c "grep 'model name' /proc/cpuinfo | head -1" | tee -a labs/lab12/analysis/cpu-comparison.txt
-```
-
-In `labs/submission12.md`, document:
-
-**Task 2 Requirements:**
-- Show juice-runc health check (HTTP 200 from port 3012)
-- Show Kata containers running successfully with `--runtime io.containerd.kata.v2`
-- Compare kernel versions:
- - runc uses host kernel (same as `uname -r`)
- - Kata uses separate guest kernel (6.12.47 or similar)
-- Compare CPU models (real vs virtualized)
-- Explain isolation implications:
- - **runc**: ?
- - **Kata**: ?
-
----
-
-### Task 3 — Isolation Tests (3 pts)
-⏱️ **Estimated time:** 15 minutes
-
-**Objective:** Observe and compare isolation characteristics between runc and Kata.
-
-#### 3.1: Kernel ring buffer (dmesg) access
-
-This demonstrates the most significant isolation difference:
-
-```bash
-echo "=== dmesg Access Test ===" | tee labs/lab12/isolation/dmesg.txt
-
-echo "Kata VM (separate kernel boot logs):" | tee -a labs/lab12/isolation/dmesg.txt
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 dmesg 2>&1 | head -5 | tee -a labs/lab12/isolation/dmesg.txt
-```
-
-**Key observation:** Kata containers show VM boot logs, proving they run in a separate kernel.
-
-#### 3.2: /proc filesystem visibility
-
-```bash
-echo "=== /proc Entries Count ===" | tee labs/lab12/isolation/proc.txt
-
-echo -n "Host: " | tee -a labs/lab12/isolation/proc.txt
-ls /proc | wc -l | tee -a labs/lab12/isolation/proc.txt
-
-echo -n "Kata VM: " | tee -a labs/lab12/isolation/proc.txt
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 sh -c "ls /proc | wc -l" | tee -a labs/lab12/isolation/proc.txt
-```
-
-#### 3.3: Network interfaces
-
-```bash
-echo "=== Network Interfaces ===" | tee labs/lab12/isolation/network.txt
-
-echo "Kata VM network:" | tee -a labs/lab12/isolation/network.txt
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 ip addr | tee -a labs/lab12/isolation/network.txt
-```
-
-#### 3.4: Kernel modules
-
-```bash
-echo "=== Kernel Modules Count ===" | tee labs/lab12/isolation/modules.txt
-
-echo -n "Host kernel modules: " | tee -a labs/lab12/isolation/modules.txt
-ls /sys/module | wc -l | tee -a labs/lab12/isolation/modules.txt
-
-echo -n "Kata guest kernel modules: " | tee -a labs/lab12/isolation/modules.txt
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 sh -c "ls /sys/module 2>/dev/null | wc -l" | tee -a labs/lab12/isolation/modules.txt
-```
-
-In `labs/submission12.md`, document:
-
-**Task 3 Requirements:**
-- Show dmesg output differences (Kata shows VM boot logs, proving separate kernel)
-- Compare /proc filesystem visibility
-- Show network interface configuration in Kata VM
-- Compare kernel module counts (host vs guest VM)
-- Explain isolation boundary differences:
- - **runc**: ?
- - **kata**: ?
-- Discuss security implications:
- - Container escape in runc = ?
- - Container escape in Kata = ?
-
----
-
-### Task 4 — Performance Comparison (2 pts)
-⏱️ **Estimated time:** 10 minutes
-
-**Objective:** Compare startup time and overhead between runc and Kata.
-
-#### 4.1: Container startup time comparison
-
-```bash
-echo "=== Startup Time Comparison ===" | tee labs/lab12/bench/startup.txt
-
-echo "runc:" | tee -a labs/lab12/bench/startup.txt
-time sudo nerdctl run --rm alpine:3.19 echo "test" 2>&1 | grep real | tee -a labs/lab12/bench/startup.txt
-
-echo "Kata:" | tee -a labs/lab12/bench/startup.txt
-time sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 echo "test" 2>&1 | grep real | tee -a labs/lab12/bench/startup.txt
-```
-
-#### 4.2: HTTP response latency (juice-runc only)
-
-```bash
-echo "=== HTTP Latency Test (juice-runc) ===" | tee labs/lab12/bench/http-latency.txt
-out="labs/lab12/bench/curl-3012.txt"
-: > "$out"
-
-for i in $(seq 1 50); do
- curl -s -o /dev/null -w "%{time_total}\n" http://localhost:3012/ >> "$out"
-done
-
-echo "Results for port 3012 (juice-runc):" | tee -a labs/lab12/bench/http-latency.txt
-awk '{s+=$1; n+=1} END {if(n>0) printf "avg=%.4fs min=%.4fs max=%.4fs n=%d\n", s/n, min, max, n}' \
- min=$(sort -n "$out" | head -1) max=$(sort -n "$out" | tail -1) "$out" | tee -a labs/lab12/bench/http-latency.txt
-```
-
-In `labs/submission12.md`, document:
-
-**Task 4 Requirements:**
-- Show startup time comparison (runc: <1s, Kata: 3-5s)
-- Show HTTP latency for juice-runc baseline
-- Analyze performance tradeoffs:
- - **Startup overhead**: ?
- - **Runtime overhead**: ?
- - **CPU overhead**: ?
-- Interpret when to use each:
- - **Use runc when**: ?
- - **Use Kata when**: ?
-
----
-
-## Acceptance Criteria
-
-- ✅ Kata shim installed and verified (`containerd-shim-kata-v2 --version`)
-- ✅ containerd configured; runtime `io.containerd.kata.v2` used for `juice-kata`
-- ✅ runc vs kata containers both reachable; environment differences captured
-- ✅ Isolation tests executed and results summarized
-- ✅ Basic latency snapshot recorded and discussed
-- ✅ All artifacts saved under `labs/lab12/` and committed
-
----
-
-## Known Issues and Troubleshooting
-
-### nerdctl + Kata runtime-rs detached container issue
-
-**Symptom:** Long-running detached containers fail with:
-```
-FATA[0001] failed to create shim task: Others("failed to handle message create container
-Caused by:
- 0: open stdout
- 1: No such file or directory (os error 2)
-```
-
-**Root Cause:** Race condition in logging initialization between nerdctl and Kata runtime-rs v3.
-
-**Workarounds:**
-1. Use short-lived/interactive containers (as in this lab)
-2. Use Kubernetes with Kata (fully supported)
-3. Use Docker with older Kata versions
-4. Use containerd's `ctr` command directly
-
-**Status:** Known issue, fix expected in future releases.
-
-### Verifying Kata is working
-
-If you encounter issues, verify Kata basics:
-
-```bash
-# Test simple execution
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 echo "Kata works"
-
-# Check kernel version (should be 6.12.47 or similar, NOT your host kernel)
-sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 uname -r
-
-# Check Kata shim
-ls -la /usr/local/bin/containerd-shim-kata-v2
-containerd-shim-kata-v2 --version
-
-# Check containerd logs
-sudo journalctl -u containerd -n 50 --no-pager | grep -i kata
-```
-
----
-
-## How to Submit
-
-1. Create a branch and push it to your fork:
-```bash
-git switch -c feature/lab12
-# create labs/submission12.md with your findings
-git add labs/lab12/ labs/submission12.md
-git commit -m "docs: add lab12 — kata containers sandboxing"
-git push -u origin feature/lab12
-```
-2. Open a PR from your fork’s `feature/lab12` → course repo’s `main`.
-3. In the PR description include:
-```text
-- [x] Task 1 — Kata install + runtime config
-- [x] Task 2 — runc vs kata runtime comparison
-- [x] Task 3 — Isolation tests
-- [x] Task 4 — Basic performance snapshot
-```
-4. Submit the PR URL via Moodle before the deadline.
-
----
-
-## Rubric (10 pts)
-
-| Criterion | Points |
-| ------------------------------------------------------ | -----: |
-| Task 1 — Install + Configure Kata | 2.0 |
-| Task 2 — Run and Compare (runc vs kata) | 3.0 |
-| Task 3 — Isolation Tests | 3.0 |
-| Task 4 — Performance Snapshot | 2.0 |
-| Total | 10.0 |
-
----
-
-## Guidelines
-
-- Prefer non-privileged containers; avoid `--privileged` unless a test explicitly calls for it
-- Use containerd+nerdctl with `io.containerd.kata.v2` per Kata 3 docs (Docker `--runtime=kata` is legacy)
-- Nested virtualization must be enabled if inside a VM (check your cloud provider or hypervisor settings)
-- Use clear, concise evidence in `submission12.md` and focus your analysis on isolation trade-offs vs operational overhead
-
-
-References
-
-- Kata Containers: https://github.com/kata-containers/kata-containers
-- Install docs (Kata 3): https://github.com/kata-containers/kata-containers/tree/main/docs/install
-- containerd runtime config: https://github.com/kata-containers/kata-containers/tree/main/docs
-
-
diff --git a/labs/lab12/scripts/configure-containerd-kata.sh b/labs/lab12/scripts/configure-containerd-kata.sh
deleted file mode 100755
index 163133af..00000000
--- a/labs/lab12/scripts/configure-containerd-kata.sh
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# configure-containerd-kata.sh
-# Idempotently ensure containerd has the Kata runtime configured:
-# [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata]
-# runtime_type = "io.containerd.kata.v2"
-#
-# Usage:
-# sudo bash labs/lab12/scripts/configure-containerd-kata.sh
-
-CONF_DEFAULT="/etc/containerd/config.toml"
-# Allow override via $CONF or first CLI arg
-CONF="${CONF:-${1:-$CONF_DEFAULT}}"
-TMP=$(mktemp)
-
-backup() {
- if [ -f "$CONF" ]; then
- cp -a "$CONF" "${CONF}.$(date +%Y%m%d%H%M%S).bak"
- fi
-}
-
-ensure_default() {
- if [ ! -s "$CONF" ]; then
- echo "Generating default containerd config at $CONF" >&2
- mkdir -p "$(dirname "$CONF")"
- containerd config default > "$CONF"
- fi
-}
-
-detect_header() {
- # Prefer v3 split-CRI path if present; otherwise fallback to grpc path
- if grep -q "^\[plugins\.'io\.containerd\.cri\.v1\.runtime'\]" "$CONF"; then
- echo "[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.kata]"
- else
- echo "[plugins.'io.containerd.grpc.v1.cri'.containerd.runtimes.kata]"
- fi
-}
-
-insert_or_update_kata() {
- local header
- header=$(detect_header)
- local value=" runtime_type = 'io.containerd.kata.v2'"
-
- # Process file: update runtime_type inside the kata table if it exists,
- # otherwise append a new table at the end.
- awk -v hdr="$header" -v val="$value" '
- BEGIN { inside=0; updated=0 }
- {
- if ($0 == hdr) {
- print $0; inside=1; next
- }
- if (inside) {
- if ($0 ~ /^\[/) {
- if (!updated) print val
- inside=0
- print $0
- next
- }
- if ($0 ~ /^\s*runtime_type\s*=\s*/){
- print val; updated=1; next
- }
- print $0; next
- }
- print $0
- }
- END {
- if (inside && !updated) {
- print val
- } else if (!inside && NR > 0) {
- # Check if header ever appeared; if not, append it.
- # We can infer by searching the output later, but simpler: do a second pass.
- }
- }
- ' "$CONF" > "$TMP"
-
- if ! grep -qF "$header" "$TMP"; then
- {
- printf '\n%s\n%s\n' "$header" "$value"
- } >> "$TMP"
- fi
-
- install -m 0644 "$TMP" "$CONF"
-}
-
-main() {
- backup
- ensure_default
- insert_or_update_kata
- echo "Updated $CONF with Kata runtime: io.containerd.kata.v2" >&2
- echo "Restart containerd to apply: sudo systemctl restart containerd" >&2
-}
-
-main "$@"
diff --git a/labs/lab12/scripts/install-kata-assets.sh b/labs/lab12/scripts/install-kata-assets.sh
deleted file mode 100755
index c3c586d9..00000000
--- a/labs/lab12/scripts/install-kata-assets.sh
+++ /dev/null
@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# install-kata-assets.sh
-# Download and install Kata Containers static assets (kernel, rootfs image,
-# default runtime-rs configuration) under /opt/kata, and ensure a
-# configuration file exists in an expected path for runtime-rs.
-#
-# Usage:
-# sudo bash labs/lab12/scripts/install-kata-assets.sh [KATA_VER]
-#
-# Notes:
-# - Requires: curl, jq, tar (with zstd support), and root privileges.
-# - Creates or updates a symlink at:
-# /etc/kata-containers/runtime-rs/configuration.toml
-# pointing to the installed default configuration.
-
-VER_ARG=${1:-}
-ARCH=$(uname -m)
-case ${ARCH} in
- x86_64) ARCH=amd64 ;;
- aarch64|arm64) ARCH=arm64 ;;
- *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
-esac
-
-if [[ -n "${VER_ARG}" ]]; then
- KATA_VER=$(echo "${VER_ARG}" | sed -E 's/^v//')
-else
- KATA_VER=$(curl -fsSL https://api.github.com/repos/kata-containers/kata-containers/releases/latest | jq -r .tag_name)
- KATA_VER=${KATA_VER#v}
-fi
-
-ASSET_URL="https://github.com/kata-containers/kata-containers/releases/download/${KATA_VER}/kata-static-${KATA_VER}-${ARCH}.tar.zst"
-
-echo "Installing Kata static assets ${KATA_VER} for ${ARCH}" >&2
-TMP_TAR=$(mktemp --suffix=.tar.zst)
-curl -fL -o "${TMP_TAR}" "${ASSET_URL}"
-
-# Extract to root; archive lays files under /opt/kata, /usr/local/bin, etc.
-# Prefer explicit decompressor if available to avoid tar invoking external zstd unexpectedly.
-if command -v zstd >/dev/null 2>&1; then
- zstd -d -c "${TMP_TAR}" | tar -xf - -C /
-elif command -v unzstd >/dev/null 2>&1; then
- unzstd -c "${TMP_TAR}" | tar -xf - -C /
-elif tar --help 2>/dev/null | grep -q -- '--zstd'; then
- tar --zstd -xf "${TMP_TAR}" -C /
-else
- echo "Missing zstd support to extract ${TMP_TAR}." >&2
- echo "Install the zstd package (e.g., sudo apt-get update && sudo apt-get install -y zstd) and re-run." >&2
- exit 1
-fi
-rm -f "${TMP_TAR}"
-
-# Link configuration to an expected path for runtime-rs
-sudo mkdir -p /etc/kata-containers/runtime-rs
-SRC_CANDIDATES=(
- "/opt/kata/share/defaults/kata-containers/runtime-rs/configuration-dragonball.toml"
- "/opt/kata/share/defaults/kata-containers/configuration-dragonball.toml"
- "/opt/kata/share/defaults/kata-containers/runtime-rs/configuration.toml"
- "/usr/share/defaults/kata-containers/runtime-rs/configuration.toml"
-)
-
-for src in "${SRC_CANDIDATES[@]}"; do
- if [[ -f "$src" ]]; then
- ln -sf "$src" /etc/kata-containers/runtime-rs/configuration.toml
- echo "Linked runtime-rs config -> $src" >&2
- break
- fi
-done
-
-if [[ ! -f /etc/kata-containers/runtime-rs/configuration.toml ]]; then
- echo "Warning: could not find a default runtime-rs configuration in known locations." >&2
- echo "Check /opt/kata/share/defaults/kata-containers/ and create: /etc/kata-containers/runtime-rs/configuration.toml" >&2
- exit 1
-fi
-
-echo "Kata assets installed. Restart containerd and test a kata container." >&2
-echo " sudo systemctl restart containerd" >&2
-echo " sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 uname -a" >&2
diff --git a/labs/lab12/setup/build-kata-runtime.sh b/labs/lab12/setup/build-kata-runtime.sh
deleted file mode 100644
index b909a410..00000000
--- a/labs/lab12/setup/build-kata-runtime.sh
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Build Kata Containers 3.x Rust runtime (containerd-shim-kata-v2)
-# inside a temporary Rust toolchain container, and place the binary
-# into the provided output directory. This avoids installing build
-# dependencies on the host.
-#
-# Usage:
-# bash labs/lab12/setup/build-kata-runtime.sh
-# # result: labs/lab12/setup/kata-out/containerd-shim-kata-v2
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")"/../.. && pwd)"
-WORK_DIR="${ROOT_DIR}/lab12/setup/kata-build"
-OUT_DIR="${ROOT_DIR}/lab12/setup/kata-out"
-
-mkdir -p "${WORK_DIR}" "${OUT_DIR}"
-
-echo "Building Kata runtime in Docker..." >&2
-docker run --rm \
- -e CARGO_NET_GIT_FETCH_WITH_CLI=true \
- -v "${WORK_DIR}":/work \
- -v "${OUT_DIR}":/out \
- rust:1.75-bookworm bash -lc '
- set -euo pipefail
- apt-get update && apt-get install -y --no-install-recommends \
- git make gcc pkg-config ca-certificates musl-tools libseccomp-dev && \
- update-ca-certificates || true
-
- # Ensure cargo/rustup are available
- export PATH=/usr/local/cargo/bin:$PATH
- rustc --version; cargo --version; rustup --version || true
-
- cd /work
- if [ ! -d kata-containers ]; then
- git clone --depth 1 https://github.com/kata-containers/kata-containers.git
- fi
- cd kata-containers/src/runtime-rs
-
- # Add MUSL target for static build expected by runtime Makefile
- rustup target add x86_64-unknown-linux-musl || true
-
- # Build the runtime (shim v2)
- make
-
- # Collect the produced binary
- f=$(find target -type f -name containerd-shim-kata-v2 | head -n1)
- if [ -z "$f" ]; then
- echo "ERROR: built binary not found" >&2; exit 1
- fi
- install -m 0755 "$f" /out/containerd-shim-kata-v2
- strip /out/containerd-shim-kata-v2 || true
- /out/containerd-shim-kata-v2 --version || true
- '
-
-echo "Done. Binary saved to: ${OUT_DIR}/containerd-shim-kata-v2" >&2
diff --git a/labs/lab2.md b/labs/lab2.md
deleted file mode 100644
index e66fb964..00000000
--- a/labs/lab2.md
+++ /dev/null
@@ -1,189 +0,0 @@
-# Lab 2 — Threat Modeling with Threagile
-
-
--blue)
-
-
-> **Goal:** Model OWASP Juice Shop (`bkimminich/juice-shop:v19.0.0`) deployment and generate an automation-first threat model with Threagile.
-> **Deliverable:** A PR from `feature/lab2` to the course repo with `labs/submission2.md` containing Threagile outputs and risk analysis. Submit the PR link via Moodle.
-
----
-
-## Overview
-
-In this lab you will practice:
-- Creating an **as-code** model with **Threagile** and automatically generating **risk reports + diagrams** from YAML
-- Making security-relevant model changes and demonstrating how they **impact the risk landscape**
-- Analyzing threat model outputs and documenting security findings systematically
-
-> Keep using the Juice Shop from Lab 1 (`:19.0.0`) as your target application.
-
----
-
-## Tasks
-
-### Task 1 — Threagile Baseline Model (6 pts)
-
-**Objective:** Use the provided Threagile model to generate a PDF report + diagrams and analyze the baseline risk posture.
-
-#### 1.1: Generate Baseline Threat Model
-
-```bash
-mkdir -p labs/lab2/baseline labs/lab2/secure
-
-docker run --rm -v "$(pwd)":/app/work threagile/threagile \
- -model /app/work/labs/lab2/threagile-model.yaml \
- -output /app/work/labs/lab2/baseline \
- -generate-risks-excel=false -generate-tags-excel=false
-```
-
-#### 1.2: Verify Generated Outputs
-
-Expected files in `labs/lab2/baseline/`:
-- `report.pdf` — full PDF report (includes diagrams)
-- Diagrams: data-flow & data-asset diagrams (PNG)
-- Risk exports: `risks.json`, `stats.json`, `technical-assets.json`
-
-#### 1.3: Risk Analysis and Documentation
-
-Calculate composite scores using these weights:
-- Severity: critical (5) > elevated (4) > high (3) > medium (2) > low (1)
-- Likelihood: very-likely (4) > likely (3) > possible (2) > unlikely (1)
-- Impact: high (3) > medium (2) > low (1)
-- **Composite score** = `Severity*100 + Likelihood*10 + Impact`
-
-In `labs/submission2.md`, document:
-- **Top 5 Risks** table with Severity, Category, Asset, Likelihood, Impact
-- Risk ranking methodology and composite score calculations
-- Analysis of critical security concerns identified
-- Screenshots or references to generated diagrams
-
----
-
-### Task 2 — HTTPS Variant & Risk Comparison (4 pts)
-
-**Objective:** Create a secure variant of the model and demonstrate how security controls affect the threat landscape.
-
-#### 2.1: Create Secure Model Variant
-
-Copy the baseline model and make these specific changes:
-- **User Browser → communication_links → Direct to App**: set `protocol: https`
-- **Reverse Proxy → communication_links**: set `protocol: https`
-- **Persistent Storage**: set `encryption: transparent`
-- Save as: `labs/lab2/threagile-model.secure.yaml`
-
-#### 2.2: Generate Secure Variant Analysis
-
-```bash
-docker run --rm -v "$(pwd)":/app/work threagile/threagile \
- -model /app/work/labs/lab2/threagile-model.secure.yaml \
- -output /app/work/labs/lab2/secure \
- -generate-risks-excel=false -generate-tags-excel=false
-```
-
-#### 2.3: Generate Risk Comparison
-
-```bash
-jq -n \
- --slurpfile b labs/lab2/baseline/risks.json \
- --slurpfile s labs/lab2/secure/risks.json '
-def tally(x):
-(x | group_by(.category) | map({ (.[0].category): length }) | add) // {};
-(tally($b[0])) as $B |
-(tally($s[0])) as $S |
-(($B + $S) | keys | sort) as $cats |
-[
-"| Category | Baseline | Secure | Δ |",
-"|---|---:|---:|---:|"
-] + (
-$cats | map(
-"| " + . + " | " +
-(($B[.] // 0) | tostring) + " | " +
-(($S[.] // 0) | tostring) + " | " +
-(((($S[.] // 0) - ($B[.] // 0))) | tostring) + " |"
-)
-) | .[]'
-```
-
-In `labs/submission2.md`, document:
-- **Risk Category Delta Table** (Baseline vs Secure vs Δ)
-- **Delta Run Explanation** covering:
- - Specific changes made to the model
- - Observed results in risk categories
- - Analysis of why these changes reduced/modified risks
-- Comparison of diagrams between baseline and secure variants
-
----
-
-## How to Submit
-
-1. Create a branch for this lab and push it to your fork:
-
- ```bash
- git switch -c feature/lab2
- # create labs/submission2.md with your findings
- git add labs/submission2.md labs/lab2/
- git commit -m "docs: add lab2 submission"
- git push -u origin feature/lab2
- ```
-
-2. Open a PR from your fork's `feature/lab2` branch → **course repository's main branch**.
-
-3. In the PR description, include:
-
- ```text
- - [x] Task 1 done — Threagile baseline model + risk analysis
- - [x] Task 2 done — HTTPS variant + risk comparison
- ```
-
-4. **Copy the PR URL** and submit it via **Moodle before the deadline**.
-
----
-
-## Acceptance Criteria
-
-- ✅ Branch `feature/lab2` exists with commits for each task
-- ✅ File `labs/submission2.md` contains required analysis for Tasks 1-2
-- ✅ Threagile baseline and secure models successfully generated
-- ✅ Both `labs/lab2/baseline/` and `labs/lab2/secure/` folders contain complete outputs
-- ✅ Top 5 risks analysis and risk category delta comparison documented
-- ✅ PR from `feature/lab2` → **course repo main branch** is open
-- ✅ PR link submitted via Moodle before the deadline
-
----
-
-## Rubric (10 pts)
-
-| Criterion | Points |
-| ------------------------------------------------------------ | -----: |
-| Task 1 — Threagile baseline model + risk analysis | **6** |
-| Task 2 — HTTPS variant + risk comparison analysis | **4** |
-| **Total** | **10** |
-
----
-
-## Guidelines
-
-- Use clear Markdown headers to organize sections in `submission2.md`
-- Include both command outputs and written analysis for each task
-- Document threat modeling process and security findings systematically
-- Ensure all generated artifacts are properly committed to the repository
-
-
-Threat Modeling Notes
-
-- Model exactly the architecture you're running from Lab 1 (localhost deployment)
-- Use consistent asset/link names between baseline and secure models for accurate diffs
-- Focus on actionable security insights rather than comprehensive risk catalogs
-
-
-
-
-Technical Tips
-
-- Verify report PDFs open correctly and diagrams render properly
-- Use the provided jq command exactly as shown for consistent delta tables
-- Keep explanations concise—one-page summaries are more valuable than detailed reports
-- Check that Threagile Docker container has proper file permissions for output generation
-
-
diff --git a/labs/lab2/baseline/data-asset-diagram.png b/labs/lab2/baseline/data-asset-diagram.png
new file mode 100644
index 00000000..4457d768
Binary files /dev/null and b/labs/lab2/baseline/data-asset-diagram.png differ
diff --git a/labs/lab2/baseline/data-flow-diagram.png b/labs/lab2/baseline/data-flow-diagram.png
new file mode 100644
index 00000000..a8803816
Binary files /dev/null and b/labs/lab2/baseline/data-flow-diagram.png differ
diff --git a/labs/lab2/baseline/report.pdf b/labs/lab2/baseline/report.pdf
new file mode 100644
index 00000000..4eb1adb8
Binary files /dev/null and b/labs/lab2/baseline/report.pdf differ
diff --git a/labs/lab2/baseline/risks.json b/labs/lab2/baseline/risks.json
new file mode 100644
index 00000000..21c99d9b
--- /dev/null
+++ b/labs/lab2/baseline/risks.json
@@ -0,0 +1 @@
+[{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unencrypted-asset@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"unencrypted-asset@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"missing-identity-store","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Identity Store\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eReverse Proxy\u003c/b\u003e as an example)","synthetic_id":"missing-identity-store@reverse-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@user-browser","most_relevant_data_asset":"","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"cross-site-scripting","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"cross-site-scripting@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@user-browser\u003edirect-to-app-no-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"container-baseimage-backdooring","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eContainer Base Image Backdooring\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"container-baseimage-backdooring@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-build-infrastructure","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Build Infrastructure\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-build-infrastructure@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"missing-waf","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eMissing Web Application Firewall (WAF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-waf@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"unencrypted-communication","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"high","title":"\u003cb\u003eUnencrypted Communication\u003c/b\u003e named \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e between \u003cb\u003eUser Browser\u003c/b\u003e and \u003cb\u003eJuice Shop Application\u003c/b\u003e transferring authentication data (like credentials, token, session-id, etc.)","synthetic_id":"unencrypted-communication@user-browser\u003edirect-to-app-no-proxy@user-browser@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"unencrypted-communication","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Communication\u003c/b\u003e named \u003cb\u003eTo App\u003c/b\u003e between \u003cb\u003eReverse Proxy\u003c/b\u003e and \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unencrypted-communication@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@user-browser\u003edirect-to-app-no-proxy@user-browser@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e forwarded via \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-hardening@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"missing-hardening@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"missing-authentication","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@juice-shop","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@reverse-proxy","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e server-side web-requesting the target \u003cb\u003eWebhook Endpoint\u003c/b\u003e via \u003cb\u003eTo Challenge WebHook\u003c/b\u003e","synthetic_id":"server-side-request-forgery@juice-shop@webhook-endpoint@juice-shop\u003eto-challenge-webhook","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"juice-shop\u003eto-challenge-webhook","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eReverse Proxy\u003c/b\u003e server-side web-requesting the target \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e","synthetic_id":"server-side-request-forgery@reverse-proxy@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["reverse-proxy"]},{"category":"missing-vault","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Vault (Secret Storage)\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-vault@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]}]
\ No newline at end of file
diff --git a/labs/lab2/baseline/stats.json b/labs/lab2/baseline/stats.json
new file mode 100644
index 00000000..88cd78be
--- /dev/null
+++ b/labs/lab2/baseline/stats.json
@@ -0,0 +1 @@
+{"risks":{"critical":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"elevated":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":4},"high":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"low":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":5},"medium":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":14}}}
\ No newline at end of file
diff --git a/labs/lab2/baseline/technical-assets.json b/labs/lab2/baseline/technical-assets.json
new file mode 100644
index 00000000..45457f1e
--- /dev/null
+++ b/labs/lab2/baseline/technical-assets.json
@@ -0,0 +1 @@
+{"juice-shop":{"Id":"juice-shop","Title":"Juice Shop Application","Description":"OWASP Juice Shop server (Node.js/Express, v19.0.0).","Usage":0,"Type":1,"Size":2,"Technology":6,"Machine":2,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":true,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"In-scope web application (contains all business logic and vulnerabilities by design).","Tags":["app","nodejs"],"DataAssetsProcessed":["user-accounts","orders","product-catalog","tokens-sessions"],"DataAssetsStored":["logs"],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"juice-shop\u003eto-challenge-webhook","SourceId":"juice-shop","TargetId":"webhook-endpoint","Title":"To Challenge WebHook","Description":"Optional outbound callback (HTTP POST) to external WebHook when a challenge is solved.","Protocol":2,"Tags":["egress"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["orders"],"DataAssetsReceived":null,"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":70.02881844380403},"persistent-storage":{"Id":"persistent-storage","Title":"Persistent Storage","Description":"Host-mounted volume for database, file uploads, and logs.","Usage":1,"Type":2,"Size":3,"Technology":10,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Local disk storage for the container – not directly exposed, but if compromised it contains sensitive data (database and logs).","Tags":["storage","volume"],"DataAssetsProcessed":[],"DataAssetsStored":["logs","user-accounts","orders","product-catalog"],"DataFormatsAccepted":[3],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":100},"reverse-proxy":{"Id":"reverse-proxy","Title":"Reverse Proxy","Description":"Optional reverse proxy (e.g., Nginx) for TLS termination and adding security headers.","Usage":0,"Type":1,"Size":2,"Technology":20,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":1,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Not exposed to internet directly; improves security of inbound traffic.","Tags":["optional","proxy"],"DataAssetsProcessed":["product-catalog","tokens-sessions"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"reverse-proxy\u003eto-app","SourceId":"reverse-proxy","TargetId":"juice-shop","Title":"To App","Description":"Proxy forwarding to app (HTTP on 3000 internally).","Protocol":1,"Tags":[],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":9.623538157950035},"user-browser":{"Id":"user-browser","Title":"User Browser","Description":"End-user web browser (client).","Usage":0,"Type":0,"Size":0,"Technology":2,"Machine":1,"Internet":true,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":true,"Encryption":0,"JustificationOutOfScope":"","Owner":"External User","Confidentiality":0,"Integrity":1,"Availability":1,"JustificationCiaRating":"Client controlled by end user (potentially an attacker).","Tags":["actor","user"],"DataAssetsProcessed":[],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"user-browser\u003eto-reverse-proxy-preferred","SourceId":"user-browser","TargetId":"reverse-proxy","Title":"To Reverse Proxy (preferred)","Description":"User browser to reverse proxy (HTTPS on 443).","Protocol":2,"Tags":["primary"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true},{"Id":"user-browser\u003edirect-to-app-no-proxy","SourceId":"user-browser","TargetId":"juice-shop","Title":"Direct to App (no proxy)","Description":"Direct browser access to app (HTTP on 3000).","Protocol":1,"Tags":["direct"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":25.859639506459924},"webhook-endpoint":{"Id":"webhook-endpoint","Title":"Webhook Endpoint","Description":"External WebHook service (3rd-party, if configured for integrations).","Usage":0,"Type":0,"Size":0,"Technology":14,"Machine":1,"Internet":true,"MultiTenant":true,"Redundant":true,"CustomDevelopedParts":false,"OutOfScope":true,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"Third-party service to receive notifications (not under our control).","Owner":"Third-Party","Confidentiality":1,"Integrity":1,"Availability":1,"JustificationCiaRating":"External service that receives data (like order or challenge info). Treated as a trusted integration point but could be abused if misconfigured.","Tags":["saas","webhook"],"DataAssetsProcessed":["orders"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":1}}
\ No newline at end of file
diff --git a/labs/lab2/secure/data-asset-diagram.png b/labs/lab2/secure/data-asset-diagram.png
new file mode 100644
index 00000000..aacf4016
Binary files /dev/null and b/labs/lab2/secure/data-asset-diagram.png differ
diff --git a/labs/lab2/secure/data-flow-diagram.png b/labs/lab2/secure/data-flow-diagram.png
new file mode 100644
index 00000000..5ead09e2
Binary files /dev/null and b/labs/lab2/secure/data-flow-diagram.png differ
diff --git a/labs/lab2/secure/report.pdf b/labs/lab2/secure/report.pdf
new file mode 100644
index 00000000..b830f7fe
Binary files /dev/null and b/labs/lab2/secure/report.pdf differ
diff --git a/labs/lab2/secure/risks.json b/labs/lab2/secure/risks.json
new file mode 100644
index 00000000..2088ecaa
--- /dev/null
+++ b/labs/lab2/secure/risks.json
@@ -0,0 +1 @@
+[{"category":"missing-vault","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Vault (Secret Storage)\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-vault@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@user-browser\u003edirect-to-app-no-proxy@user-browser@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e forwarded via \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@user-browser","most_relevant_data_asset":"","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"container-baseimage-backdooring","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eContainer Base Image Backdooring\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"container-baseimage-backdooring@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-build-infrastructure","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Build Infrastructure\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-build-infrastructure@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unencrypted-asset@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-identity-store","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Identity Store\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eReverse Proxy\u003c/b\u003e as an example)","synthetic_id":"missing-identity-store@reverse-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"cross-site-scripting","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"cross-site-scripting@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e server-side web-requesting the target \u003cb\u003eWebhook Endpoint\u003c/b\u003e via \u003cb\u003eTo Challenge WebHook\u003c/b\u003e","synthetic_id":"server-side-request-forgery@juice-shop@webhook-endpoint@juice-shop\u003eto-challenge-webhook","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"juice-shop\u003eto-challenge-webhook","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eReverse Proxy\u003c/b\u003e server-side web-requesting the target \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e","synthetic_id":"server-side-request-forgery@reverse-proxy@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["reverse-proxy"]},{"category":"missing-waf","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eMissing Web Application Firewall (WAF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-waf@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-authentication","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@juice-shop","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@reverse-proxy","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@user-browser\u003edirect-to-app-no-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-hardening@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"missing-hardening@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]}]
\ No newline at end of file
diff --git a/labs/lab2/secure/stats.json b/labs/lab2/secure/stats.json
new file mode 100644
index 00000000..c19a18a6
--- /dev/null
+++ b/labs/lab2/secure/stats.json
@@ -0,0 +1 @@
+{"risks":{"critical":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"elevated":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":2},"high":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"low":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":5},"medium":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":13}}}
\ No newline at end of file
diff --git a/labs/lab2/secure/technical-assets.json b/labs/lab2/secure/technical-assets.json
new file mode 100644
index 00000000..a082acb4
--- /dev/null
+++ b/labs/lab2/secure/technical-assets.json
@@ -0,0 +1 @@
+{"juice-shop":{"Id":"juice-shop","Title":"Juice Shop Application","Description":"OWASP Juice Shop server (Node.js/Express, v19.0.0).","Usage":0,"Type":1,"Size":2,"Technology":6,"Machine":2,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":true,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"In-scope web application (contains all business logic and vulnerabilities by design).","Tags":["app","nodejs"],"DataAssetsProcessed":["user-accounts","orders","product-catalog","tokens-sessions"],"DataAssetsStored":["logs"],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"juice-shop\u003eto-challenge-webhook","SourceId":"juice-shop","TargetId":"webhook-endpoint","Title":"To Challenge WebHook","Description":"Optional outbound callback (HTTP POST) to external WebHook when a challenge is solved.","Protocol":2,"Tags":["egress"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["orders"],"DataAssetsReceived":null,"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":70.02881844380403},"persistent-storage":{"Id":"persistent-storage","Title":"Persistent Storage","Description":"Host-mounted volume for database, file uploads, and logs.","Usage":1,"Type":2,"Size":3,"Technology":10,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":1,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Local disk storage for the container – not directly exposed, but if compromised it contains sensitive data (database and logs).","Tags":["storage","volume"],"DataAssetsProcessed":[],"DataAssetsStored":["logs","user-accounts","orders","product-catalog"],"DataFormatsAccepted":[3],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":100},"reverse-proxy":{"Id":"reverse-proxy","Title":"Reverse Proxy","Description":"Optional reverse proxy (e.g., Nginx) for TLS termination and adding security headers.","Usage":0,"Type":1,"Size":2,"Technology":20,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":1,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Not exposed to internet directly; improves security of inbound traffic.","Tags":["optional","proxy"],"DataAssetsProcessed":["product-catalog","tokens-sessions"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"reverse-proxy\u003eto-app","SourceId":"reverse-proxy","TargetId":"juice-shop","Title":"To App","Description":"Proxy forwarding to app (HTTP on 3000 internally).","Protocol":2,"Tags":[],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":9.623538157950035},"user-browser":{"Id":"user-browser","Title":"User Browser","Description":"End-user web browser (client).","Usage":0,"Type":0,"Size":0,"Technology":2,"Machine":1,"Internet":true,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":true,"Encryption":0,"JustificationOutOfScope":"","Owner":"External User","Confidentiality":0,"Integrity":1,"Availability":1,"JustificationCiaRating":"Client controlled by end user (potentially an attacker).","Tags":["actor","user"],"DataAssetsProcessed":[],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"user-browser\u003eto-reverse-proxy-preferred","SourceId":"user-browser","TargetId":"reverse-proxy","Title":"To Reverse Proxy (preferred)","Description":"User browser to reverse proxy (HTTPS on 443).","Protocol":2,"Tags":["primary"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true},{"Id":"user-browser\u003edirect-to-app-no-proxy","SourceId":"user-browser","TargetId":"juice-shop","Title":"Direct to App (no proxy)","Description":"Direct browser access to app (HTTP on 3000).","Protocol":2,"Tags":["direct"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":25.859639506459924},"webhook-endpoint":{"Id":"webhook-endpoint","Title":"Webhook Endpoint","Description":"External WebHook service (3rd-party, if configured for integrations).","Usage":0,"Type":0,"Size":0,"Technology":14,"Machine":1,"Internet":true,"MultiTenant":true,"Redundant":true,"CustomDevelopedParts":false,"OutOfScope":true,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"Third-party service to receive notifications (not under our control).","Owner":"Third-Party","Confidentiality":1,"Integrity":1,"Availability":1,"JustificationCiaRating":"External service that receives data (like order or challenge info). Treated as a trusted integration point but could be abused if misconfigured.","Tags":["saas","webhook"],"DataAssetsProcessed":["orders"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":1}}
\ No newline at end of file
diff --git a/labs/lab2/threagile-model.secure.yaml b/labs/lab2/threagile-model.secure.yaml
new file mode 100644
index 00000000..d449bdfa
--- /dev/null
+++ b/labs/lab2/threagile-model.secure.yaml
@@ -0,0 +1,429 @@
+threagile_version: 1.0.0
+
+title: OWASP Juice Shop — Local Lab Threat Model
+date: 2025-09-18
+
+author:
+ name: Student Name
+ homepage: https://example.edu
+
+management_summary_comment: >
+ Threat model for a local OWASP Juice Shop setup. Users access the app
+ either directly via HTTP on port 3000 or through an optional reverse proxy that
+ terminates TLS and adds security headers. The app runs in a container
+ and writes data to a host-mounted volume (for database, uploads, logs).
+ Optional outbound notifications (e.g., a challenge-solution WebHook) can be configured for integrations.
+
+business_criticality: important # archive, operational, important, critical, mission-critical
+
+business_overview:
+ description: >
+ Training environment for DevSecOps. This model covers a deliberately vulnerable
+ web application (OWASP Juice Shop) running locally in a Docker container. The focus is on a minimal architecture, STRIDE threat analysis, and actionable mitigations for the identified risks.
+
+ images:
+ # - dfd.png: Data Flow Diagram (if exported from the tool)
+
+technical_overview:
+ description: >
+ A user’s web browser connects to the Juice Shop application (Node.js/Express server) either directly on **localhost:3000** (HTTP) or via a **reverse proxy** on ports 80/443 (with HTTPS). The Juice Shop server may issue outbound requests to external services (e.g., a configured **WebHook** for solved challenge notifications). All application data (the SQLite database, file uploads, logs) is stored on the host’s filesystem via a mounted volume. Key trust boundaries include the **Internet** (user & external services) → **Host** (local machine/VM) → **Container Network** (isolated app container).
+ images: []
+
+questions:
+ Do you expose port 3000 beyond localhost?: ""
+ Do you use a reverse proxy with TLS and security headers?: ""
+ Are any outbound integrations (webhooks) configured?: ""
+ Is any sensitive data stored in logs or files?: ""
+
+abuse_cases:
+ Credential Stuffing / Brute Force: >
+ Attackers attempt repeated login attempts to guess credentials or exhaust system resources.
+ Stored XSS via Product Reviews: >
+ Malicious scripts are inserted into product reviews, getting stored and executed in other users’ browsers.
+ SSRF via Outbound Requests: >
+ Server-side requests (e.g. profile image URL fetch or WebHook callback) are abused to access internal network resources.
+
+security_requirements:
+ TLS in transit: Enforce HTTPS for user traffic via a TLS-terminating reverse proxy with strong ciphers and certificate management.
+ AuthZ on sensitive routes: Implement strict server-side authorization checks (role/permission) on admin or sensitive functionalities.
+ Rate limiting & lockouts: Apply rate limiting and account lockout policies to mitigate brute-force and automated attacks on authentication and expensive operations.
+ Secure headers: Add security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, etc.) at the proxy or app to mitigate client-side attacks.
+ Secrets management: Protect secret keys and credentials (JWT signing keys, OAuth client secrets) – keep them out of code repos and avoid logging them.
+
+tags_available:
+ # Relevant technologies and environment tags
+ - docker
+ - nodejs
+ # Data and asset tags
+ - pii
+ - auth
+ - tokens
+ - logs
+ - public
+ - actor
+ - user
+ - optional
+ - proxy
+ - app
+ - storage
+ - volume
+ - saas
+ - webhook
+ # Communication tags
+ - primary
+ - direct
+ - egress
+
+# =========================
+# DATA ASSETS
+# =========================
+data_assets:
+
+ User Accounts:
+ id: user-accounts
+ description: "User profile data, credential hashes, emails."
+ usage: business
+ tags: ["pii", "auth"]
+ origin: user-supplied
+ owner: Lab Owner
+ quantity: many
+ confidentiality: confidential
+ integrity: critical
+ availability: important
+ justification_cia_rating: >
+ Contains personal identifiers and authentication data. High confidentiality is required to protect user privacy, and integrity is critical to prevent account takeovers.
+
+ Orders:
+ id: orders
+ description: "Order history, addresses, and payment metadata (no raw card numbers)."
+ usage: business
+ tags: ["pii"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: confidential
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ Contains users’ personal data and business transaction records. Integrity and confidentiality are important to prevent fraud or privacy breaches.
+
+ Product Catalog:
+ id: product-catalog
+ description: "Product information (names, descriptions, prices) available to all users."
+ usage: business
+ tags: ["public"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: public
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ Product data is intended to be public, but its integrity is important (to avoid defacement or price manipulation that could mislead users).
+
+ Tokens & Sessions:
+ id: tokens-sessions
+ description: "Session identifiers, JWTs for authenticated sessions, CSRF tokens."
+ usage: business
+ tags: ["auth", "tokens"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: confidential
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ If session tokens are compromised, attackers can hijack user sessions. They must be kept confidential and intact; availability is less critical (tokens can be reissued).
+
+ Logs:
+ id: logs
+ description: "Application and access logs (may inadvertently contain PII or secrets)."
+ usage: devops
+ tags: ["logs"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ Logs are for internal use (troubleshooting, monitoring). They should not be exposed publicly, and sensitive data should be sanitized to protect confidentiality.
+
+# =========================
+# TECHNICAL ASSETS
+# =========================
+technical_assets:
+
+ User Browser:
+ id: user-browser
+ description: "End-user web browser (client)."
+ type: external-entity
+ usage: business
+ used_as_client_by_human: true
+ out_of_scope: false
+ justification_out_of_scope:
+ size: system
+ technology: browser
+ tags: ["actor", "user"]
+ internet: true
+ machine: virtual
+ encryption: none
+ owner: External User
+ confidentiality: public
+ integrity: operational
+ availability: operational
+ justification_cia_rating: "Client controlled by end user (potentially an attacker)."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: false
+ data_assets_processed: []
+ data_assets_stored: []
+ data_formats_accepted:
+ - json
+ communication_links:
+ To Reverse Proxy (preferred):
+ target: reverse-proxy
+ description: "User browser to reverse proxy (HTTPS on 443)."
+ protocol: https
+ authentication: session-id
+ authorization: enduser-identity-propagation
+ tags: ["primary"]
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - tokens-sessions
+ data_assets_received:
+ - product-catalog
+ Direct to App (no proxy):
+ target: juice-shop
+ description: "Direct browser access to app (HTTP on 3000)."
+ protocol: https
+ authentication: session-id
+ authorization: enduser-identity-propagation
+ tags: ["direct"]
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - tokens-sessions
+ data_assets_received:
+ - product-catalog
+
+ Reverse Proxy:
+ id: reverse-proxy
+ description: "Optional reverse proxy (e.g., Nginx) for TLS termination and adding security headers."
+ type: process
+ usage: business
+ used_as_client_by_human: false
+ out_of_scope: false
+ justification_out_of_scope:
+ size: application
+ technology: reverse-proxy
+ tags: ["optional", "proxy"]
+ internet: false
+ machine: virtual
+ encryption: transparent
+ owner: Lab Owner
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: "Not exposed to internet directly; improves security of inbound traffic."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: false
+ data_assets_processed:
+ - product-catalog
+ - tokens-sessions
+ data_assets_stored: []
+ data_formats_accepted:
+ - json
+ communication_links:
+ To App:
+ target: juice-shop
+ description: "Proxy forwarding to app (HTTP on 3000 internally)."
+ protocol: https
+ authentication: none
+ authorization: none
+ tags: []
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - tokens-sessions
+ data_assets_received:
+ - product-catalog
+
+ Juice Shop Application:
+ id: juice-shop
+ description: "OWASP Juice Shop server (Node.js/Express, v19.0.0)."
+ type: process
+ usage: business
+ used_as_client_by_human: false
+ out_of_scope: false
+ justification_out_of_scope:
+ size: application
+ technology: web-server
+ tags: ["app", "nodejs"]
+ internet: false
+ machine: container
+ encryption: none
+ owner: Lab Owner
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: "In-scope web application (contains all business logic and vulnerabilities by design)."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: true
+ data_assets_processed:
+ - user-accounts
+ - orders
+ - product-catalog
+ - tokens-sessions
+ data_assets_stored:
+ - logs
+ data_formats_accepted:
+ - json
+ communication_links:
+ To Challenge WebHook:
+ target: webhook-endpoint
+ description: "Optional outbound callback (HTTP POST) to external WebHook when a challenge is solved."
+ protocol: https
+ authentication: none
+ authorization: none
+ tags: ["egress"]
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - orders
+
+ Persistent Storage:
+ id: persistent-storage
+ description: "Host-mounted volume for database, file uploads, and logs."
+ type: datastore
+ usage: devops
+ used_as_client_by_human: false
+ out_of_scope: false
+ justification_out_of_scope:
+ size: component
+ technology: file-server
+ tags: ["storage", "volume"]
+ internet: false
+ machine: virtual
+ encryption: transparent
+ owner: Lab Owner
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: "Local disk storage for the container – not directly exposed, but if compromised it contains sensitive data (database and logs)."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: false
+ data_assets_processed: []
+ data_assets_stored:
+ - logs
+ - user-accounts
+ - orders
+ - product-catalog
+ data_formats_accepted:
+ - file
+ communication_links: {}
+
+ Webhook Endpoint:
+ id: webhook-endpoint
+ description: "External WebHook service (3rd-party, if configured for integrations)."
+ type: external-entity
+ usage: business
+ used_as_client_by_human: false
+ out_of_scope: true
+ justification_out_of_scope: "Third-party service to receive notifications (not under our control)."
+ size: system
+ technology: web-service-rest
+ tags: ["saas", "webhook"]
+ internet: true
+ machine: virtual
+ encryption: none
+ owner: Third-Party
+ confidentiality: internal
+ integrity: operational
+ availability: operational
+ justification_cia_rating: "External service that receives data (like order or challenge info). Treated as a trusted integration point but could be abused if misconfigured."
+ multi_tenant: true
+ redundant: true
+ custom_developed_parts: false
+ data_assets_processed:
+ - orders
+ data_assets_stored: []
+ data_formats_accepted:
+ - json
+ communication_links: {}
+
+# =========================
+# TRUST BOUNDARIES
+# =========================
+trust_boundaries:
+
+ Internet:
+ id: internet
+ description: "Untrusted public network (Internet)."
+ type: network-dedicated-hoster
+ tags: []
+ technical_assets_inside:
+ - user-browser
+ - webhook-endpoint
+ trust_boundaries_nested:
+ - host
+
+ Host:
+ id: host
+ description: "Local host machine / VM running the Docker environment."
+ type: network-dedicated-hoster
+ tags: []
+ technical_assets_inside:
+ - reverse-proxy
+ - persistent-storage
+ trust_boundaries_nested:
+ - container-network
+
+ Container Network:
+ id: container-network
+ description: "Docker container network (isolated internal network for containers)."
+ type: network-dedicated-hoster
+ tags: []
+ technical_assets_inside:
+ - juice-shop
+ trust_boundaries_nested: []
+
+# =========================
+# SHARED RUNTIMES
+# =========================
+shared_runtimes:
+
+ Docker Host:
+ id: docker-host
+ description: "Docker Engine and default bridge network on the host."
+ tags: ["docker"]
+ technical_assets_running:
+ - juice-shop
+ # If the reverse proxy is containerized, include it:
+ # - reverse-proxy
+
+# =========================
+# INDIVIDUAL RISK CATEGORIES (optional)
+# =========================
+individual_risk_categories: {}
+
+# =========================
+# RISK TRACKING (optional)
+# =========================
+risk_tracking: {}
+
+# (Optional diagram layout tweaks can be added here)
+#diagram_tweak_edge_layout: spline
+#diagram_tweak_layout_left_to_right: true
\ No newline at end of file
diff --git a/labs/lab2/threagile-model.yaml b/labs/lab2/threagile-model.yaml
index 85c01a79..30e7c0a0 100644
--- a/labs/lab2/threagile-model.yaml
+++ b/labs/lab2/threagile-model.yaml
@@ -426,4 +426,4 @@ risk_tracking: {}
# (Optional diagram layout tweaks can be added here)
#diagram_tweak_edge_layout: spline
-#diagram_tweak_layout_left_to_right: true
+#diagram_tweak_layout_left_to_right: true
\ No newline at end of file
diff --git a/labs/lab3.md b/labs/lab3.md
deleted file mode 100644
index 47ec06df..00000000
--- a/labs/lab3.md
+++ /dev/null
@@ -1,265 +0,0 @@
-# Lab 3 — Secure Git
-
-
-
-
-
-> **Goal:** Practice secure Git fundamentals: signed commits and pre-commit secret scanning.
-> **Deliverable:** A PR from `feature/lab3` to the course repo with `labs/submission3.md` containing secure Git practices implementation. Submit the PR link via Moodle.
-
----
-
-## Overview
-
-In this lab you will practice:
-- Verifying commit authenticity with **SSH commit signing**
-- Preventing secrets exposure with **pre-commit scanning** (TruffleHog + Gitleaks)
-- Implementing automated security controls in development workflows
-
----
-
-## Tasks
-
-### Task 1 — SSH Commit Signature Verification (5 pts)
-
-**Objective:** Configure SSH commit signing to verify commit authenticity and integrity.
-
-#### 1.1: Research Commit Signing Benefits
-
-Study why commit signing is crucial for verifying the integrity and authenticity of commits:
-- [GitHub Docs on SSH Commit Verification](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
-- [Atlassian Guide to SSH and Git](https://confluence.atlassian.com/bitbucketserver/sign-commits-and-tags-with-ssh-keys-1305971205.html)
-
-#### 1.2: Configure SSH Commit Signing
-
-1. **Generate SSH Key (Option A - Recommended):**
-
- ```sh
- ssh-keygen -t ed25519 -C "your_email@example.com"
- ```
-
-2. **Use Existing SSH Key (Option B):**
-
- Use an existing SSH key and add it to GitHub
-
-3. **Configure Git for SSH Signing:**
-
- ```sh
- git config --global user.signingkey
- git config --global commit.gpgSign true
- git config --global gpg.format ssh
- ```
-
-#### 1.3: Create Signed Commit
-
-```sh
-git commit -S -m "docs: add commit signing summary"
-```
-
-In `labs/submission3.md`, document:
-- Summary explaining the benefits of signing commits for security
-- Evidence of successful SSH key setup and configuration
-- Analysis: "Why is commit signing critical in DevSecOps workflows?"
-- Screenshots or verification of the "Verified" badge on GitHub
-
----
-
-### Task 2 — Pre-commit Secret Scanning (5 pts)
-
-**Objective:** Implement local Git pre-commit hook that scans staged changes for secrets using Dockerized TruffleHog and Gitleaks.
-
-#### 2.1: Create Pre-commit Hook
-
-1. **Setup Pre-commit Hook File:**
-
- Create `.git/hooks/pre-commit` with the following content:
-
- ```bash
- #!/usr/bin/env bash
- set -euo pipefail
- echo "[pre-commit] scanning staged files for secrets…"
-
- # Collect staged files (added/changed)
- mapfile -t STAGED < <(git diff --cached --name-only --diff-filter=ACM)
- if [ ${#STAGED[@]} -eq 0 ]; then
- echo "[pre-commit] no staged files; skipping scans"
- exit 0
- fi
-
- FILES=()
- for f in "${STAGED[@]}"; do
- [ -f "$f" ] && FILES+=("$f")
- done
- if [ ${#FILES[@]} -eq 0 ]; then
- echo "[pre-commit] no regular files to scan; skipping"
- exit 0
- fi
-
- echo "[pre-commit] Files to scan: ${FILES[*]}"
-
- NON_LECTURES_FILES=()
- LECTURES_FILES=()
- for f in "${FILES[@]}"; do
- if [[ "$f" == lectures/* ]]; then
- LECTURES_FILES+=("$f")
- else
- NON_LECTURES_FILES+=("$f")
- fi
- done
-
- echo "[pre-commit] Non-lectures files: ${NON_LECTURES_FILES[*]:-none}"
- echo "[pre-commit] Lectures files: ${LECTURES_FILES[*]:-none}"
-
- TRUFFLEHOG_FOUND_SECRETS=false
- if [ ${#NON_LECTURES_FILES[@]} -gt 0 ]; then
- echo "[pre-commit] TruffleHog scan on non-lectures files…"
-
- set +e
- TRUFFLEHOG_OUTPUT=$(docker run --rm -v "$(pwd):/repo" -w /repo \
- trufflesecurity/trufflehog:latest \
- filesystem "${NON_LECTURES_FILES[@]}" 2>&1)
- TRUFFLEHOG_EXIT_CODE=$?
- set -e
- echo "$TRUFFLEHOG_OUTPUT"
-
- if [ $TRUFFLEHOG_EXIT_CODE -ne 0 ]; then
- echo "[pre-commit] ✖ TruffleHog detected potential secrets in non-lectures files"
- TRUFFLEHOG_FOUND_SECRETS=true
- else
- echo "[pre-commit] ✓ TruffleHog found no secrets in non-lectures files"
- fi
- else
- echo "[pre-commit] Skipping TruffleHog (only lectures files staged)"
- fi
-
- echo "[pre-commit] Gitleaks scan on staged files…"
- GITLEAKS_FOUND_SECRETS=false
- GITLEAKS_FOUND_IN_LECTURES=false
-
- for file in "${FILES[@]}"; do
- echo "[pre-commit] Scanning $file with Gitleaks..."
-
- GITLEAKS_RESULT=$(docker run --rm -v "$(pwd):/repo" -w /repo \
- zricethezav/gitleaks:latest \
- detect --source="$file" --no-git --verbose --exit-code=0 --no-banner 2>&1 || true)
-
- if [ -n "$GITLEAKS_RESULT" ] && echo "$GITLEAKS_RESULT" | grep -q -E "(Finding:|WRN leaks found)"; then
- echo "Gitleaks found secrets in $file:"
- echo "$GITLEAKS_RESULT"
- echo "---"
-
- if [[ "$file" == lectures/* ]]; then
- echo "⚠️ Secrets found in lectures directory - allowing as educational content"
- GITLEAKS_FOUND_IN_LECTURES=true
- else
- echo "✖ Secrets found in non-excluded file: $file"
- GITLEAKS_FOUND_SECRETS=true
- fi
- else
- echo "[pre-commit] No secrets found in $file"
- fi
- done
-
- echo ""
- echo "[pre-commit] === SCAN SUMMARY ==="
- echo "TruffleHog found secrets in non-lectures files: $TRUFFLEHOG_FOUND_SECRETS"
- echo "Gitleaks found secrets in non-lectures files: $GITLEAKS_FOUND_SECRETS"
- echo "Gitleaks found secrets in lectures files: $GITLEAKS_FOUND_IN_LECTURES"
- echo ""
-
- if [ "$TRUFFLEHOG_FOUND_SECRETS" = true ] || [ "$GITLEAKS_FOUND_SECRETS" = true ]; then
- echo -e "✖ COMMIT BLOCKED: Secrets detected in non-excluded files." >&2
- echo "Fix or unstage the offending files and try again." >&2
- exit 1
- elif [ "$GITLEAKS_FOUND_IN_LECTURES" = true ]; then
- echo "⚠️ Secrets found only in lectures directory (educational content) - allowing commit."
- fi
-
- echo "✓ No secrets detected in non-excluded files; proceeding with commit."
- exit 0
- ```
-
-2. **Make Hook Executable:**
-
- ```bash
- chmod +x .git/hooks/pre-commit
- ```
-
-#### 2.2: Test Secret Detection
-
-Verify hook functionality:
-- Add a test secret (e.g., fake AWS key) to a file and stage it
-- Attempt to commit - should be blocked by TruffleHog or Gitleaks
-- Remove/redact the secret, then commit again to confirm success
-
-In `labs/submission3.md`, document:
-- Pre-commit hook setup process and configuration
-- Evidence of successful secret detection blocking commits
-- Test results showing both blocked and successful commits
-- Analysis of how automated secret scanning prevents security incidents
-
----
-
-## How to Submit
-
-1. Create a branch for this lab and push it to your fork:
-
- ```bash
- git switch -c feature/lab3
- # create labs/submission3.md with your findings
- git add labs/submission3.md
- git commit -m "docs: add lab3 submission"
- git push -u origin feature/lab3
- ```
-
-2. Open a PR from your fork's `feature/lab3` branch → **course repository's main branch**.
-
-3. In the PR description, include:
-
- ```text
- - [x] Task 1 done — SSH commit signing setup
- - [x] Task 2 done — Pre-commit secrets scanning setup
- ```
-
-4. **Copy the PR URL** and submit it via **Moodle before the deadline**.
-
----
-
-## Acceptance Criteria
-
-- ✅ Branch `feature/lab3` exists with commits for each task
-- ✅ File `labs/submission3.md` contains required analysis for both tasks
-- ✅ At least one commit shows **"Verified"** (signed via SSH) on GitHub
-- ✅ Local `.git/hooks/pre-commit` runs TruffleHog and Gitleaks via Docker and blocks secrets
-- ✅ PR from `feature/lab3` → **course repo main branch** is open
-- ✅ PR link submitted via Moodle before the deadline
-
----
-
-## Rubric (10 pts)
-
-| Criterion | Points |
-| ------------------------------------------------ | -----: |
-| Task 1 — SSH commit signing setup + analysis | **5** |
-| Task 2 — Pre-commit secrets scanning setup | **5** |
-| **Total** | **10** |
-
----
-
-## Guidelines
-
-- Use clear Markdown headers to organize sections in `submission3.md`
-- Include both command outputs and written analysis for each task
-- Document security configurations and testing procedures thoroughly
-- Demonstrate both successful and blocked operations for secret scanning
-
-
-Security Configuration Notes
-
-- Ensure the email on your commits matches your GitHub account for proper verification
-- Verify `gpg.format` is set to `ssh` for proper signing configuration
-- Test pre-commit hooks thoroughly with both legitimate and test secret content
-- Docker Desktop/Engine must be running for secret scanning tools
-- Ensure all commits are properly signed for verification on GitHub
-
-
diff --git a/labs/lab4.md b/labs/lab4.md
deleted file mode 100644
index 12cc043d..00000000
--- a/labs/lab4.md
+++ /dev/null
@@ -1,325 +0,0 @@
-# Lab 4 — SBOM Generation & Software Composition Analysis
-
-
-
-
-
-> **Goal:** Generate Software Bills of Materials (SBOMs) for OWASP Juice Shop using Syft and Trivy, perform comprehensive Software Composition Analysis with Grype and Trivy, then compare the toolchain capabilities.
-> **Deliverable:** A PR from `feature/lab4` to the course repo with `labs/submission4.md` containing SBOM analysis, SCA findings, and comprehensive toolchain comparison. Submit the PR link via Moodle.
-
----
-
-## Overview
-
-In this lab you will practice:
-- Generating **SBOMs** with **Syft** and **Trivy** using Docker images for consistency
-- Performing **Software Composition Analysis (SCA)** with **Grype** (Anchore) and **Trivy**
-- **Comprehensive feature comparison** between **Syft+Grype** vs **Trivy all-in-one** approaches
-- **License analysis**, **vulnerability management**, and **supply chain security assessment**
-
-> Continue using the OWASP Juice Shop from previous labs (`bkimminich/juice-shop:v19.0.0`) as your target application.
-
----
-
-## Tasks
-
-### Task 1 — SBOM Generation with Syft and Trivy (4 pts)
-
-**Objective:** Generate comprehensive SBOMs using both Syft and Trivy Docker images, extracting maximum metadata including licenses, file information, and dependency relationships.
-
-#### 1.1: Setup SBOM Generation Environment
-
-```bash
-# Prepare working directory
-mkdir -p labs/lab4/{syft,trivy,comparison,analysis}
-
-# Pull required Docker images
-docker pull anchore/syft:latest
-docker pull aquasec/trivy:latest
-docker pull anchore/grype:latest
-```
-
-#### 1.2: Comprehensive SBOM Generation with Syft
-
-```bash
-# Syft native JSON format (most detailed)
-docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
- -v "$(pwd)":/tmp anchore/syft:latest \
- bkimminich/juice-shop:v19.0.0 -o syft-json=/tmp/labs/lab4/syft/juice-shop-syft-native.json
-
-# Human-readable table
-docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
- -v "$(pwd)":/tmp anchore/syft:latest \
- bkimminich/juice-shop:v19.0.0 -o table=/tmp/labs/lab4/syft/juice-shop-syft-table.txt
-
-# Extract licenses from the native JSON format
-echo "Extracting licenses from Syft SBOM..." > labs/lab4/syft/juice-shop-licenses.txt
-jq -r '.artifacts[] | select(.licenses != null and (.licenses | length > 0)) | "\(.name) | \(.version) | \(.licenses | map(.value) | join(", "))"' \
- labs/lab4/syft/juice-shop-syft-native.json >> labs/lab4/syft/juice-shop-licenses.txt
-```
-
-#### 1.3: Comprehensive SBOM Generation with Trivy
-
-```bash
-# SBOM with license information
-docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
- -v "$(pwd)":/tmp aquasec/trivy:latest image \
- --format json --output /tmp/labs/lab4/trivy/juice-shop-trivy-detailed.json \
- --list-all-pkgs bkimminich/juice-shop:v19.0.0
-
-# Human-readable table with package details
-docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
- -v "$(pwd)":/tmp aquasec/trivy:latest image \
- --format table --output /tmp/labs/lab4/trivy/juice-shop-trivy-table.txt \
- --list-all-pkgs bkimminich/juice-shop:v19.0.0
-```
-
-#### 1.4: SBOM Analysis and Extraction
-
-```bash
-# Component Analysis
-echo "=== SBOM Component Analysis ===" > labs/lab4/analysis/sbom-analysis.txt
-echo "" >> labs/lab4/analysis/sbom-analysis.txt
-echo "Syft Package Counts:" >> labs/lab4/analysis/sbom-analysis.txt
-jq -r '.artifacts[] | .type' labs/lab4/syft/juice-shop-syft-native.json | sort | uniq -c >> labs/lab4/analysis/sbom-analysis.txt
-
-echo "" >> labs/lab4/analysis/sbom-analysis.txt
-echo "Trivy Package Counts:" >> labs/lab4/analysis/sbom-analysis.txt
-jq -r '.Results[] as $result | $result.Packages[]? | "\($result.Target // "Unknown") - \(.Type // "unknown")"' \
- labs/lab4/trivy/juice-shop-trivy-detailed.json | sort | uniq -c >> labs/lab4/analysis/sbom-analysis.txt
-
-# License Extraction
-echo "" >> labs/lab4/analysis/sbom-analysis.txt
-echo "=== License Analysis ===" >> labs/lab4/analysis/sbom-analysis.txt
-echo "" >> labs/lab4/analysis/sbom-analysis.txt
-echo "Syft Licenses:" >> labs/lab4/analysis/sbom-analysis.txt
-jq -r '.artifacts[]? | select(.licenses != null) | .licenses[]? | .value' \
- labs/lab4/syft/juice-shop-syft-native.json | sort | uniq -c >> labs/lab4/analysis/sbom-analysis.txt
-
-echo "" >> labs/lab4/analysis/sbom-analysis.txt
-echo "Trivy Licenses (OS Packages):" >> labs/lab4/analysis/sbom-analysis.txt
-jq -r '.Results[] | select(.Class // "" | contains("os-pkgs")) | .Packages[]? | select(.Licenses != null) | .Licenses[]?' \
- labs/lab4/trivy/juice-shop-trivy-detailed.json | sort | uniq -c >> labs/lab4/analysis/sbom-analysis.txt
-
-echo "" >> labs/lab4/analysis/sbom-analysis.txt
-echo "Trivy Licenses (Node.js):" >> labs/lab4/analysis/sbom-analysis.txt
-jq -r '.Results[] | select(.Class // "" | contains("lang-pkgs")) | .Packages[]? | select(.Licenses != null) | .Licenses[]?' \
- labs/lab4/trivy/juice-shop-trivy-detailed.json | sort | uniq -c >> labs/lab4/analysis/sbom-analysis.txt
-```
-
-In `labs/submission4.md`, document:
-- **Package Type Distribution** comparison between Syft and Trivy
-- **Dependency Discovery Analysis** - which tool found more/better dependency data
-- **License Discovery Analysis** - which tool found more/better license data
-
----
-
-### Task 2 — Software Composition Analysis with Grype and Trivy (3 pts)
-
-**Objective:** Perform comprehensive vulnerability analysis using both Grype (designed for Syft SBOMs) and Trivy's built-in vulnerability scanning.
-
-#### 2.1: SCA with Grype (Anchore)
-
-```bash
-# Scan using the Syft-generated SBOM
-docker run --rm -v "$(pwd)":/tmp anchore/grype:latest \
- sbom:/tmp/labs/lab4/syft/juice-shop-syft-native.json \
- -o json > labs/lab4/syft/grype-vuln-results.json
-
-# Human-readable vulnerability report
-docker run --rm -v "$(pwd)":/tmp anchore/grype:latest \
- sbom:/tmp/labs/lab4/syft/juice-shop-syft-native.json \
- -o table > labs/lab4/syft/grype-vuln-table.txt
-```
-
-#### 2.2: SCA with Trivy (All-in-One)
-
-```bash
-# Full vulnerability scan with detailed output
-docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
- -v "$(pwd)":/tmp aquasec/trivy:latest image \
- --format json --output /tmp/labs/lab4/trivy/trivy-vuln-detailed.json \
- bkimminich/juice-shop:v19.0.0
-
-# Secrets scanning
-docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
- -v "$(pwd)":/tmp aquasec/trivy:latest image \
- --scanners secret --format table \
- --output /tmp/labs/lab4/trivy/trivy-secrets.txt \
- bkimminich/juice-shop:v19.0.0
-
-# License compliance scanning
-docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
- -v "$(pwd)":/tmp aquasec/trivy:latest image \
- --scanners license --format json \
- --output /tmp/labs/lab4/trivy/trivy-licenses.json \
- bkimminich/juice-shop:v19.0.0
-```
-
-#### 2.3: Vulnerability Analysis and Risk Assessment
-
-```bash
-# Count vulnerabilities by severity
-echo "=== Vulnerability Analysis ===" > labs/lab4/analysis/vulnerability-analysis.txt
-echo "" >> labs/lab4/analysis/vulnerability-analysis.txt
-echo "Grype Vulnerabilities by Severity:" >> labs/lab4/analysis/vulnerability-analysis.txt
-jq -r '.matches[]? | .vulnerability.severity' labs/lab4/syft/grype-vuln-results.json | sort | uniq -c >> labs/lab4/analysis/vulnerability-analysis.txt
-
-echo "" >> labs/lab4/analysis/vulnerability-analysis.txt
-echo "Trivy Vulnerabilities by Severity:" >> labs/lab4/analysis/vulnerability-analysis.txt
-jq -r '.Results[]?.Vulnerabilities[]? | .Severity' labs/lab4/trivy/trivy-vuln-detailed.json | sort | uniq -c >> labs/lab4/analysis/vulnerability-analysis.txt
-
-# License comparison summary
-echo "" >> labs/lab4/analysis/vulnerability-analysis.txt
-echo "=== License Analysis Summary ===" >> labs/lab4/analysis/vulnerability-analysis.txt
-echo "Tool Comparison:" >> labs/lab4/analysis/vulnerability-analysis.txt
-if [ -f labs/lab4/syft/juice-shop-syft-native.json ]; then
- syft_licenses=$(jq -r '.artifacts[] | select(.licenses != null) | .licenses[].value' labs/lab4/syft/juice-shop-syft-native.json 2>/dev/null | sort | uniq | wc -l)
- echo "- Syft found $syft_licenses unique license types" >> labs/lab4/analysis/vulnerability-analysis.txt
-fi
-if [ -f labs/lab4/trivy/trivy-licenses.json ]; then
- trivy_licenses=$(jq -r '.Results[].Licenses[]?.Name' labs/lab4/trivy/trivy-licenses.json 2>/dev/null | sort | uniq | wc -l)
- echo "- Trivy found $trivy_licenses unique license types" >> labs/lab4/analysis/vulnerability-analysis.txt
-fi
-```
-
-In `labs/submission4.md`, document:
-- **SCA Tool Comparison** - vulnerability detection capabilities
-- **Critical Vulnerabilities Analysis** - top 5 most critical findings with remediation
-- **License Compliance Assessment** - risky licenses and compliance recommendations
-- **Additional Security Features** - secrets scanning results
-
----
-
-### Task 3 — Toolchain Comparison: Syft+Grype vs Trivy All-in-One (3 pts)
-
-**Objective:** Comprehensive comparison of the specialized toolchain (Syft+Grype) versus the integrated solution (Trivy) across multiple dimensions.
-
-#### 3.1: Accuracy and Coverage Analysis
-
-```bash
-# Compare package detection
-echo "=== Package Detection Comparison ===" > labs/lab4/comparison/accuracy-analysis.txt
-
-# Extract unique packages from each tool
-jq -r '.artifacts[] | "\(.name)@\(.version)"' labs/lab4/syft/juice-shop-syft-native.json | sort > labs/lab4/comparison/syft-packages.txt
-jq -r '.Results[]?.Packages[]? | "\(.Name)@\(.Version)"' labs/lab4/trivy/juice-shop-trivy-detailed.json | sort > labs/lab4/comparison/trivy-packages.txt
-
-# Find packages detected by both tools
-comm -12 labs/lab4/comparison/syft-packages.txt labs/lab4/comparison/trivy-packages.txt > labs/lab4/comparison/common-packages.txt
-
-# Find packages unique to each tool
-comm -23 labs/lab4/comparison/syft-packages.txt labs/lab4/comparison/trivy-packages.txt > labs/lab4/comparison/syft-only.txt
-comm -13 labs/lab4/comparison/syft-packages.txt labs/lab4/comparison/trivy-packages.txt > labs/lab4/comparison/trivy-only.txt
-
-echo "Packages detected by both tools: $(wc -l < labs/lab4/comparison/common-packages.txt)" >> labs/lab4/comparison/accuracy-analysis.txt
-echo "Packages only detected by Syft: $(wc -l < labs/lab4/comparison/syft-only.txt)" >> labs/lab4/comparison/accuracy-analysis.txt
-echo "Packages only detected by Trivy: $(wc -l < labs/lab4/comparison/trivy-only.txt)" >> labs/lab4/comparison/accuracy-analysis.txt
-
-# Compare vulnerability findings
-echo "" >> labs/lab4/comparison/accuracy-analysis.txt
-echo "=== Vulnerability Detection Overlap ===" >> labs/lab4/comparison/accuracy-analysis.txt
-
-# Extract CVE IDs
-jq -r '.matches[]? | .vulnerability.id' labs/lab4/syft/grype-vuln-results.json | sort | uniq > labs/lab4/comparison/grype-cves.txt
-jq -r '.Results[]?.Vulnerabilities[]? | .VulnerabilityID' labs/lab4/trivy/trivy-vuln-detailed.json | sort | uniq > labs/lab4/comparison/trivy-cves.txt
-
-echo "CVEs found by Grype: $(wc -l < labs/lab4/comparison/grype-cves.txt)" >> labs/lab4/comparison/accuracy-analysis.txt
-echo "CVEs found by Trivy: $(wc -l < labs/lab4/comparison/trivy-cves.txt)" >> labs/lab4/comparison/accuracy-analysis.txt
-echo "Common CVEs: $(comm -12 labs/lab4/comparison/grype-cves.txt labs/lab4/comparison/trivy-cves.txt | wc -l)" >> labs/lab4/comparison/accuracy-analysis.txt
-```
-
-In `labs/submission4.md`, document:
-- **Accuracy Analysis** - package detection and vulnerability overlap quantified
-- **Tool Strengths and Weaknesses** - practical observations from your testing
-- **Use Case Recommendations** - when to choose Syft+Grype vs Trivy
-- **Integration Considerations** - CI/CD, automation, and operational aspects
-
----
-
-## How to Submit
-
-1. Create a branch for this lab and push it to your fork:
-
- ```bash
- git switch -c feature/lab4
- # create labs/submission4.md with your findings
- git add labs/submission4.md labs/lab4/
- git commit -m "docs: add lab4 submission - SBOM generation and SCA comparison"
- git push -u origin feature/lab4
- ```
-
-2. Open a PR from your fork's `feature/lab4` branch → **course repository's main branch**.
-
-3. In the PR description, include:
-
- ```text
- - [x] Task 1 done — SBOM Generation with Syft and Trivy
- - [x] Task 2 done — SCA with Grype and Trivy
- - [x] Task 3 done — Comprehensive Toolchain Comparison
- ```
-
-4. **Copy the PR URL** and submit it via **Moodle before the deadline**.
-
----
-
-## Acceptance Criteria
-
-- ✅ Branch `feature/lab4` exists with commits for each task
-- ✅ File `labs/submission4.md` contains required analysis for Tasks 1-3
-- ✅ SBOM generation completed successfully with both Syft and Trivy
-- ✅ Comprehensive SCA performed with both Grype and Trivy vulnerability scanning
-- ✅ Quantitative toolchain comparison completed with accuracy analysis
-- ✅ All generated SBOMs, vulnerability reports, and analysis files committed
-- ✅ PR from `feature/lab4` → **course repo main branch** is open
-- ✅ PR link submitted via Moodle before the deadline
-
----
-
-## Rubric (10 pts)
-
-| Criterion | Points |
-| ---------------------------------------------------------------- | -----: |
-| Task 1 — SBOM generation with Syft and Trivy + analysis | **4** |
-| Task 2 — SCA with Grype and Trivy + vulnerability assessment | **3** |
-| Task 3 — Comprehensive toolchain comparison + recommendations | **3** |
-| **Total** | **10** |
-
----
-
-## Guidelines
-
-- Use clear Markdown headers to organize sections in `submission4.md`
-- Include both quantitative metrics and qualitative analysis for each task
-- Document all Docker commands used and any issues encountered
-- Provide actionable security recommendations based on findings
-- Focus on practical insights over theoretical comparisons
-
-
-SBOM Quality Notes
-
-- NYU research (SBOMit project) shows metadata-based SBOM generation has accuracy limitations
-- Pay attention to packages detected by one tool but not the other - document these discrepancies
-- Consider the "lying SBOM" problem when evaluating tool accuracy
-
-
-
-
-SCA Best Practices
-
-- Always cross-reference critical vulnerabilities between tools before taking action
-- Evaluate both direct and transitive dependency risks in your analysis
-- Consider CVSS scores, exploitability, and context when prioritizing vulnerabilities
-- Document false positives and tool-specific detection patterns
-
-
-
-
-Comparison Methodology
-
-- Use consistent container image and execution environment for fair comparison
-- Focus on practical operational differences, not just feature checklists
-- Consider maintenance overhead and community support in your analysis
-- Provide specific use case recommendations based on quantitative findings
-
-
diff --git a/labs/lab4/analysis/sbom-analysis.txt b/labs/lab4/analysis/sbom-analysis.txt
new file mode 100644
index 00000000..af04ef26
--- /dev/null
+++ b/labs/lab4/analysis/sbom-analysis.txt
@@ -0,0 +1,79 @@
+=== SBOM Component Analysis ===
+
+Syft Package Counts:
+ 1 binary
+ 10 deb
+ 1128 npm
+
+Trivy Package Counts:
+ 10 bkimminich/juice-shop:v19.0.0 (debian 12.11) - unknown
+ 1125 Node.js - unknown
+
+=== License Analysis ===
+
+Syft Licenses:
+ 1 0BSD
+ 1 ad-hoc
+ 1 Apache2
+ 15 Apache-2.0
+ 5 Artistic
+ 5 BlueOak-1.0.0
+ 1 BSD
+ 12 BSD-2-Clause
+ 1 (BSD-2-Clause OR MIT OR Apache-2.0)
+ 14 BSD-3-Clause
+ 4 GFDL-1.2
+ 5 GPL
+ 1 GPL-1
+ 1 GPL-1+
+ 6 GPL-2
+ 1 GPL-2.0
+ 4 GPL-3
+ 143 ISC
+ 4 LGPL
+ 1 LGPL-2.1
+ 19 LGPL-3.0
+ 888 MIT
+ 2 (MIT OR Apache-2.0)
+ 1 (MIT OR WTFPL)
+ 2 MIT/X11
+ 2 MPL-2.0
+ 1 public-domain
+ 2 Unlicense
+ 1 WTFPL
+ 1 WTFPL OR ISC
+ 1 (WTFPL OR MIT)
+
+Trivy Licenses (OS Packages):
+ 1 ad-hoc
+ 1 Apache-2.0
+ 2 Artistic-2.0
+ 1 GFDL-1.2-only
+ 1 GPL-1.0-only
+ 1 GPL-1.0-or-later
+ 3 GPL-2.0-only
+ 2 GPL-2.0-or-later
+ 1 GPL-3.0-only
+ 1 LGPL-2.0-or-later
+ 1 LGPL-2.1-only
+ 1 public-domain
+
+Trivy Licenses (Node.js):
+ 1 0BSD
+ 12 Apache-2.0
+ 5 BlueOak-1.0.0
+ 12 BSD-2-Clause
+ 1 (BSD-2-Clause OR MIT OR Apache-2.0)
+ 14 BSD-3-Clause
+ 1 GPL-2.0-only
+ 143 ISC
+ 19 LGPL-3.0-only
+ 878 MIT
+ 2 (MIT OR Apache-2.0)
+ 1 (MIT OR WTFPL)
+ 2 MIT/X11
+ 2 MPL-2.0
+ 2 Unlicense
+ 1 WTFPL
+ 1 WTFPL OR ISC
+ 1 (WTFPL OR MIT)
\ No newline at end of file
diff --git a/labs/lab4/analysis/vulnerability-analysis.txt b/labs/lab4/analysis/vulnerability-analysis.txt
new file mode 100644
index 00000000..8c214450
--- /dev/null
+++ b/labs/lab4/analysis/vulnerability-analysis.txt
@@ -0,0 +1,10 @@
+
+=== License Analysis Summary ===
+Tool Comparison:
+- Syft found 31 unique license types
+- Trivy found 28 unique license types
+
+=== License Analysis Summary ===
+Tool Comparison:
+- Syft found 31 unique license types
+- Trivy found 28 unique license types
\ No newline at end of file
diff --git a/labs/lab4/comparison/accuracy-analysis.txt b/labs/lab4/comparison/accuracy-analysis.txt
new file mode 100644
index 00000000..170d7de6
--- /dev/null
+++ b/labs/lab4/comparison/accuracy-analysis.txt
@@ -0,0 +1,9 @@
+=== Package Detection Comparison ===
+Packages detected by both tools: 1126
+Packages only detected by Syft: 13
+Packages only detected by Trivy: 9
+
+=== Vulnerability Detection Overlap ===
+CVEs found by Grype: 58
+CVEs found by Trivy: 62
+Common CVEs: 15
diff --git a/labs/lab4/comparison/common-packages.txt b/labs/lab4/comparison/common-packages.txt
new file mode 100644
index 00000000..4c466f8a
--- /dev/null
+++ b/labs/lab4/comparison/common-packages.txt
@@ -0,0 +1,1126 @@
+1to2@1.0.0
+abbrev@1.1.1
+abbrev@3.0.1
+abitype@0.7.1
+abort-controller@3.0.0
+accepts@1.3.8
+acorn@7.4.1
+acorn@8.15.0
+acorn-walk@8.3.4
+@adraffy/ens-normalize@1.10.1
+aes-js@4.0.0-beta.5
+agent-base@6.0.2
+agent-base@7.1.4
+agent-base@7.1.4
+agentkeepalive@4.6.0
+aggregate-error@3.1.0
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@3.0.1
+ansi-regex@5.0.1
+ansi-regex@6.2.0
+ansi-regex@6.2.0
+ansi-styles@2.2.1
+ansi-styles@3.2.1
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@6.2.1
+anymatch@3.1.3
+append-field@1.0.0
+aproba@1.2.0
+archiver@1.3.0
+archiver-utils@1.3.0
+archive-type@4.0.0
+are-we-there-yet@1.1.7
+are-we-there-yet@3.0.1
+arg@4.1.3
+argparse@1.0.10
+array-buffer-byte-length@1.0.2
+array-each@1.0.1
+array-flatten@1.1.1
+array-slice@1.1.0
+array-unique@0.3.2
+arr-diff@4.0.0
+arr-flatten@1.1.0
+arr-union@3.1.0
+asap@2.0.6
+assert-never@1.4.0
+assign-symbols@1.0.0
+async@2.6.4
+async@2.6.4
+async@3.2.6
+at-least-node@1.0.0
+atob@2.1.2
+available-typed-arrays@1.0.7
+@babel/helper-string-parser@7.27.1
+@babel/helper-validator-identifier@7.27.1
+@babel/parser@7.28.3
+@babel/types@7.28.2
+babel-walk@3.0.0-canary-5
+balanced-match@1.0.2
+base@0.11.2
+base64-arraybuffer@0.1.4
+base64id@2.0.0
+base64-js@0.0.8
+base64-js@1.5.1
+base64url@0.0.6
+base-files@12.4+deb12u11
+basic-auth@2.0.1
+batch@0.6.1
+beep-boop@1.2.3
+big-integer@1.6.52
+binary@0.3.0
+binary-extensions@2.3.0
+bindings@1.5.0
+bintrees@1.0.2
+bl@1.2.3
+bl@4.1.0
+bluebird@3.4.7
+bluebird@3.7.2
+body-parser@1.20.3
+bower-config@1.4.3
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@2.0.2
+braces@2.3.2
+braces@3.0.3
+braces@3.0.3
+braces@3.0.3
+brotli@1.3.3
+buffer@5.7.1
+buffer@6.0.3
+buffer-alloc@1.2.0
+buffer-alloc-unsafe@1.1.0
+buffer-crc32@0.2.13
+buffer-fill@1.0.0
+buffer-from@1.1.2
+buffer-indexof-polyfill@1.0.2
+buffers@0.1.1
+busboy@1.6.0
+byline@4.2.2
+bytes@3.1.2
+cacache@15.3.0
+cacache@19.0.1
+cacheable-request@2.1.4
+cache-base@1.0.1
+call-bind@1.0.8
+call-bind-apply-helpers@1.0.2
+call-bound@1.0.4
+camelcase@5.3.1
+chainsaw@0.1.0
+chalk@1.1.3
+chalk@2.4.2
+chalk@4.1.2
+character-parser@2.2.0
+check-dependencies@1.1.1
+check-internet-connected@2.0.6
+check-types@6.0.0
+chokidar@3.5.1
+chownr@1.1.4
+chownr@1.1.4
+chownr@2.0.0
+chownr@3.0.0
+clarinet@0.12.6
+class-utils@0.3.6
+clean-stack@2.2.0
+cliui@6.0.0
+clone@2.1.2
+clone-response@1.0.2
+code-point-at@1.1.0
+collection-visit@1.0.0
+color@3.2.1
+color-convert@1.9.3
+color-convert@2.0.1
+color-convert@2.0.1
+color-convert@2.0.1
+color-name@1.1.3
+color-name@1.1.4
+color-name@1.1.4
+color-name@1.1.4
+colors@1.1.2
+colors@1.4.0
+@colors/colors@1.6.0
+@colors/colors@1.6.0
+colorspace@1.1.4
+color-string@1.9.1
+color-support@1.1.3
+commander@2.20.3
+commander@2.20.3
+component-emitter@1.3.1
+component-type@1.2.1
+compress-commons@1.2.2
+compressible@2.0.18
+compression@1.8.1
+concat-map@0.0.1
+concat-stream@1.6.2
+config@3.3.12
+console-control-strings@1.1.0
+constantinople@4.0.1
+content-disposition@0.5.4
+content-type@1.0.5
+cookie@0.4.2
+cookie@0.7.1
+cookie@0.7.2
+cookie-parser@1.4.7
+cookie-signature@1.0.6
+copy-descriptor@0.1.1
+core-util-is@1.0.2
+cors@2.8.5
+crc-32@1.2.2
+crc32-stream@2.0.0
+crc@3.8.0
+create-require@1.1.1
+cross-fetch@4.1.0
+cross-fetch-polyfill@0.0.0
+cross-spawn@7.0.6
+crypto-js@3.3.0
+@dabh/diagnostics@2.0.3
+dateformat@4.6.3
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@3.2.7
+debug@4.3.7
+decamelize@1.2.0
+decode-uri-component@0.2.2
+decompress@4.2.1
+decompress-response@3.3.0
+decompress-response@4.2.1
+decompress-response@6.0.0
+decompress-response@6.0.0
+decompress-tar@4.1.1
+decompress-tarbz2@4.1.1
+decompress-targz@4.1.1
+decompress-unzip@4.0.1
+deep-equal@2.2.3
+deep-extend@0.6.0
+define-data-property@1.1.4
+define-properties@1.2.1
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@1.0.0
+define-property@1.0.0
+define-property@1.0.0
+define-property@2.0.2
+delegates@1.0.0
+depd@1.1.2
+depd@2.0.0
+destroy@1.2.0
+detect-file@1.0.0
+detect-libc@1.0.3
+detect-libc@2.0.4
+detect-libc@2.0.4
+dfa@1.2.0
+diff@4.0.2
+doctypes@1.1.0
+domelementtype@1.3.1
+domhandler@2.1.0
+domutils@1.1.6
+dottie@2.0.6
+double-ended-queue@0.9.7
+download@8.0.0
+dunder-proto@1.0.1
+duplexer2@0.1.4
+duplexer3@0.1.5
+dynamic-dedupe@0.3.0
+eastasianwidth@0.2.0
+ee-first@1.1.1
+eivindfjeldstad-dot@0.0.1
+emoji-regex@8.0.0
+emoji-regex@9.2.2
+emoji-regex@9.2.2
+enabled@2.0.0
+encodeurl@1.0.2
+encodeurl@2.0.0
+encoding@0.1.13
+end-of-stream@1.4.5
+engine.io@4.1.2
+engine.io-parser@4.0.3
+env-paths@2.2.1
+err-code@1.1.2
+err-code@2.0.3
+errorhandler@1.5.1
+escape-html@1.0.3
+escape-string-regexp@1.0.5
+escodegen@2.1.0
+es-define-property@1.0.1
+es-errors@1.3.0
+es-get-iterator@1.1.3
+es-object-atoms@1.1.1
+esprima@1.0.4
+esprima@4.0.1
+estraverse@5.3.0
+esutils@2.0.3
+etag@1.8.1
+ethereum-cryptography@2.2.1
+@ethereumjs/rlp@4.0.1
+@ethereumjs/rlp@5.0.2
+ethers@6.15.0
+eventemitter2@0.4.14
+eventemitter3@1.1.1
+eventemitter3@5.0.1
+events@3.3.0
+event-target-shim@5.0.1
+exit@0.1.2
+expand-brackets@2.1.4
+expand-template@2.0.3
+expand-tilde@2.0.2
+exponential-backoff@3.1.2
+express@4.21.2
+express-ipfilter@1.3.2
+express-jwt@0.1.3
+express-rate-limit@7.5.1
+express-robots-txt@0.4.1
+express-security.txt@2.0.0
+extend@3.0.2
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@3.0.2
+extglob@2.0.4
+ext-list@2.2.2
+ext-name@5.0.0
+fast.js@0.1.1
+fdir@6.5.0
+fd-slicer@1.1.0
+feature-policy@0.5.0
+fecha@4.2.3
+filehound@1.17.6
+file-js@0.3.0
+filename-reserved-regex@2.0.0
+filenamify@3.0.0
+filesniffer@1.0.3
+file-stream-rotator@1.0.0
+file-type@11.1.0
+file-type@16.5.4
+file-type@3.9.0
+file-type@4.4.0
+file-type@5.2.0
+file-type@5.2.0
+file-type@6.2.0
+file-uri-to-path@1.0.0
+fill-range@4.0.0
+fill-range@7.1.1
+fill-range@7.1.1
+fill-range@7.1.1
+finale-rest@1.2.2
+finalhandler@1.3.1
+find-up@4.1.0
+findup-sync@2.0.0
+findup-sync@4.0.0
+findup-sync@5.0.0
+fined@1.2.0
+flagged-respawn@1.0.1
+fn.name@1.1.0
+fontkit@1.9.0
+for-each@0.3.5
+foreachasync@3.0.0
+foreground-child@3.3.1
+for-in@1.0.2
+formatio@1.1.1
+for-own@1.0.0
+forwarded@0.2.0
+fragment-cache@0.2.1
+fresh@0.5.2
+from2@2.3.0
+frontend@19.0.0
+fs-constants@1.0.0
+fs-extra@9.1.0
+fs-minipass@1.2.7
+fs-minipass@2.1.0
+fs-minipass@3.0.3
+fs.realpath@1.0.0
+fstream@1.0.12
+function-bind@1.1.2
+functions-have-names@1.2.3
+fuzzball@1.4.0
+@gar/promisify@1.1.3
+gauge@2.7.4
+gauge@4.0.4
+geojson-utils@1.1.0
+get-caller-file@2.0.5
+get-intrinsic@1.3.0
+getobject@1.0.2
+get-proto@1.0.1
+get-stream@2.3.1
+get-stream@3.0.0
+get-stream@3.0.0
+get-stream@4.1.0
+get-value@2.0.6
+github-from-package@0.0.0
+glob@10.4.5
+glob@7.1.7
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+global-modules@1.0.0
+global-prefix@1.0.2
+glob-parent@5.1.2
+gopd@1.2.0
+got@8.3.2
+graceful-fs@4.2.11
+grunt@1.6.1
+grunt-cli@1.4.3
+grunt-contrib-compress@1.6.0
+grunt-known-options@2.0.0
+grunt-legacy-log@3.0.0
+grunt-legacy-log-utils@2.1.0
+grunt-legacy-util@2.0.1
+grunt-replace-json@0.1.0
+handlebars@4.7.7
+has-ansi@2.0.0
+has-bigints@1.1.0
+has-flag@3.0.0
+has-flag@4.0.0
+hashids@2.3.0
+hasown@2.0.2
+has-property-descriptors@1.0.2
+has-symbols@1.1.0
+has-symbol-support-x@1.4.2
+has-tostringtag@1.0.2
+has-to-string-tag-x@1.4.1
+has-unicode@2.0.1
+has-value@0.3.1
+has-value@1.0.0
+has-values@0.1.4
+has-values@1.0.0
+hbs@4.2.0
+he@0.4.1
+heap@0.2.7
+helmet@4.6.0
+hoister@0.0.2
+homedir-polyfill@1.0.3
+hooker@0.2.3
+html-entities@1.4.0
+htmlparser2@3.3.0
+http-cache-semantics@3.8.1
+http-cache-semantics@4.2.0
+http-cache-semantics@4.2.0
+http-errors@1.6.3
+http-errors@2.0.0
+http-proxy-agent@4.0.1
+http-proxy-agent@5.0.0
+http-proxy-agent@7.0.2
+https-proxy-agent@5.0.1
+https-proxy-agent@7.0.6
+humanize-ms@1.2.1
+i18n@0.11.1
+iconv-lite@0.4.24
+iconv-lite@0.6.3
+iconv-lite@0.6.3
+ieee754@1.2.1
+ignore-walk@3.0.4
+iltorb@2.4.5
+imurmurhash@0.1.4
+indent-string@4.0.0
+infer-owner@1.0.4
+inflection@1.13.4
+inflight@1.0.6
+inherits@2.0.3
+inherits@2.0.4
+ini@1.3.8
+ini@1.3.8
+internal-slot@1.1.0
+interpret@1.1.0
+into-stream@3.1.0
+invariant@2.2.4
+ip@2.0.1
+ip6@0.2.11
+ip-address@10.0.1
+ipaddr.js@1.9.1
+@isaacs/cliui@8.0.2
+@isaacs/fs-minipass@4.0.1
+is-absolute@1.0.0
+is-accessor-descriptor@1.0.1
+is-arguments@1.2.0
+isarray@0.0.1
+isarray@1.0.0
+isarray@1.0.0
+isarray@2.0.5
+is-array-buffer@3.0.5
+is-arrayish@0.3.2
+is-bigint@1.1.0
+is-binary-path@2.1.0
+is-boolean-object@1.2.2
+is-buffer@1.1.6
+is-callable@1.2.7
+is-core-module@2.16.1
+is-data-descriptor@1.0.1
+is-date-object@1.1.0
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@1.0.3
+isexe@2.0.0
+isexe@3.1.1
+is-expression@4.0.0
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@1.0.1
+is-extglob@2.1.1
+is-fullwidth-code-point@1.0.0
+is-fullwidth-code-point@2.0.0
+is-fullwidth-code-point@3.0.0
+is-generator-function@1.1.0
+is-glob@3.1.0
+is-glob@4.0.3
+is-lambda@1.0.1
+is-map@2.0.3
+is-natural-number@4.0.1
+is-number@3.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number-like@1.0.8
+is-number-object@1.1.1
+is-object@1.0.2
+isobject@2.1.0
+isobject@3.0.1
+isomorphic-ws@5.0.0
+is-plain-obj@1.1.0
+is-plain-object@2.0.4
+is-promise@2.2.2
+is-regex@1.2.1
+is-relative@1.0.0
+is-retry-allowed@1.2.0
+is-set@2.0.3
+is-shared-array-buffer@1.0.4
+is-stream@1.1.0
+is-stream@2.0.1
+is-string@1.1.1
+is-symbol@1.1.1
+is-typed-array@1.1.15
+is-unc-path@1.0.0
+isurl@1.0.0
+is-weakmap@2.0.2
+is-weakset@2.0.4
+is-windows@1.0.2
+jackspeak@3.4.3
+json5@2.2.3
+json-buffer@3.0.0
+jsonfile@6.2.0
+jsonwebtoken@0.1.0
+jsonwebtoken@0.4.0
+jssha@3.3.1
+js-stringify@1.0.2
+js-tokens@4.0.0
+jstransformer@1.0.0
+js-yaml@3.14.1
+juice-shop@19.0.0
+juice-shop@19.0.0
+juicy-chat-bot@0.9.0
+jwa@0.0.1
+jws@0.2.6
+keyv@3.0.0
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@4.0.0
+kind-of@6.0.3
+kuler@2.0.0
+lazystream@1.0.1
+libxmljs2@0.37.0
+liftup@3.0.1
+linebreak@1.1.0
+listenercount@1.0.1
+ljharb-monorepo-symlink-test@0.0.0
+locate-path@5.0.0
+lodash@2.4.2
+lodash@4.17.21
+lodash.camelcase@4.3.0
+lodash.isfinite@3.3.2
+lodash.set@4.3.2
+logform@2.7.0
+lolex@1.3.2
+loose-envify@1.4.0
+lowercase-keys@1.0.0
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@6.0.0
+make-dir@1.3.0
+make-dir@2.1.0
+make-error@1.3.6
+make-fetch-happen@14.0.3
+make-fetch-happen@9.1.0
+make-iterator@1.0.1
+make-plural@4.3.0
+make-plural@6.2.2
+map-cache@0.2.2
+map-visit@1.0.0
+marsdb@0.6.11
+math-interval-parser@2.0.1
+math-intrinsics@1.1.0
+median@0.0.2
+media-typer@0.3.0
+media-types@10.0.0
+merge-descriptors@1.0.3
+messageformat@2.3.0
+messageformat-formatters@2.0.1
+messageformat-parser@4.1.3
+methods@1.1.2
+micromatch@3.1.10
+micromatch@4.0.8
+micromatch@4.0.8
+mime@1.6.0
+mime-db@1.52.0
+mime-types@2.1.35
+mimic-response@1.0.1
+mimic-response@2.1.0
+mimic-response@3.1.0
+mimic-response@3.1.0
+minami@1.1.1
+minami@1.1.1
+minami@1.1.1
+minimatch@3.0.5
+minimatch@3.0.8
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@5.1.6
+minimatch@9.0.5
+minimist@0.2.4
+minimist@1.2.8
+minipass@2.9.0
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@5.0.0
+minipass@7.1.2
+minipass-collect@1.0.2
+minipass-collect@2.0.1
+minipass-fetch@1.4.1
+minipass-fetch@4.0.1
+minipass-flush@1.0.5
+minipass-pipeline@1.2.4
+minipass-sized@1.0.3
+minizlib@1.3.3
+minizlib@2.1.2
+minizlib@3.0.2
+mixin-deep@1.3.2
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@1.0.4
+mkdirp@3.0.1
+mkdirp@3.0.1
+mkdirp-classic@0.5.3
+moment@2.0.0
+moment@2.30.1
+moment-timezone@0.5.48
+morgan@1.10.1
+mout@1.2.4
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.1.3
+multer@1.4.5-lts.2
+mustache@4.2.0
+mylib@0.0.0
+@my-scope/package-a@0.0.0
+@my-scope/package-b@0.0.0
+nan@2.22.2
+nanomatch@1.2.13
+napi-build-utils@1.0.2
+napi-build-utils@2.0.0
+napi-build-utils@2.0.0
+needle@2.9.1
+negotiator@0.6.3
+negotiator@0.6.4
+negotiator@1.0.0
+neo-async@2.6.2
+netbase@6.4
+@nlpjs/core@4.26.1
+@nlpjs/core-loader@4.26.1
+@nlpjs/evaluator@4.26.1
+@nlpjs/lang-en@4.26.1
+@nlpjs/lang-en-min@4.26.1
+@nlpjs/language@4.25.0
+@nlpjs/language-min@4.25.0
+@nlpjs/ner@4.27.0
+@nlpjs/neural@4.25.0
+@nlpjs/nlg@4.26.1
+@nlpjs/nlp@4.27.0
+@nlpjs/nlu@4.27.0
+@nlpjs/request@4.25.0
+@nlpjs/sentiment@4.26.1
+@nlpjs/similarity@4.26.1
+@nlpjs/slot@4.26.1
+@noble/curves@1.2.0
+@noble/curves@1.4.2
+@noble/curves@1.4.2
+@noble/hashes@1.3.2
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+node-abi@2.30.1
+node-abi@3.77.0
+node-abi@3.77.0
+node-addon-api@7.1.1
+node-fetch@2.7.0
+node-gyp@11.4.2
+node-gyp@8.4.1
+node-pre-gyp@0.15.0
+noop-logger@0.1.1
+nopt@3.0.6
+nopt@4.0.3
+nopt@4.0.3
+nopt@5.0.0
+nopt@8.1.0
+normalize-path@2.1.1
+normalize-path@3.0.0
+normalize-path@3.0.0
+normalize-url@2.0.1
+notevil@1.3.3
+npm-bundled@1.1.2
+@npmcli/agent@3.0.0
+@npmcli/fs@1.1.1
+@npmcli/fs@4.0.0
+@npmcli/move-file@1.1.2
+npmlog@4.1.2
+npmlog@6.0.2
+npm-normalize-package-bin@1.0.1
+npm-packlist@1.4.8
+number-is-nan@1.0.1
+nw-pre-gyp-module-test@0.0.1
+object-assign@4.1.1
+object.assign@4.1.7
+object-copy@0.1.0
+object.defaults@1.1.0
+object-inspect@1.13.4
+object-is@1.1.6
+object-keys@1.1.1
+object.map@1.0.1
+object.pick@1.3.0
+object-visit@1.0.1
+once@1.4.0
+one-time@1.0.0
+on-finished@2.3.0
+on-finished@2.4.1
+on-headers@1.1.0
+opentype.js@0.7.3
+osenv@0.1.5
+os-homedir@1.0.2
+os-tmpdir@1.0.2
+otplib@12.0.1
+@otplib/core@12.0.1
+@otplib/plugin-crypto@12.0.1
+@otplib/plugin-thirty-two@12.0.1
+@otplib/preset-default@12.0.1
+@otplib/preset-v11@12.0.1
+package-json-from-dist@1.0.1
+pako@0.2.9
+parse-filepath@1.0.2
+parse-passwd@1.0.0
+parseurl@1.3.3
+pascalcase@0.1.1
+path-exists@4.0.0
+path-is-absolute@1.0.1
+path-key@3.1.1
+path-parse@1.0.7
+path-root@0.1.1
+path-root-regex@0.1.2
+path-scurry@1.11.1
+path-to-regexp@0.1.12
+p-cancelable@0.4.1
+pdfkit@0.11.0
+peek-readable@4.1.0
+pend@1.2.0
+p-event@2.3.1
+p-finally@1.0.0
+pg-connection-string@2.9.1
+picomatch@2.3.1
+picomatch@4.0.3
+pify@2.3.0
+pify@2.3.0
+pify@3.0.0
+pify@3.0.0
+pify@4.0.1
+pinkie@2.0.4
+pinkie-promise@2.0.1
+p-is-promise@1.1.0
+@pkgjs/parseargs@0.11.0
+p-limit@2.3.0
+p-locate@4.1.0
+p-map@4.0.0
+p-map@7.0.3
+png-js@1.0.0
+posix-character-classes@0.1.1
+possible-typed-array-names@1.1.0
+prebuild-install@5.3.6
+prebuild-install@7.1.3
+prebuild-install@7.1.3
+prepend-http@2.0.0
+pretty-bytes@4.0.2
+process@0.11.10
+process-nextick-args@2.0.1
+proc-log@5.0.0
+prom-client@14.2.0
+promise@7.3.1
+promise-inflight@1.0.1
+promise-retry@2.0.1
+proper-lockfile@1.2.0
+proxy-addr@2.0.7
+p-timeout@2.0.1
+p-try@2.2.0
+pug@3.0.3
+pug-attrs@3.0.0
+pug-code-gen@3.0.3
+pug-error@2.1.0
+pug-filters@4.0.0
+pug-lexer@5.0.1
+pug-linker@4.0.0
+pug-load@3.0.0
+pug-parser@6.0.0
+pug-runtime@3.0.1
+pug-strip-comments@2.0.0
+pug-walk@2.0.0
+pump@3.0.3
+qs@6.13.0
+query-string@5.1.1
+range_check@2.0.4
+range-parser@1.2.1
+raw-body@2.5.2
+rc@1.2.8
+readable-stream@1.0.34
+readable-stream@2.3.8
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@4.7.0
+readable-web-to-node-stream@3.0.4
+readdirp@3.5.0
+rechoir@0.7.1
+recursedir-comparisons@0.0.0
+regex-not@1.0.2
+regexp.prototype.flags@1.5.4
+remove-trailing-separator@1.1.0
+repeat-element@1.1.4
+repeat-string@1.6.1
+replace@1.2.2
+require-directory@2.1.1
+require-main-filename@2.0.0
+resolve@1.22.10
+resolve-dir@1.0.1
+resolve-url@0.2.1
+responselike@1.0.2
+restructure@2.0.1
+ret@0.1.15
+retry@0.10.1
+retry@0.12.0
+retry-as-promised@7.1.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@3.0.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.2.1
+safer-buffer@2.1.2
+safe-regex@1.1.0
+safe-regex-test@1.1.0
+safe-stable-stringify@2.5.0
+samsam@1.1.2
+sanitize-filename@1.6.3
+sanitize-html@1.4.2
+sax@1.4.1
+@scarf/scarf@1.4.0
+@scure/base@1.1.9
+@scure/bip32@1.4.0
+@scure/bip39@1.3.0
+seek-bzip@1.0.6
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@7.7.2
+send@0.19.0
+sequelize@6.37.7
+sequelize-pool@7.1.0
+serve-index@1.9.1
+serve-static@1.16.2
+set-blocking@2.0.0
+set-function-length@1.2.2
+set-function-name@2.0.2
+setimmediate@1.0.5
+setprototypeof@1.1.0
+setprototypeof@1.2.0
+set-value@2.0.1
+shebang-command@2.0.0
+shebang-regex@3.0.0
+side-channel@1.1.0
+side-channel-list@1.0.0
+side-channel-map@1.0.1
+side-channel-weakmap@1.0.2
+signal-exit@3.0.7
+signal-exit@4.1.0
+simple-concat@1.0.1
+simple-get@3.1.1
+simple-get@4.0.1
+simple-get@4.0.1
+simple-swizzle@0.2.2
+@sindresorhus/is@0.7.0
+sinon@1.17.7
+smart-buffer@4.2.0
+snapdragon@0.8.2
+snapdragon-node@2.1.1
+snapdragon-util@3.0.1
+socket.io@3.1.2
+socket.io-adapter@2.1.0
+socket.io-parser@4.0.5
+socks@2.8.7
+socks-proxy-agent@6.2.1
+socks-proxy-agent@8.0.5
+sort-keys@1.1.2
+sort-keys@2.0.0
+sort-keys-length@1.0.1
+source-map@0.5.7
+source-map@0.6.1
+source-map-resolve@0.5.3
+source-map-support@0.5.21
+source-map-url@0.4.1
+split-string@3.1.0
+sprintf-js@1.0.3
+sprintf-js@1.1.3
+sqlite3@5.1.7
+ssri@12.0.0
+ssri@8.0.1
+stack-trace@0.0.10
+static-extend@0.1.2
+statuses@1.5.0
+statuses@2.0.1
+stop-iteration-iterator@1.1.0
+stream-buffers@2.2.0
+streamsearch@1.1.0
+strict-uri-encode@1.1.0
+string_decoder@0.10.31
+string_decoder@1.1.1
+string_decoder@1.3.0
+string.fromcodepoint@0.2.1
+string.prototype.codepointat@0.2.1
+string-width@1.0.2
+string-width@2.1.1
+string-width@4.2.3
+string-width@4.2.3
+string-width@5.1.2
+string-width@5.1.2
+strip-ansi@3.0.1
+strip-ansi@3.0.1
+strip-ansi@4.0.0
+strip-ansi@6.0.1
+strip-ansi@6.0.1
+strip-ansi@7.1.0
+strip-ansi@7.1.0
+strip-bom@3.0.0
+strip-dirs@2.1.0
+strip-json-comments@2.0.1
+strip-json-comments@2.0.1
+strip-outer@1.0.1
+strtok3@6.3.0
+supports-color@2.0.0
+supports-color@5.5.0
+supports-color@7.2.0
+supports-preserve-symlinks-flag@1.0.0
+svg-captcha@1.4.0
+swagger-ui-dist@5.28.1
+swagger-ui-express@5.0.1
+@swc/helpers@0.3.17
+tar@4.4.19
+tar@6.2.1
+tar@7.4.3
+tar-fs@2.1.3
+tar-stream@1.6.2
+tar-stream@2.2.0
+tdigest@0.1.2
+text-hex@1.0.0
+thirty-two@1.0.2
+through@2.3.8
+timed-out@4.0.1
+tinyglobby@0.2.14
+tiny-inflate@1.0.3
+to-buffer@1.2.1
+toidentifier@1.0.1
+@tokenizer/token@0.3.0
+token-stream@1.0.0
+token-types@4.2.1
+to-object-path@0.3.0
+@tootallnate/once@1.1.2
+@tootallnate/once@2.0.0
+to-regex@3.0.2
+to-regex-range@2.1.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+tr46@0.0.3
+traverse@0.3.9
+tree-kill@1.2.2
+trim-repeated@1.0.0
+triple-beam@1.4.1
+truncate-utf8-bytes@1.0.2
+tsconfig@7.0.0
+tslib@2.7.0
+ts-node@9.1.1
+ts-node-dev@1.1.8
+tunnel-agent@0.6.0
+typecast@0.0.1
+typedarray@0.0.6
+typed-array-buffer@1.0.3
+type-is@1.6.18
+@types/component-emitter@1.2.14
+@types/cookie@0.4.1
+@types/cors@2.8.19
+typescript@5.3.3
+@types/debug@4.1.12
+@types/ms@2.1.0
+@types/node@20.19.12
+@types/node@22.7.5
+@types/strip-bom@3.0.0
+@types/strip-json-comments@0.0.30
+@types/triple-beam@1.3.5
+@types/validator@13.15.3
+@types/ws@8.5.3
+uglify-js@3.19.3
+unbzip2-stream@1.4.3
+unc-path-regex@0.1.2
+underscore.string@3.3.6
+undici-types@6.19.8
+undici-types@6.21.0
+unicode-properties@1.4.1
+unicode-trie@2.0.0
+union-value@1.0.1
+unique-filename@1.1.1
+unique-filename@4.0.0
+unique-slug@2.0.2
+unique-slug@5.0.0
+unit-compare@1.0.1
+universalify@2.0.1
+unpipe@1.0.0
+unset-value@1.0.0
+untildify@2.1.0
+unzipper@0.9.15
+urix@0.1.0
+url-parse-lax@3.0.0
+url-to-options@1.0.1
+use@3.1.1
+utf8-byte-length@1.0.5
+util@0.12.5
+util-deprecate@1.0.2
+utils-merge@1.0.1
+uuid@8.3.2
+v8flags@3.2.0
+validate@4.5.1
+validator@13.15.15
+vary@1.1.2
+vm2@3.9.17
+void-elements@3.1.0
+walk@2.3.15
+walkdir@0.0.11
+web3@4.16.0
+web3-core@4.7.1
+web3-errors@1.3.1
+web3-eth@4.11.1
+web3-eth-abi@4.4.1
+web3-eth-accounts@4.3.1
+web3-eth-contract@4.7.2
+web3-eth-ens@4.4.0
+web3-eth-iban@4.0.7
+web3-eth-personal@4.1.0
+web3-net@4.1.0
+web3-providers-http@4.2.0
+web3-providers-ipc@4.0.7
+web3-providers-ws@4.0.8
+web3-rpc-methods@1.3.0
+web3-rpc-providers@1.0.0-rc.4
+web3-types@1.10.0
+web3-utils@4.3.3
+web3-validator@2.0.6
+webidl-conversions@3.0.1
+whatwg-url@5.0.0
+which@1.3.1
+which@2.0.2
+which@5.0.0
+which-boxed-primitive@1.1.1
+which-collection@1.0.2
+which-module@2.0.1
+which-pm-runs@1.1.0
+which-typed-array@1.1.19
+wide-align@1.1.3
+wide-align@1.1.5
+winston@3.17.0
+winston-transport@4.9.0
+with@7.0.2
+wkx@0.5.0
+wordwrap@0.0.3
+wordwrap@1.0.0
+wrap-ansi@6.2.0
+wrap-ansi@7.0.0
+wrap-ansi@8.1.0
+wrappy@1.0.2
+ws@7.4.6
+ws@8.17.1
+xtend@4.0.2
+y18n@4.0.3
+yallist@3.1.1
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@5.0.0
+yaml-schema-validator@1.2.3
+yargs@15.4.1
+yargs-parser@18.1.3
+yauzl@2.10.0
+yn@3.1.1
+z85@0.0.2
+zip-stream@1.2.0
+zod@3.25.76
diff --git a/labs/lab4/comparison/grype-cves.txt b/labs/lab4/comparison/grype-cves.txt
new file mode 100644
index 00000000..17cf609f
--- /dev/null
+++ b/labs/lab4/comparison/grype-cves.txt
@@ -0,0 +1,58 @@
+CVE-2010-4756
+CVE-2018-20796
+CVE-2019-1010022
+CVE-2019-1010023
+CVE-2019-1010024
+CVE-2019-1010025
+CVE-2019-9192
+CVE-2022-27943
+CVE-2025-27587
+CVE-2025-4802
+CVE-2025-8058
+CVE-2025-9230
+CVE-2025-9232
+GHSA-25hc-qcg6-38wj
+GHSA-2p57-rm9w-gvfp
+GHSA-35jh-r3h4-6jhm
+GHSA-3h5v-q93c-6h6q
+GHSA-3j7m-hmh3-9jmp
+GHSA-446m-mv8f-q348
+GHSA-44fp-w29j-9vj5
+GHSA-4pg4-qvpc-4q3h
+GHSA-4xc9-xhrj-v574
+GHSA-5mrr-rgp6-x4gr
+GHSA-6g6m-m6h5-w9gf
+GHSA-87vv-r9j6-g5qv
+GHSA-8cf7-32gw-wr33
+GHSA-8g4m-cjm2-96wq
+GHSA-8hfj-j24r-96c4
+GHSA-952p-6rrq-rcjv
+GHSA-c7hr-j4mj-j2w6
+GHSA-cchq-frgv-rjh5
+GHSA-cgfm-xwp7-2cvr
+GHSA-cqmj-92xf-r6r9
+GHSA-f5x3-32g6-xq36
+GHSA-fjgf-rc76-4x9p
+GHSA-fvqr-27wr-82fm
+GHSA-g5hg-p3ph-g8qg
+GHSA-g644-9gfx-q4q4
+GHSA-gjcw-v447-2w7q
+GHSA-grv7-fg5c-xmjg
+GHSA-hjrf-2m68-5959
+GHSA-jf85-cpcp-j695
+GHSA-mjxr-4v3x-q3m4
+GHSA-p5gc-c584-jj6v
+GHSA-p6mc-m468-83gw
+GHSA-pfrx-2q88-qq97
+GHSA-pxg6-pf52-xh8x
+GHSA-qhxp-v273-g94h
+GHSA-qwph-4952-7xr6
+GHSA-r7qp-cfhv-p84w
+GHSA-rc47-6667-2j5j
+GHSA-rjqq-98f6-6j3r
+GHSA-rm97-x556-q36h
+GHSA-rvg8-pwq2-xj7q
+GHSA-vj76-c3g6-qr5v
+GHSA-whpj-8f3w-67p5
+GHSA-xc6g-ggrc-qq4r
+GHSA-xwcq-pm8m-c4vf
diff --git a/labs/lab4/comparison/syft-only.txt b/labs/lab4/comparison/syft-only.txt
new file mode 100644
index 00000000..e5761d79
--- /dev/null
+++ b/labs/lab4/comparison/syft-only.txt
@@ -0,0 +1,13 @@
+baz@UNKNOWN
+browser_field@UNKNOWN
+false_main@UNKNOWN
+gcc-12-base@12.2.0-14+deb12u1
+hashids-esm@UNKNOWN
+invalid_main@UNKNOWN
+libc6@2.36-9+deb12u10
+libgcc-s1@12.2.0-14+deb12u1
+libgomp1@12.2.0-14+deb12u1
+libssl3@3.0.17-1~deb12u2
+libstdc++6@12.2.0-14+deb12u1
+node@22.18.0
+tzdata@2025b-0+deb12u1
diff --git a/labs/lab4/comparison/syft-packages.txt b/labs/lab4/comparison/syft-packages.txt
new file mode 100644
index 00000000..7091e4a9
--- /dev/null
+++ b/labs/lab4/comparison/syft-packages.txt
@@ -0,0 +1,1139 @@
+1to2@1.0.0
+abbrev@1.1.1
+abbrev@3.0.1
+abitype@0.7.1
+abort-controller@3.0.0
+accepts@1.3.8
+acorn@7.4.1
+acorn@8.15.0
+acorn-walk@8.3.4
+@adraffy/ens-normalize@1.10.1
+aes-js@4.0.0-beta.5
+agent-base@6.0.2
+agent-base@7.1.4
+agent-base@7.1.4
+agentkeepalive@4.6.0
+aggregate-error@3.1.0
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@3.0.1
+ansi-regex@5.0.1
+ansi-regex@6.2.0
+ansi-regex@6.2.0
+ansi-styles@2.2.1
+ansi-styles@3.2.1
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@6.2.1
+anymatch@3.1.3
+append-field@1.0.0
+aproba@1.2.0
+archiver@1.3.0
+archiver-utils@1.3.0
+archive-type@4.0.0
+are-we-there-yet@1.1.7
+are-we-there-yet@3.0.1
+arg@4.1.3
+argparse@1.0.10
+array-buffer-byte-length@1.0.2
+array-each@1.0.1
+array-flatten@1.1.1
+array-slice@1.1.0
+array-unique@0.3.2
+arr-diff@4.0.0
+arr-flatten@1.1.0
+arr-union@3.1.0
+asap@2.0.6
+assert-never@1.4.0
+assign-symbols@1.0.0
+async@2.6.4
+async@2.6.4
+async@3.2.6
+at-least-node@1.0.0
+atob@2.1.2
+available-typed-arrays@1.0.7
+@babel/helper-string-parser@7.27.1
+@babel/helper-validator-identifier@7.27.1
+@babel/parser@7.28.3
+@babel/types@7.28.2
+babel-walk@3.0.0-canary-5
+balanced-match@1.0.2
+base@0.11.2
+base64-arraybuffer@0.1.4
+base64id@2.0.0
+base64-js@0.0.8
+base64-js@1.5.1
+base64url@0.0.6
+base-files@12.4+deb12u11
+basic-auth@2.0.1
+batch@0.6.1
+baz@UNKNOWN
+beep-boop@1.2.3
+big-integer@1.6.52
+binary@0.3.0
+binary-extensions@2.3.0
+bindings@1.5.0
+bintrees@1.0.2
+bl@1.2.3
+bl@4.1.0
+bluebird@3.4.7
+bluebird@3.7.2
+body-parser@1.20.3
+bower-config@1.4.3
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@2.0.2
+braces@2.3.2
+braces@3.0.3
+braces@3.0.3
+braces@3.0.3
+brotli@1.3.3
+browser_field@UNKNOWN
+buffer@5.7.1
+buffer@6.0.3
+buffer-alloc@1.2.0
+buffer-alloc-unsafe@1.1.0
+buffer-crc32@0.2.13
+buffer-fill@1.0.0
+buffer-from@1.1.2
+buffer-indexof-polyfill@1.0.2
+buffers@0.1.1
+busboy@1.6.0
+byline@4.2.2
+bytes@3.1.2
+cacache@15.3.0
+cacache@19.0.1
+cacheable-request@2.1.4
+cache-base@1.0.1
+call-bind@1.0.8
+call-bind-apply-helpers@1.0.2
+call-bound@1.0.4
+camelcase@5.3.1
+chainsaw@0.1.0
+chalk@1.1.3
+chalk@2.4.2
+chalk@4.1.2
+character-parser@2.2.0
+check-dependencies@1.1.1
+check-internet-connected@2.0.6
+check-types@6.0.0
+chokidar@3.5.1
+chownr@1.1.4
+chownr@1.1.4
+chownr@2.0.0
+chownr@3.0.0
+clarinet@0.12.6
+class-utils@0.3.6
+clean-stack@2.2.0
+cliui@6.0.0
+clone@2.1.2
+clone-response@1.0.2
+code-point-at@1.1.0
+collection-visit@1.0.0
+color@3.2.1
+color-convert@1.9.3
+color-convert@2.0.1
+color-convert@2.0.1
+color-convert@2.0.1
+color-name@1.1.3
+color-name@1.1.4
+color-name@1.1.4
+color-name@1.1.4
+colors@1.1.2
+colors@1.4.0
+@colors/colors@1.6.0
+@colors/colors@1.6.0
+colorspace@1.1.4
+color-string@1.9.1
+color-support@1.1.3
+commander@2.20.3
+commander@2.20.3
+component-emitter@1.3.1
+component-type@1.2.1
+compress-commons@1.2.2
+compressible@2.0.18
+compression@1.8.1
+concat-map@0.0.1
+concat-stream@1.6.2
+config@3.3.12
+console-control-strings@1.1.0
+constantinople@4.0.1
+content-disposition@0.5.4
+content-type@1.0.5
+cookie@0.4.2
+cookie@0.7.1
+cookie@0.7.2
+cookie-parser@1.4.7
+cookie-signature@1.0.6
+copy-descriptor@0.1.1
+core-util-is@1.0.2
+cors@2.8.5
+crc-32@1.2.2
+crc32-stream@2.0.0
+crc@3.8.0
+create-require@1.1.1
+cross-fetch@4.1.0
+cross-fetch-polyfill@0.0.0
+cross-spawn@7.0.6
+crypto-js@3.3.0
+@dabh/diagnostics@2.0.3
+dateformat@4.6.3
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@3.2.7
+debug@4.3.7
+decamelize@1.2.0
+decode-uri-component@0.2.2
+decompress@4.2.1
+decompress-response@3.3.0
+decompress-response@4.2.1
+decompress-response@6.0.0
+decompress-response@6.0.0
+decompress-tar@4.1.1
+decompress-tarbz2@4.1.1
+decompress-targz@4.1.1
+decompress-unzip@4.0.1
+deep-equal@2.2.3
+deep-extend@0.6.0
+define-data-property@1.1.4
+define-properties@1.2.1
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@1.0.0
+define-property@1.0.0
+define-property@1.0.0
+define-property@2.0.2
+delegates@1.0.0
+depd@1.1.2
+depd@2.0.0
+destroy@1.2.0
+detect-file@1.0.0
+detect-libc@1.0.3
+detect-libc@2.0.4
+detect-libc@2.0.4
+dfa@1.2.0
+diff@4.0.2
+doctypes@1.1.0
+domelementtype@1.3.1
+domhandler@2.1.0
+domutils@1.1.6
+dottie@2.0.6
+double-ended-queue@0.9.7
+download@8.0.0
+dunder-proto@1.0.1
+duplexer2@0.1.4
+duplexer3@0.1.5
+dynamic-dedupe@0.3.0
+eastasianwidth@0.2.0
+ee-first@1.1.1
+eivindfjeldstad-dot@0.0.1
+emoji-regex@8.0.0
+emoji-regex@9.2.2
+emoji-regex@9.2.2
+enabled@2.0.0
+encodeurl@1.0.2
+encodeurl@2.0.0
+encoding@0.1.13
+end-of-stream@1.4.5
+engine.io@4.1.2
+engine.io-parser@4.0.3
+env-paths@2.2.1
+err-code@1.1.2
+err-code@2.0.3
+errorhandler@1.5.1
+escape-html@1.0.3
+escape-string-regexp@1.0.5
+escodegen@2.1.0
+es-define-property@1.0.1
+es-errors@1.3.0
+es-get-iterator@1.1.3
+es-object-atoms@1.1.1
+esprima@1.0.4
+esprima@4.0.1
+estraverse@5.3.0
+esutils@2.0.3
+etag@1.8.1
+ethereum-cryptography@2.2.1
+@ethereumjs/rlp@4.0.1
+@ethereumjs/rlp@5.0.2
+ethers@6.15.0
+eventemitter2@0.4.14
+eventemitter3@1.1.1
+eventemitter3@5.0.1
+events@3.3.0
+event-target-shim@5.0.1
+exit@0.1.2
+expand-brackets@2.1.4
+expand-template@2.0.3
+expand-tilde@2.0.2
+exponential-backoff@3.1.2
+express@4.21.2
+express-ipfilter@1.3.2
+express-jwt@0.1.3
+express-rate-limit@7.5.1
+express-robots-txt@0.4.1
+express-security.txt@2.0.0
+extend@3.0.2
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@3.0.2
+extglob@2.0.4
+ext-list@2.2.2
+ext-name@5.0.0
+false_main@UNKNOWN
+fast.js@0.1.1
+fdir@6.5.0
+fd-slicer@1.1.0
+feature-policy@0.5.0
+fecha@4.2.3
+filehound@1.17.6
+file-js@0.3.0
+filename-reserved-regex@2.0.0
+filenamify@3.0.0
+filesniffer@1.0.3
+file-stream-rotator@1.0.0
+file-type@11.1.0
+file-type@16.5.4
+file-type@3.9.0
+file-type@4.4.0
+file-type@5.2.0
+file-type@5.2.0
+file-type@6.2.0
+file-uri-to-path@1.0.0
+fill-range@4.0.0
+fill-range@7.1.1
+fill-range@7.1.1
+fill-range@7.1.1
+finale-rest@1.2.2
+finalhandler@1.3.1
+find-up@4.1.0
+findup-sync@2.0.0
+findup-sync@4.0.0
+findup-sync@5.0.0
+fined@1.2.0
+flagged-respawn@1.0.1
+fn.name@1.1.0
+fontkit@1.9.0
+for-each@0.3.5
+foreachasync@3.0.0
+foreground-child@3.3.1
+for-in@1.0.2
+formatio@1.1.1
+for-own@1.0.0
+forwarded@0.2.0
+fragment-cache@0.2.1
+fresh@0.5.2
+from2@2.3.0
+frontend@19.0.0
+fs-constants@1.0.0
+fs-extra@9.1.0
+fs-minipass@1.2.7
+fs-minipass@2.1.0
+fs-minipass@3.0.3
+fs.realpath@1.0.0
+fstream@1.0.12
+function-bind@1.1.2
+functions-have-names@1.2.3
+fuzzball@1.4.0
+@gar/promisify@1.1.3
+gauge@2.7.4
+gauge@4.0.4
+gcc-12-base@12.2.0-14+deb12u1
+geojson-utils@1.1.0
+get-caller-file@2.0.5
+get-intrinsic@1.3.0
+getobject@1.0.2
+get-proto@1.0.1
+get-stream@2.3.1
+get-stream@3.0.0
+get-stream@3.0.0
+get-stream@4.1.0
+get-value@2.0.6
+github-from-package@0.0.0
+glob@10.4.5
+glob@7.1.7
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+global-modules@1.0.0
+global-prefix@1.0.2
+glob-parent@5.1.2
+gopd@1.2.0
+got@8.3.2
+graceful-fs@4.2.11
+grunt@1.6.1
+grunt-cli@1.4.3
+grunt-contrib-compress@1.6.0
+grunt-known-options@2.0.0
+grunt-legacy-log@3.0.0
+grunt-legacy-log-utils@2.1.0
+grunt-legacy-util@2.0.1
+grunt-replace-json@0.1.0
+handlebars@4.7.7
+has-ansi@2.0.0
+has-bigints@1.1.0
+has-flag@3.0.0
+has-flag@4.0.0
+hashids@2.3.0
+hashids-esm@UNKNOWN
+hasown@2.0.2
+has-property-descriptors@1.0.2
+has-symbols@1.1.0
+has-symbol-support-x@1.4.2
+has-tostringtag@1.0.2
+has-to-string-tag-x@1.4.1
+has-unicode@2.0.1
+has-value@0.3.1
+has-value@1.0.0
+has-values@0.1.4
+has-values@1.0.0
+hbs@4.2.0
+he@0.4.1
+heap@0.2.7
+helmet@4.6.0
+hoister@0.0.2
+homedir-polyfill@1.0.3
+hooker@0.2.3
+html-entities@1.4.0
+htmlparser2@3.3.0
+http-cache-semantics@3.8.1
+http-cache-semantics@4.2.0
+http-cache-semantics@4.2.0
+http-errors@1.6.3
+http-errors@2.0.0
+http-proxy-agent@4.0.1
+http-proxy-agent@5.0.0
+http-proxy-agent@7.0.2
+https-proxy-agent@5.0.1
+https-proxy-agent@7.0.6
+humanize-ms@1.2.1
+i18n@0.11.1
+iconv-lite@0.4.24
+iconv-lite@0.6.3
+iconv-lite@0.6.3
+ieee754@1.2.1
+ignore-walk@3.0.4
+iltorb@2.4.5
+imurmurhash@0.1.4
+indent-string@4.0.0
+infer-owner@1.0.4
+inflection@1.13.4
+inflight@1.0.6
+inherits@2.0.3
+inherits@2.0.4
+ini@1.3.8
+ini@1.3.8
+internal-slot@1.1.0
+interpret@1.1.0
+into-stream@3.1.0
+invalid_main@UNKNOWN
+invariant@2.2.4
+ip@2.0.1
+ip6@0.2.11
+ip-address@10.0.1
+ipaddr.js@1.9.1
+@isaacs/cliui@8.0.2
+@isaacs/fs-minipass@4.0.1
+is-absolute@1.0.0
+is-accessor-descriptor@1.0.1
+is-arguments@1.2.0
+isarray@0.0.1
+isarray@1.0.0
+isarray@1.0.0
+isarray@2.0.5
+is-array-buffer@3.0.5
+is-arrayish@0.3.2
+is-bigint@1.1.0
+is-binary-path@2.1.0
+is-boolean-object@1.2.2
+is-buffer@1.1.6
+is-callable@1.2.7
+is-core-module@2.16.1
+is-data-descriptor@1.0.1
+is-date-object@1.1.0
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@1.0.3
+isexe@2.0.0
+isexe@3.1.1
+is-expression@4.0.0
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@1.0.1
+is-extglob@2.1.1
+is-fullwidth-code-point@1.0.0
+is-fullwidth-code-point@2.0.0
+is-fullwidth-code-point@3.0.0
+is-generator-function@1.1.0
+is-glob@3.1.0
+is-glob@4.0.3
+is-lambda@1.0.1
+is-map@2.0.3
+is-natural-number@4.0.1
+is-number@3.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number-like@1.0.8
+is-number-object@1.1.1
+is-object@1.0.2
+isobject@2.1.0
+isobject@3.0.1
+isomorphic-ws@5.0.0
+is-plain-obj@1.1.0
+is-plain-object@2.0.4
+is-promise@2.2.2
+is-regex@1.2.1
+is-relative@1.0.0
+is-retry-allowed@1.2.0
+is-set@2.0.3
+is-shared-array-buffer@1.0.4
+is-stream@1.1.0
+is-stream@2.0.1
+is-string@1.1.1
+is-symbol@1.1.1
+is-typed-array@1.1.15
+is-unc-path@1.0.0
+isurl@1.0.0
+is-weakmap@2.0.2
+is-weakset@2.0.4
+is-windows@1.0.2
+jackspeak@3.4.3
+json5@2.2.3
+json-buffer@3.0.0
+jsonfile@6.2.0
+jsonwebtoken@0.1.0
+jsonwebtoken@0.4.0
+jssha@3.3.1
+js-stringify@1.0.2
+js-tokens@4.0.0
+jstransformer@1.0.0
+js-yaml@3.14.1
+juice-shop@19.0.0
+juice-shop@19.0.0
+juicy-chat-bot@0.9.0
+jwa@0.0.1
+jws@0.2.6
+keyv@3.0.0
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@4.0.0
+kind-of@6.0.3
+kuler@2.0.0
+lazystream@1.0.1
+libc6@2.36-9+deb12u10
+libgcc-s1@12.2.0-14+deb12u1
+libgomp1@12.2.0-14+deb12u1
+libssl3@3.0.17-1~deb12u2
+libstdc++6@12.2.0-14+deb12u1
+libxmljs2@0.37.0
+liftup@3.0.1
+linebreak@1.1.0
+listenercount@1.0.1
+ljharb-monorepo-symlink-test@0.0.0
+locate-path@5.0.0
+lodash@2.4.2
+lodash@4.17.21
+lodash.camelcase@4.3.0
+lodash.isfinite@3.3.2
+lodash.set@4.3.2
+logform@2.7.0
+lolex@1.3.2
+loose-envify@1.4.0
+lowercase-keys@1.0.0
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@6.0.0
+make-dir@1.3.0
+make-dir@2.1.0
+make-error@1.3.6
+make-fetch-happen@14.0.3
+make-fetch-happen@9.1.0
+make-iterator@1.0.1
+make-plural@4.3.0
+make-plural@6.2.2
+map-cache@0.2.2
+map-visit@1.0.0
+marsdb@0.6.11
+math-interval-parser@2.0.1
+math-intrinsics@1.1.0
+median@0.0.2
+media-typer@0.3.0
+media-types@10.0.0
+merge-descriptors@1.0.3
+messageformat@2.3.0
+messageformat-formatters@2.0.1
+messageformat-parser@4.1.3
+methods@1.1.2
+micromatch@3.1.10
+micromatch@4.0.8
+micromatch@4.0.8
+mime@1.6.0
+mime-db@1.52.0
+mime-types@2.1.35
+mimic-response@1.0.1
+mimic-response@2.1.0
+mimic-response@3.1.0
+mimic-response@3.1.0
+minami@1.1.1
+minami@1.1.1
+minami@1.1.1
+minimatch@3.0.5
+minimatch@3.0.8
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@5.1.6
+minimatch@9.0.5
+minimist@0.2.4
+minimist@1.2.8
+minipass@2.9.0
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@5.0.0
+minipass@7.1.2
+minipass-collect@1.0.2
+minipass-collect@2.0.1
+minipass-fetch@1.4.1
+minipass-fetch@4.0.1
+minipass-flush@1.0.5
+minipass-pipeline@1.2.4
+minipass-sized@1.0.3
+minizlib@1.3.3
+minizlib@2.1.2
+minizlib@3.0.2
+mixin-deep@1.3.2
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@1.0.4
+mkdirp@3.0.1
+mkdirp@3.0.1
+mkdirp-classic@0.5.3
+moment@2.0.0
+moment@2.30.1
+moment-timezone@0.5.48
+morgan@1.10.1
+mout@1.2.4
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.1.3
+multer@1.4.5-lts.2
+mustache@4.2.0
+mylib@0.0.0
+@my-scope/package-a@0.0.0
+@my-scope/package-b@0.0.0
+nan@2.22.2
+nanomatch@1.2.13
+napi-build-utils@1.0.2
+napi-build-utils@2.0.0
+napi-build-utils@2.0.0
+needle@2.9.1
+negotiator@0.6.3
+negotiator@0.6.4
+negotiator@1.0.0
+neo-async@2.6.2
+netbase@6.4
+@nlpjs/core@4.26.1
+@nlpjs/core-loader@4.26.1
+@nlpjs/evaluator@4.26.1
+@nlpjs/lang-en@4.26.1
+@nlpjs/lang-en-min@4.26.1
+@nlpjs/language@4.25.0
+@nlpjs/language-min@4.25.0
+@nlpjs/ner@4.27.0
+@nlpjs/neural@4.25.0
+@nlpjs/nlg@4.26.1
+@nlpjs/nlp@4.27.0
+@nlpjs/nlu@4.27.0
+@nlpjs/request@4.25.0
+@nlpjs/sentiment@4.26.1
+@nlpjs/similarity@4.26.1
+@nlpjs/slot@4.26.1
+@noble/curves@1.2.0
+@noble/curves@1.4.2
+@noble/curves@1.4.2
+@noble/hashes@1.3.2
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+node@22.18.0
+node-abi@2.30.1
+node-abi@3.77.0
+node-abi@3.77.0
+node-addon-api@7.1.1
+node-fetch@2.7.0
+node-gyp@11.4.2
+node-gyp@8.4.1
+node-pre-gyp@0.15.0
+noop-logger@0.1.1
+nopt@3.0.6
+nopt@4.0.3
+nopt@4.0.3
+nopt@5.0.0
+nopt@8.1.0
+normalize-path@2.1.1
+normalize-path@3.0.0
+normalize-path@3.0.0
+normalize-url@2.0.1
+notevil@1.3.3
+npm-bundled@1.1.2
+@npmcli/agent@3.0.0
+@npmcli/fs@1.1.1
+@npmcli/fs@4.0.0
+@npmcli/move-file@1.1.2
+npmlog@4.1.2
+npmlog@6.0.2
+npm-normalize-package-bin@1.0.1
+npm-packlist@1.4.8
+number-is-nan@1.0.1
+nw-pre-gyp-module-test@0.0.1
+object-assign@4.1.1
+object.assign@4.1.7
+object-copy@0.1.0
+object.defaults@1.1.0
+object-inspect@1.13.4
+object-is@1.1.6
+object-keys@1.1.1
+object.map@1.0.1
+object.pick@1.3.0
+object-visit@1.0.1
+once@1.4.0
+one-time@1.0.0
+on-finished@2.3.0
+on-finished@2.4.1
+on-headers@1.1.0
+opentype.js@0.7.3
+osenv@0.1.5
+os-homedir@1.0.2
+os-tmpdir@1.0.2
+otplib@12.0.1
+@otplib/core@12.0.1
+@otplib/plugin-crypto@12.0.1
+@otplib/plugin-thirty-two@12.0.1
+@otplib/preset-default@12.0.1
+@otplib/preset-v11@12.0.1
+package-json-from-dist@1.0.1
+pako@0.2.9
+parse-filepath@1.0.2
+parse-passwd@1.0.0
+parseurl@1.3.3
+pascalcase@0.1.1
+path-exists@4.0.0
+path-is-absolute@1.0.1
+path-key@3.1.1
+path-parse@1.0.7
+path-root@0.1.1
+path-root-regex@0.1.2
+path-scurry@1.11.1
+path-to-regexp@0.1.12
+p-cancelable@0.4.1
+pdfkit@0.11.0
+peek-readable@4.1.0
+pend@1.2.0
+p-event@2.3.1
+p-finally@1.0.0
+pg-connection-string@2.9.1
+picomatch@2.3.1
+picomatch@4.0.3
+pify@2.3.0
+pify@2.3.0
+pify@3.0.0
+pify@3.0.0
+pify@4.0.1
+pinkie@2.0.4
+pinkie-promise@2.0.1
+p-is-promise@1.1.0
+@pkgjs/parseargs@0.11.0
+p-limit@2.3.0
+p-locate@4.1.0
+p-map@4.0.0
+p-map@7.0.3
+png-js@1.0.0
+posix-character-classes@0.1.1
+possible-typed-array-names@1.1.0
+prebuild-install@5.3.6
+prebuild-install@7.1.3
+prebuild-install@7.1.3
+prepend-http@2.0.0
+pretty-bytes@4.0.2
+process@0.11.10
+process-nextick-args@2.0.1
+proc-log@5.0.0
+prom-client@14.2.0
+promise@7.3.1
+promise-inflight@1.0.1
+promise-retry@2.0.1
+proper-lockfile@1.2.0
+proxy-addr@2.0.7
+p-timeout@2.0.1
+p-try@2.2.0
+pug@3.0.3
+pug-attrs@3.0.0
+pug-code-gen@3.0.3
+pug-error@2.1.0
+pug-filters@4.0.0
+pug-lexer@5.0.1
+pug-linker@4.0.0
+pug-load@3.0.0
+pug-parser@6.0.0
+pug-runtime@3.0.1
+pug-strip-comments@2.0.0
+pug-walk@2.0.0
+pump@3.0.3
+qs@6.13.0
+query-string@5.1.1
+range_check@2.0.4
+range-parser@1.2.1
+raw-body@2.5.2
+rc@1.2.8
+readable-stream@1.0.34
+readable-stream@2.3.8
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@4.7.0
+readable-web-to-node-stream@3.0.4
+readdirp@3.5.0
+rechoir@0.7.1
+recursedir-comparisons@0.0.0
+regex-not@1.0.2
+regexp.prototype.flags@1.5.4
+remove-trailing-separator@1.1.0
+repeat-element@1.1.4
+repeat-string@1.6.1
+replace@1.2.2
+require-directory@2.1.1
+require-main-filename@2.0.0
+resolve@1.22.10
+resolve-dir@1.0.1
+resolve-url@0.2.1
+responselike@1.0.2
+restructure@2.0.1
+ret@0.1.15
+retry@0.10.1
+retry@0.12.0
+retry-as-promised@7.1.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@3.0.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.2.1
+safer-buffer@2.1.2
+safe-regex@1.1.0
+safe-regex-test@1.1.0
+safe-stable-stringify@2.5.0
+samsam@1.1.2
+sanitize-filename@1.6.3
+sanitize-html@1.4.2
+sax@1.4.1
+@scarf/scarf@1.4.0
+@scure/base@1.1.9
+@scure/bip32@1.4.0
+@scure/bip39@1.3.0
+seek-bzip@1.0.6
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@7.7.2
+send@0.19.0
+sequelize@6.37.7
+sequelize-pool@7.1.0
+serve-index@1.9.1
+serve-static@1.16.2
+set-blocking@2.0.0
+set-function-length@1.2.2
+set-function-name@2.0.2
+setimmediate@1.0.5
+setprototypeof@1.1.0
+setprototypeof@1.2.0
+set-value@2.0.1
+shebang-command@2.0.0
+shebang-regex@3.0.0
+side-channel@1.1.0
+side-channel-list@1.0.0
+side-channel-map@1.0.1
+side-channel-weakmap@1.0.2
+signal-exit@3.0.7
+signal-exit@4.1.0
+simple-concat@1.0.1
+simple-get@3.1.1
+simple-get@4.0.1
+simple-get@4.0.1
+simple-swizzle@0.2.2
+@sindresorhus/is@0.7.0
+sinon@1.17.7
+smart-buffer@4.2.0
+snapdragon@0.8.2
+snapdragon-node@2.1.1
+snapdragon-util@3.0.1
+socket.io@3.1.2
+socket.io-adapter@2.1.0
+socket.io-parser@4.0.5
+socks@2.8.7
+socks-proxy-agent@6.2.1
+socks-proxy-agent@8.0.5
+sort-keys@1.1.2
+sort-keys@2.0.0
+sort-keys-length@1.0.1
+source-map@0.5.7
+source-map@0.6.1
+source-map-resolve@0.5.3
+source-map-support@0.5.21
+source-map-url@0.4.1
+split-string@3.1.0
+sprintf-js@1.0.3
+sprintf-js@1.1.3
+sqlite3@5.1.7
+ssri@12.0.0
+ssri@8.0.1
+stack-trace@0.0.10
+static-extend@0.1.2
+statuses@1.5.0
+statuses@2.0.1
+stop-iteration-iterator@1.1.0
+stream-buffers@2.2.0
+streamsearch@1.1.0
+strict-uri-encode@1.1.0
+string_decoder@0.10.31
+string_decoder@1.1.1
+string_decoder@1.3.0
+string.fromcodepoint@0.2.1
+string.prototype.codepointat@0.2.1
+string-width@1.0.2
+string-width@2.1.1
+string-width@4.2.3
+string-width@4.2.3
+string-width@5.1.2
+string-width@5.1.2
+strip-ansi@3.0.1
+strip-ansi@3.0.1
+strip-ansi@4.0.0
+strip-ansi@6.0.1
+strip-ansi@6.0.1
+strip-ansi@7.1.0
+strip-ansi@7.1.0
+strip-bom@3.0.0
+strip-dirs@2.1.0
+strip-json-comments@2.0.1
+strip-json-comments@2.0.1
+strip-outer@1.0.1
+strtok3@6.3.0
+supports-color@2.0.0
+supports-color@5.5.0
+supports-color@7.2.0
+supports-preserve-symlinks-flag@1.0.0
+svg-captcha@1.4.0
+swagger-ui-dist@5.28.1
+swagger-ui-express@5.0.1
+@swc/helpers@0.3.17
+tar@4.4.19
+tar@6.2.1
+tar@7.4.3
+tar-fs@2.1.3
+tar-stream@1.6.2
+tar-stream@2.2.0
+tdigest@0.1.2
+text-hex@1.0.0
+thirty-two@1.0.2
+through@2.3.8
+timed-out@4.0.1
+tinyglobby@0.2.14
+tiny-inflate@1.0.3
+to-buffer@1.2.1
+toidentifier@1.0.1
+@tokenizer/token@0.3.0
+token-stream@1.0.0
+token-types@4.2.1
+to-object-path@0.3.0
+@tootallnate/once@1.1.2
+@tootallnate/once@2.0.0
+to-regex@3.0.2
+to-regex-range@2.1.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+tr46@0.0.3
+traverse@0.3.9
+tree-kill@1.2.2
+trim-repeated@1.0.0
+triple-beam@1.4.1
+truncate-utf8-bytes@1.0.2
+tsconfig@7.0.0
+tslib@2.7.0
+ts-node@9.1.1
+ts-node-dev@1.1.8
+tunnel-agent@0.6.0
+typecast@0.0.1
+typedarray@0.0.6
+typed-array-buffer@1.0.3
+type-is@1.6.18
+@types/component-emitter@1.2.14
+@types/cookie@0.4.1
+@types/cors@2.8.19
+typescript@5.3.3
+@types/debug@4.1.12
+@types/ms@2.1.0
+@types/node@20.19.12
+@types/node@22.7.5
+@types/strip-bom@3.0.0
+@types/strip-json-comments@0.0.30
+@types/triple-beam@1.3.5
+@types/validator@13.15.3
+@types/ws@8.5.3
+tzdata@2025b-0+deb12u1
+uglify-js@3.19.3
+unbzip2-stream@1.4.3
+unc-path-regex@0.1.2
+underscore.string@3.3.6
+undici-types@6.19.8
+undici-types@6.21.0
+unicode-properties@1.4.1
+unicode-trie@2.0.0
+union-value@1.0.1
+unique-filename@1.1.1
+unique-filename@4.0.0
+unique-slug@2.0.2
+unique-slug@5.0.0
+unit-compare@1.0.1
+universalify@2.0.1
+unpipe@1.0.0
+unset-value@1.0.0
+untildify@2.1.0
+unzipper@0.9.15
+urix@0.1.0
+url-parse-lax@3.0.0
+url-to-options@1.0.1
+use@3.1.1
+utf8-byte-length@1.0.5
+util@0.12.5
+util-deprecate@1.0.2
+utils-merge@1.0.1
+uuid@8.3.2
+v8flags@3.2.0
+validate@4.5.1
+validator@13.15.15
+vary@1.1.2
+vm2@3.9.17
+void-elements@3.1.0
+walk@2.3.15
+walkdir@0.0.11
+web3@4.16.0
+web3-core@4.7.1
+web3-errors@1.3.1
+web3-eth@4.11.1
+web3-eth-abi@4.4.1
+web3-eth-accounts@4.3.1
+web3-eth-contract@4.7.2
+web3-eth-ens@4.4.0
+web3-eth-iban@4.0.7
+web3-eth-personal@4.1.0
+web3-net@4.1.0
+web3-providers-http@4.2.0
+web3-providers-ipc@4.0.7
+web3-providers-ws@4.0.8
+web3-rpc-methods@1.3.0
+web3-rpc-providers@1.0.0-rc.4
+web3-types@1.10.0
+web3-utils@4.3.3
+web3-validator@2.0.6
+webidl-conversions@3.0.1
+whatwg-url@5.0.0
+which@1.3.1
+which@2.0.2
+which@5.0.0
+which-boxed-primitive@1.1.1
+which-collection@1.0.2
+which-module@2.0.1
+which-pm-runs@1.1.0
+which-typed-array@1.1.19
+wide-align@1.1.3
+wide-align@1.1.5
+winston@3.17.0
+winston-transport@4.9.0
+with@7.0.2
+wkx@0.5.0
+wordwrap@0.0.3
+wordwrap@1.0.0
+wrap-ansi@6.2.0
+wrap-ansi@7.0.0
+wrap-ansi@8.1.0
+wrappy@1.0.2
+ws@7.4.6
+ws@8.17.1
+xtend@4.0.2
+y18n@4.0.3
+yallist@3.1.1
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@5.0.0
+yaml-schema-validator@1.2.3
+yargs@15.4.1
+yargs-parser@18.1.3
+yauzl@2.10.0
+yn@3.1.1
+z85@0.0.2
+zip-stream@1.2.0
+zod@3.25.76
diff --git a/labs/lab4/comparison/trivy-cves.txt b/labs/lab4/comparison/trivy-cves.txt
new file mode 100644
index 00000000..708e9dc4
--- /dev/null
+++ b/labs/lab4/comparison/trivy-cves.txt
@@ -0,0 +1,62 @@
+CVE-2010-4756
+CVE-2015-9235
+CVE-2016-1000223
+CVE-2016-1000237
+CVE-2016-4055
+CVE-2017-16016
+CVE-2017-18214
+CVE-2018-16487
+CVE-2018-20796
+CVE-2018-3721
+CVE-2019-1010022
+CVE-2019-1010023
+CVE-2019-1010024
+CVE-2019-1010025
+CVE-2019-10744
+CVE-2019-25225
+CVE-2019-9192
+CVE-2020-15084
+CVE-2020-8203
+CVE-2021-23337
+CVE-2021-23771
+CVE-2021-26539
+CVE-2021-26540
+CVE-2022-23539
+CVE-2022-23540
+CVE-2022-23541
+CVE-2022-24785
+CVE-2022-25881
+CVE-2022-25887
+CVE-2022-27943
+CVE-2022-33987
+CVE-2022-41940
+CVE-2023-32313
+CVE-2023-32314
+CVE-2023-32695
+CVE-2023-37466
+CVE-2023-37903
+CVE-2023-46233
+CVE-2024-21501
+CVE-2024-28863
+CVE-2024-29415
+CVE-2024-37890
+CVE-2024-38355
+CVE-2024-4067
+CVE-2024-4068
+CVE-2024-47764
+CVE-2025-27587
+CVE-2025-47935
+CVE-2025-47944
+CVE-2025-4802
+CVE-2025-48997
+CVE-2025-57349
+CVE-2025-59343
+CVE-2025-7338
+CVE-2025-8058
+CVE-2025-9230
+CVE-2025-9232
+GHSA-5mrr-rgp6-x4gr
+GHSA-rvg8-pwq2-xj7q
+NSWG-ECO-154
+NSWG-ECO-17
+NSWG-ECO-428
diff --git a/labs/lab4/comparison/trivy-only.txt b/labs/lab4/comparison/trivy-only.txt
new file mode 100644
index 00000000..eb056b32
--- /dev/null
+++ b/labs/lab4/comparison/trivy-only.txt
@@ -0,0 +1,9 @@
+gcc-12-base@12.2.0
+libc6@2.36
+libgcc-s1@12.2.0
+libgomp1@12.2.0
+libssl3@3.0.17
+libstdc++6@12.2.0
+portscanner@2.2.0
+toposort-class@1.0.1
+tzdata@2025b
diff --git a/labs/lab4/comparison/trivy-packages.txt b/labs/lab4/comparison/trivy-packages.txt
new file mode 100644
index 00000000..e807fc96
--- /dev/null
+++ b/labs/lab4/comparison/trivy-packages.txt
@@ -0,0 +1,1135 @@
+1to2@1.0.0
+abbrev@1.1.1
+abbrev@3.0.1
+abitype@0.7.1
+abort-controller@3.0.0
+accepts@1.3.8
+acorn@7.4.1
+acorn@8.15.0
+acorn-walk@8.3.4
+@adraffy/ens-normalize@1.10.1
+aes-js@4.0.0-beta.5
+agent-base@6.0.2
+agent-base@7.1.4
+agent-base@7.1.4
+agentkeepalive@4.6.0
+aggregate-error@3.1.0
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@3.0.1
+ansi-regex@5.0.1
+ansi-regex@6.2.0
+ansi-regex@6.2.0
+ansi-styles@2.2.1
+ansi-styles@3.2.1
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@6.2.1
+anymatch@3.1.3
+append-field@1.0.0
+aproba@1.2.0
+archiver@1.3.0
+archiver-utils@1.3.0
+archive-type@4.0.0
+are-we-there-yet@1.1.7
+are-we-there-yet@3.0.1
+arg@4.1.3
+argparse@1.0.10
+array-buffer-byte-length@1.0.2
+array-each@1.0.1
+array-flatten@1.1.1
+array-slice@1.1.0
+array-unique@0.3.2
+arr-diff@4.0.0
+arr-flatten@1.1.0
+arr-union@3.1.0
+asap@2.0.6
+assert-never@1.4.0
+assign-symbols@1.0.0
+async@2.6.4
+async@2.6.4
+async@3.2.6
+at-least-node@1.0.0
+atob@2.1.2
+available-typed-arrays@1.0.7
+@babel/helper-string-parser@7.27.1
+@babel/helper-validator-identifier@7.27.1
+@babel/parser@7.28.3
+@babel/types@7.28.2
+babel-walk@3.0.0-canary-5
+balanced-match@1.0.2
+base@0.11.2
+base64-arraybuffer@0.1.4
+base64id@2.0.0
+base64-js@0.0.8
+base64-js@1.5.1
+base64url@0.0.6
+base-files@12.4+deb12u11
+basic-auth@2.0.1
+batch@0.6.1
+beep-boop@1.2.3
+big-integer@1.6.52
+binary@0.3.0
+binary-extensions@2.3.0
+bindings@1.5.0
+bintrees@1.0.2
+bl@1.2.3
+bl@4.1.0
+bluebird@3.4.7
+bluebird@3.7.2
+body-parser@1.20.3
+bower-config@1.4.3
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@2.0.2
+braces@2.3.2
+braces@3.0.3
+braces@3.0.3
+braces@3.0.3
+brotli@1.3.3
+buffer@5.7.1
+buffer@6.0.3
+buffer-alloc@1.2.0
+buffer-alloc-unsafe@1.1.0
+buffer-crc32@0.2.13
+buffer-fill@1.0.0
+buffer-from@1.1.2
+buffer-indexof-polyfill@1.0.2
+buffers@0.1.1
+busboy@1.6.0
+byline@4.2.2
+bytes@3.1.2
+cacache@15.3.0
+cacache@19.0.1
+cacheable-request@2.1.4
+cache-base@1.0.1
+call-bind@1.0.8
+call-bind-apply-helpers@1.0.2
+call-bound@1.0.4
+camelcase@5.3.1
+chainsaw@0.1.0
+chalk@1.1.3
+chalk@2.4.2
+chalk@4.1.2
+character-parser@2.2.0
+check-dependencies@1.1.1
+check-internet-connected@2.0.6
+check-types@6.0.0
+chokidar@3.5.1
+chownr@1.1.4
+chownr@1.1.4
+chownr@2.0.0
+chownr@3.0.0
+clarinet@0.12.6
+class-utils@0.3.6
+clean-stack@2.2.0
+cliui@6.0.0
+clone@2.1.2
+clone-response@1.0.2
+code-point-at@1.1.0
+collection-visit@1.0.0
+color@3.2.1
+color-convert@1.9.3
+color-convert@2.0.1
+color-convert@2.0.1
+color-convert@2.0.1
+color-name@1.1.3
+color-name@1.1.4
+color-name@1.1.4
+color-name@1.1.4
+colors@1.1.2
+colors@1.4.0
+@colors/colors@1.6.0
+@colors/colors@1.6.0
+colorspace@1.1.4
+color-string@1.9.1
+color-support@1.1.3
+commander@2.20.3
+commander@2.20.3
+component-emitter@1.3.1
+component-type@1.2.1
+compress-commons@1.2.2
+compressible@2.0.18
+compression@1.8.1
+concat-map@0.0.1
+concat-stream@1.6.2
+config@3.3.12
+console-control-strings@1.1.0
+constantinople@4.0.1
+content-disposition@0.5.4
+content-type@1.0.5
+cookie@0.4.2
+cookie@0.7.1
+cookie@0.7.2
+cookie-parser@1.4.7
+cookie-signature@1.0.6
+copy-descriptor@0.1.1
+core-util-is@1.0.2
+cors@2.8.5
+crc-32@1.2.2
+crc32-stream@2.0.0
+crc@3.8.0
+create-require@1.1.1
+cross-fetch@4.1.0
+cross-fetch-polyfill@0.0.0
+cross-spawn@7.0.6
+crypto-js@3.3.0
+@dabh/diagnostics@2.0.3
+dateformat@4.6.3
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@3.2.7
+debug@4.3.7
+decamelize@1.2.0
+decode-uri-component@0.2.2
+decompress@4.2.1
+decompress-response@3.3.0
+decompress-response@4.2.1
+decompress-response@6.0.0
+decompress-response@6.0.0
+decompress-tar@4.1.1
+decompress-tarbz2@4.1.1
+decompress-targz@4.1.1
+decompress-unzip@4.0.1
+deep-equal@2.2.3
+deep-extend@0.6.0
+define-data-property@1.1.4
+define-properties@1.2.1
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@1.0.0
+define-property@1.0.0
+define-property@1.0.0
+define-property@2.0.2
+delegates@1.0.0
+depd@1.1.2
+depd@2.0.0
+destroy@1.2.0
+detect-file@1.0.0
+detect-libc@1.0.3
+detect-libc@2.0.4
+detect-libc@2.0.4
+dfa@1.2.0
+diff@4.0.2
+doctypes@1.1.0
+domelementtype@1.3.1
+domhandler@2.1.0
+domutils@1.1.6
+dottie@2.0.6
+double-ended-queue@0.9.7
+download@8.0.0
+dunder-proto@1.0.1
+duplexer2@0.1.4
+duplexer3@0.1.5
+dynamic-dedupe@0.3.0
+eastasianwidth@0.2.0
+ee-first@1.1.1
+eivindfjeldstad-dot@0.0.1
+emoji-regex@8.0.0
+emoji-regex@9.2.2
+emoji-regex@9.2.2
+enabled@2.0.0
+encodeurl@1.0.2
+encodeurl@2.0.0
+encoding@0.1.13
+end-of-stream@1.4.5
+engine.io@4.1.2
+engine.io-parser@4.0.3
+env-paths@2.2.1
+err-code@1.1.2
+err-code@2.0.3
+errorhandler@1.5.1
+escape-html@1.0.3
+escape-string-regexp@1.0.5
+escodegen@2.1.0
+es-define-property@1.0.1
+es-errors@1.3.0
+es-get-iterator@1.1.3
+es-object-atoms@1.1.1
+esprima@1.0.4
+esprima@4.0.1
+estraverse@5.3.0
+esutils@2.0.3
+etag@1.8.1
+ethereum-cryptography@2.2.1
+@ethereumjs/rlp@4.0.1
+@ethereumjs/rlp@5.0.2
+ethers@6.15.0
+eventemitter2@0.4.14
+eventemitter3@1.1.1
+eventemitter3@5.0.1
+events@3.3.0
+event-target-shim@5.0.1
+exit@0.1.2
+expand-brackets@2.1.4
+expand-template@2.0.3
+expand-tilde@2.0.2
+exponential-backoff@3.1.2
+express@4.21.2
+express-ipfilter@1.3.2
+express-jwt@0.1.3
+express-rate-limit@7.5.1
+express-robots-txt@0.4.1
+express-security.txt@2.0.0
+extend@3.0.2
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@3.0.2
+extglob@2.0.4
+ext-list@2.2.2
+ext-name@5.0.0
+fast.js@0.1.1
+fdir@6.5.0
+fd-slicer@1.1.0
+feature-policy@0.5.0
+fecha@4.2.3
+filehound@1.17.6
+file-js@0.3.0
+filename-reserved-regex@2.0.0
+filenamify@3.0.0
+filesniffer@1.0.3
+file-stream-rotator@1.0.0
+file-type@11.1.0
+file-type@16.5.4
+file-type@3.9.0
+file-type@4.4.0
+file-type@5.2.0
+file-type@5.2.0
+file-type@6.2.0
+file-uri-to-path@1.0.0
+fill-range@4.0.0
+fill-range@7.1.1
+fill-range@7.1.1
+fill-range@7.1.1
+finale-rest@1.2.2
+finalhandler@1.3.1
+find-up@4.1.0
+findup-sync@2.0.0
+findup-sync@4.0.0
+findup-sync@5.0.0
+fined@1.2.0
+flagged-respawn@1.0.1
+fn.name@1.1.0
+fontkit@1.9.0
+for-each@0.3.5
+foreachasync@3.0.0
+foreground-child@3.3.1
+for-in@1.0.2
+formatio@1.1.1
+for-own@1.0.0
+forwarded@0.2.0
+fragment-cache@0.2.1
+fresh@0.5.2
+from2@2.3.0
+frontend@19.0.0
+fs-constants@1.0.0
+fs-extra@9.1.0
+fs-minipass@1.2.7
+fs-minipass@2.1.0
+fs-minipass@3.0.3
+fs.realpath@1.0.0
+fstream@1.0.12
+function-bind@1.1.2
+functions-have-names@1.2.3
+fuzzball@1.4.0
+@gar/promisify@1.1.3
+gauge@2.7.4
+gauge@4.0.4
+gcc-12-base@12.2.0
+geojson-utils@1.1.0
+get-caller-file@2.0.5
+get-intrinsic@1.3.0
+getobject@1.0.2
+get-proto@1.0.1
+get-stream@2.3.1
+get-stream@3.0.0
+get-stream@3.0.0
+get-stream@4.1.0
+get-value@2.0.6
+github-from-package@0.0.0
+glob@10.4.5
+glob@7.1.7
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+global-modules@1.0.0
+global-prefix@1.0.2
+glob-parent@5.1.2
+gopd@1.2.0
+got@8.3.2
+graceful-fs@4.2.11
+grunt@1.6.1
+grunt-cli@1.4.3
+grunt-contrib-compress@1.6.0
+grunt-known-options@2.0.0
+grunt-legacy-log@3.0.0
+grunt-legacy-log-utils@2.1.0
+grunt-legacy-util@2.0.1
+grunt-replace-json@0.1.0
+handlebars@4.7.7
+has-ansi@2.0.0
+has-bigints@1.1.0
+has-flag@3.0.0
+has-flag@4.0.0
+hashids@2.3.0
+hasown@2.0.2
+has-property-descriptors@1.0.2
+has-symbols@1.1.0
+has-symbol-support-x@1.4.2
+has-tostringtag@1.0.2
+has-to-string-tag-x@1.4.1
+has-unicode@2.0.1
+has-value@0.3.1
+has-value@1.0.0
+has-values@0.1.4
+has-values@1.0.0
+hbs@4.2.0
+he@0.4.1
+heap@0.2.7
+helmet@4.6.0
+hoister@0.0.2
+homedir-polyfill@1.0.3
+hooker@0.2.3
+html-entities@1.4.0
+htmlparser2@3.3.0
+http-cache-semantics@3.8.1
+http-cache-semantics@4.2.0
+http-cache-semantics@4.2.0
+http-errors@1.6.3
+http-errors@2.0.0
+http-proxy-agent@4.0.1
+http-proxy-agent@5.0.0
+http-proxy-agent@7.0.2
+https-proxy-agent@5.0.1
+https-proxy-agent@7.0.6
+humanize-ms@1.2.1
+i18n@0.11.1
+iconv-lite@0.4.24
+iconv-lite@0.6.3
+iconv-lite@0.6.3
+ieee754@1.2.1
+ignore-walk@3.0.4
+iltorb@2.4.5
+imurmurhash@0.1.4
+indent-string@4.0.0
+infer-owner@1.0.4
+inflection@1.13.4
+inflight@1.0.6
+inherits@2.0.3
+inherits@2.0.4
+ini@1.3.8
+ini@1.3.8
+internal-slot@1.1.0
+interpret@1.1.0
+into-stream@3.1.0
+invariant@2.2.4
+ip@2.0.1
+ip6@0.2.11
+ip-address@10.0.1
+ipaddr.js@1.9.1
+@isaacs/cliui@8.0.2
+@isaacs/fs-minipass@4.0.1
+is-absolute@1.0.0
+is-accessor-descriptor@1.0.1
+is-arguments@1.2.0
+isarray@0.0.1
+isarray@1.0.0
+isarray@1.0.0
+isarray@2.0.5
+is-array-buffer@3.0.5
+is-arrayish@0.3.2
+is-bigint@1.1.0
+is-binary-path@2.1.0
+is-boolean-object@1.2.2
+is-buffer@1.1.6
+is-callable@1.2.7
+is-core-module@2.16.1
+is-data-descriptor@1.0.1
+is-date-object@1.1.0
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@1.0.3
+isexe@2.0.0
+isexe@3.1.1
+is-expression@4.0.0
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@1.0.1
+is-extglob@2.1.1
+is-fullwidth-code-point@1.0.0
+is-fullwidth-code-point@2.0.0
+is-fullwidth-code-point@3.0.0
+is-generator-function@1.1.0
+is-glob@3.1.0
+is-glob@4.0.3
+is-lambda@1.0.1
+is-map@2.0.3
+is-natural-number@4.0.1
+is-number@3.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number-like@1.0.8
+is-number-object@1.1.1
+is-object@1.0.2
+isobject@2.1.0
+isobject@3.0.1
+isomorphic-ws@5.0.0
+is-plain-obj@1.1.0
+is-plain-object@2.0.4
+is-promise@2.2.2
+is-regex@1.2.1
+is-relative@1.0.0
+is-retry-allowed@1.2.0
+is-set@2.0.3
+is-shared-array-buffer@1.0.4
+is-stream@1.1.0
+is-stream@2.0.1
+is-string@1.1.1
+is-symbol@1.1.1
+is-typed-array@1.1.15
+is-unc-path@1.0.0
+isurl@1.0.0
+is-weakmap@2.0.2
+is-weakset@2.0.4
+is-windows@1.0.2
+jackspeak@3.4.3
+json5@2.2.3
+json-buffer@3.0.0
+jsonfile@6.2.0
+jsonwebtoken@0.1.0
+jsonwebtoken@0.4.0
+jssha@3.3.1
+js-stringify@1.0.2
+js-tokens@4.0.0
+jstransformer@1.0.0
+js-yaml@3.14.1
+juice-shop@19.0.0
+juice-shop@19.0.0
+juicy-chat-bot@0.9.0
+jwa@0.0.1
+jws@0.2.6
+keyv@3.0.0
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@4.0.0
+kind-of@6.0.3
+kuler@2.0.0
+lazystream@1.0.1
+libc6@2.36
+libgcc-s1@12.2.0
+libgomp1@12.2.0
+libssl3@3.0.17
+libstdc++6@12.2.0
+libxmljs2@0.37.0
+liftup@3.0.1
+linebreak@1.1.0
+listenercount@1.0.1
+ljharb-monorepo-symlink-test@0.0.0
+locate-path@5.0.0
+lodash@2.4.2
+lodash@4.17.21
+lodash.camelcase@4.3.0
+lodash.isfinite@3.3.2
+lodash.set@4.3.2
+logform@2.7.0
+lolex@1.3.2
+loose-envify@1.4.0
+lowercase-keys@1.0.0
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@6.0.0
+make-dir@1.3.0
+make-dir@2.1.0
+make-error@1.3.6
+make-fetch-happen@14.0.3
+make-fetch-happen@9.1.0
+make-iterator@1.0.1
+make-plural@4.3.0
+make-plural@6.2.2
+map-cache@0.2.2
+map-visit@1.0.0
+marsdb@0.6.11
+math-interval-parser@2.0.1
+math-intrinsics@1.1.0
+median@0.0.2
+media-typer@0.3.0
+media-types@10.0.0
+merge-descriptors@1.0.3
+messageformat@2.3.0
+messageformat-formatters@2.0.1
+messageformat-parser@4.1.3
+methods@1.1.2
+micromatch@3.1.10
+micromatch@4.0.8
+micromatch@4.0.8
+mime@1.6.0
+mime-db@1.52.0
+mime-types@2.1.35
+mimic-response@1.0.1
+mimic-response@2.1.0
+mimic-response@3.1.0
+mimic-response@3.1.0
+minami@1.1.1
+minami@1.1.1
+minami@1.1.1
+minimatch@3.0.5
+minimatch@3.0.8
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@5.1.6
+minimatch@9.0.5
+minimist@0.2.4
+minimist@1.2.8
+minipass@2.9.0
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@5.0.0
+minipass@7.1.2
+minipass-collect@1.0.2
+minipass-collect@2.0.1
+minipass-fetch@1.4.1
+minipass-fetch@4.0.1
+minipass-flush@1.0.5
+minipass-pipeline@1.2.4
+minipass-sized@1.0.3
+minizlib@1.3.3
+minizlib@2.1.2
+minizlib@3.0.2
+mixin-deep@1.3.2
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@1.0.4
+mkdirp@3.0.1
+mkdirp@3.0.1
+mkdirp-classic@0.5.3
+moment@2.0.0
+moment@2.30.1
+moment-timezone@0.5.48
+morgan@1.10.1
+mout@1.2.4
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.1.3
+multer@1.4.5-lts.2
+mustache@4.2.0
+mylib@0.0.0
+@my-scope/package-a@0.0.0
+@my-scope/package-b@0.0.0
+nan@2.22.2
+nanomatch@1.2.13
+napi-build-utils@1.0.2
+napi-build-utils@2.0.0
+napi-build-utils@2.0.0
+needle@2.9.1
+negotiator@0.6.3
+negotiator@0.6.4
+negotiator@1.0.0
+neo-async@2.6.2
+netbase@6.4
+@nlpjs/core@4.26.1
+@nlpjs/core-loader@4.26.1
+@nlpjs/evaluator@4.26.1
+@nlpjs/lang-en@4.26.1
+@nlpjs/lang-en-min@4.26.1
+@nlpjs/language@4.25.0
+@nlpjs/language-min@4.25.0
+@nlpjs/ner@4.27.0
+@nlpjs/neural@4.25.0
+@nlpjs/nlg@4.26.1
+@nlpjs/nlp@4.27.0
+@nlpjs/nlu@4.27.0
+@nlpjs/request@4.25.0
+@nlpjs/sentiment@4.26.1
+@nlpjs/similarity@4.26.1
+@nlpjs/slot@4.26.1
+@noble/curves@1.2.0
+@noble/curves@1.4.2
+@noble/curves@1.4.2
+@noble/hashes@1.3.2
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+node-abi@2.30.1
+node-abi@3.77.0
+node-abi@3.77.0
+node-addon-api@7.1.1
+node-fetch@2.7.0
+node-gyp@11.4.2
+node-gyp@8.4.1
+node-pre-gyp@0.15.0
+noop-logger@0.1.1
+nopt@3.0.6
+nopt@4.0.3
+nopt@4.0.3
+nopt@5.0.0
+nopt@8.1.0
+normalize-path@2.1.1
+normalize-path@3.0.0
+normalize-path@3.0.0
+normalize-url@2.0.1
+notevil@1.3.3
+npm-bundled@1.1.2
+@npmcli/agent@3.0.0
+@npmcli/fs@1.1.1
+@npmcli/fs@4.0.0
+@npmcli/move-file@1.1.2
+npmlog@4.1.2
+npmlog@6.0.2
+npm-normalize-package-bin@1.0.1
+npm-packlist@1.4.8
+number-is-nan@1.0.1
+nw-pre-gyp-module-test@0.0.1
+object-assign@4.1.1
+object.assign@4.1.7
+object-copy@0.1.0
+object.defaults@1.1.0
+object-inspect@1.13.4
+object-is@1.1.6
+object-keys@1.1.1
+object.map@1.0.1
+object.pick@1.3.0
+object-visit@1.0.1
+once@1.4.0
+one-time@1.0.0
+on-finished@2.3.0
+on-finished@2.4.1
+on-headers@1.1.0
+opentype.js@0.7.3
+osenv@0.1.5
+os-homedir@1.0.2
+os-tmpdir@1.0.2
+otplib@12.0.1
+@otplib/core@12.0.1
+@otplib/plugin-crypto@12.0.1
+@otplib/plugin-thirty-two@12.0.1
+@otplib/preset-default@12.0.1
+@otplib/preset-v11@12.0.1
+package-json-from-dist@1.0.1
+pako@0.2.9
+parse-filepath@1.0.2
+parse-passwd@1.0.0
+parseurl@1.3.3
+pascalcase@0.1.1
+path-exists@4.0.0
+path-is-absolute@1.0.1
+path-key@3.1.1
+path-parse@1.0.7
+path-root@0.1.1
+path-root-regex@0.1.2
+path-scurry@1.11.1
+path-to-regexp@0.1.12
+p-cancelable@0.4.1
+pdfkit@0.11.0
+peek-readable@4.1.0
+pend@1.2.0
+p-event@2.3.1
+p-finally@1.0.0
+pg-connection-string@2.9.1
+picomatch@2.3.1
+picomatch@4.0.3
+pify@2.3.0
+pify@2.3.0
+pify@3.0.0
+pify@3.0.0
+pify@4.0.1
+pinkie@2.0.4
+pinkie-promise@2.0.1
+p-is-promise@1.1.0
+@pkgjs/parseargs@0.11.0
+p-limit@2.3.0
+p-locate@4.1.0
+p-map@4.0.0
+p-map@7.0.3
+png-js@1.0.0
+portscanner@2.2.0
+posix-character-classes@0.1.1
+possible-typed-array-names@1.1.0
+prebuild-install@5.3.6
+prebuild-install@7.1.3
+prebuild-install@7.1.3
+prepend-http@2.0.0
+pretty-bytes@4.0.2
+process@0.11.10
+process-nextick-args@2.0.1
+proc-log@5.0.0
+prom-client@14.2.0
+promise@7.3.1
+promise-inflight@1.0.1
+promise-retry@2.0.1
+proper-lockfile@1.2.0
+proxy-addr@2.0.7
+p-timeout@2.0.1
+p-try@2.2.0
+pug@3.0.3
+pug-attrs@3.0.0
+pug-code-gen@3.0.3
+pug-error@2.1.0
+pug-filters@4.0.0
+pug-lexer@5.0.1
+pug-linker@4.0.0
+pug-load@3.0.0
+pug-parser@6.0.0
+pug-runtime@3.0.1
+pug-strip-comments@2.0.0
+pug-walk@2.0.0
+pump@3.0.3
+qs@6.13.0
+query-string@5.1.1
+range_check@2.0.4
+range-parser@1.2.1
+raw-body@2.5.2
+rc@1.2.8
+readable-stream@1.0.34
+readable-stream@2.3.8
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@4.7.0
+readable-web-to-node-stream@3.0.4
+readdirp@3.5.0
+rechoir@0.7.1
+recursedir-comparisons@0.0.0
+regex-not@1.0.2
+regexp.prototype.flags@1.5.4
+remove-trailing-separator@1.1.0
+repeat-element@1.1.4
+repeat-string@1.6.1
+replace@1.2.2
+require-directory@2.1.1
+require-main-filename@2.0.0
+resolve@1.22.10
+resolve-dir@1.0.1
+resolve-url@0.2.1
+responselike@1.0.2
+restructure@2.0.1
+ret@0.1.15
+retry@0.10.1
+retry@0.12.0
+retry-as-promised@7.1.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@3.0.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.2.1
+safer-buffer@2.1.2
+safe-regex@1.1.0
+safe-regex-test@1.1.0
+safe-stable-stringify@2.5.0
+samsam@1.1.2
+sanitize-filename@1.6.3
+sanitize-html@1.4.2
+sax@1.4.1
+@scarf/scarf@1.4.0
+@scure/base@1.1.9
+@scure/bip32@1.4.0
+@scure/bip39@1.3.0
+seek-bzip@1.0.6
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@7.7.2
+send@0.19.0
+sequelize@6.37.7
+sequelize-pool@7.1.0
+serve-index@1.9.1
+serve-static@1.16.2
+set-blocking@2.0.0
+set-function-length@1.2.2
+set-function-name@2.0.2
+setimmediate@1.0.5
+setprototypeof@1.1.0
+setprototypeof@1.2.0
+set-value@2.0.1
+shebang-command@2.0.0
+shebang-regex@3.0.0
+side-channel@1.1.0
+side-channel-list@1.0.0
+side-channel-map@1.0.1
+side-channel-weakmap@1.0.2
+signal-exit@3.0.7
+signal-exit@4.1.0
+simple-concat@1.0.1
+simple-get@3.1.1
+simple-get@4.0.1
+simple-get@4.0.1
+simple-swizzle@0.2.2
+@sindresorhus/is@0.7.0
+sinon@1.17.7
+smart-buffer@4.2.0
+snapdragon@0.8.2
+snapdragon-node@2.1.1
+snapdragon-util@3.0.1
+socket.io@3.1.2
+socket.io-adapter@2.1.0
+socket.io-parser@4.0.5
+socks@2.8.7
+socks-proxy-agent@6.2.1
+socks-proxy-agent@8.0.5
+sort-keys@1.1.2
+sort-keys@2.0.0
+sort-keys-length@1.0.1
+source-map@0.5.7
+source-map@0.6.1
+source-map-resolve@0.5.3
+source-map-support@0.5.21
+source-map-url@0.4.1
+split-string@3.1.0
+sprintf-js@1.0.3
+sprintf-js@1.1.3
+sqlite3@5.1.7
+ssri@12.0.0
+ssri@8.0.1
+stack-trace@0.0.10
+static-extend@0.1.2
+statuses@1.5.0
+statuses@2.0.1
+stop-iteration-iterator@1.1.0
+stream-buffers@2.2.0
+streamsearch@1.1.0
+strict-uri-encode@1.1.0
+string_decoder@0.10.31
+string_decoder@1.1.1
+string_decoder@1.3.0
+string.fromcodepoint@0.2.1
+string.prototype.codepointat@0.2.1
+string-width@1.0.2
+string-width@2.1.1
+string-width@4.2.3
+string-width@4.2.3
+string-width@5.1.2
+string-width@5.1.2
+strip-ansi@3.0.1
+strip-ansi@3.0.1
+strip-ansi@4.0.0
+strip-ansi@6.0.1
+strip-ansi@6.0.1
+strip-ansi@7.1.0
+strip-ansi@7.1.0
+strip-bom@3.0.0
+strip-dirs@2.1.0
+strip-json-comments@2.0.1
+strip-json-comments@2.0.1
+strip-outer@1.0.1
+strtok3@6.3.0
+supports-color@2.0.0
+supports-color@5.5.0
+supports-color@7.2.0
+supports-preserve-symlinks-flag@1.0.0
+svg-captcha@1.4.0
+swagger-ui-dist@5.28.1
+swagger-ui-express@5.0.1
+@swc/helpers@0.3.17
+tar@4.4.19
+tar@6.2.1
+tar@7.4.3
+tar-fs@2.1.3
+tar-stream@1.6.2
+tar-stream@2.2.0
+tdigest@0.1.2
+text-hex@1.0.0
+thirty-two@1.0.2
+through@2.3.8
+timed-out@4.0.1
+tinyglobby@0.2.14
+tiny-inflate@1.0.3
+to-buffer@1.2.1
+toidentifier@1.0.1
+@tokenizer/token@0.3.0
+token-stream@1.0.0
+token-types@4.2.1
+to-object-path@0.3.0
+@tootallnate/once@1.1.2
+@tootallnate/once@2.0.0
+toposort-class@1.0.1
+to-regex@3.0.2
+to-regex-range@2.1.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+tr46@0.0.3
+traverse@0.3.9
+tree-kill@1.2.2
+trim-repeated@1.0.0
+triple-beam@1.4.1
+truncate-utf8-bytes@1.0.2
+tsconfig@7.0.0
+tslib@2.7.0
+ts-node@9.1.1
+ts-node-dev@1.1.8
+tunnel-agent@0.6.0
+typecast@0.0.1
+typedarray@0.0.6
+typed-array-buffer@1.0.3
+type-is@1.6.18
+@types/component-emitter@1.2.14
+@types/cookie@0.4.1
+@types/cors@2.8.19
+typescript@5.3.3
+@types/debug@4.1.12
+@types/ms@2.1.0
+@types/node@20.19.12
+@types/node@22.7.5
+@types/strip-bom@3.0.0
+@types/strip-json-comments@0.0.30
+@types/triple-beam@1.3.5
+@types/validator@13.15.3
+@types/ws@8.5.3
+tzdata@2025b
+uglify-js@3.19.3
+unbzip2-stream@1.4.3
+unc-path-regex@0.1.2
+underscore.string@3.3.6
+undici-types@6.19.8
+undici-types@6.21.0
+unicode-properties@1.4.1
+unicode-trie@2.0.0
+union-value@1.0.1
+unique-filename@1.1.1
+unique-filename@4.0.0
+unique-slug@2.0.2
+unique-slug@5.0.0
+unit-compare@1.0.1
+universalify@2.0.1
+unpipe@1.0.0
+unset-value@1.0.0
+untildify@2.1.0
+unzipper@0.9.15
+urix@0.1.0
+url-parse-lax@3.0.0
+url-to-options@1.0.1
+use@3.1.1
+utf8-byte-length@1.0.5
+util@0.12.5
+util-deprecate@1.0.2
+utils-merge@1.0.1
+uuid@8.3.2
+v8flags@3.2.0
+validate@4.5.1
+validator@13.15.15
+vary@1.1.2
+vm2@3.9.17
+void-elements@3.1.0
+walk@2.3.15
+walkdir@0.0.11
+web3@4.16.0
+web3-core@4.7.1
+web3-errors@1.3.1
+web3-eth@4.11.1
+web3-eth-abi@4.4.1
+web3-eth-accounts@4.3.1
+web3-eth-contract@4.7.2
+web3-eth-ens@4.4.0
+web3-eth-iban@4.0.7
+web3-eth-personal@4.1.0
+web3-net@4.1.0
+web3-providers-http@4.2.0
+web3-providers-ipc@4.0.7
+web3-providers-ws@4.0.8
+web3-rpc-methods@1.3.0
+web3-rpc-providers@1.0.0-rc.4
+web3-types@1.10.0
+web3-utils@4.3.3
+web3-validator@2.0.6
+webidl-conversions@3.0.1
+whatwg-url@5.0.0
+which@1.3.1
+which@2.0.2
+which@5.0.0
+which-boxed-primitive@1.1.1
+which-collection@1.0.2
+which-module@2.0.1
+which-pm-runs@1.1.0
+which-typed-array@1.1.19
+wide-align@1.1.3
+wide-align@1.1.5
+winston@3.17.0
+winston-transport@4.9.0
+with@7.0.2
+wkx@0.5.0
+wordwrap@0.0.3
+wordwrap@1.0.0
+wrap-ansi@6.2.0
+wrap-ansi@7.0.0
+wrap-ansi@8.1.0
+wrappy@1.0.2
+ws@7.4.6
+ws@8.17.1
+xtend@4.0.2
+y18n@4.0.3
+yallist@3.1.1
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@5.0.0
+yaml-schema-validator@1.2.3
+yargs@15.4.1
+yargs-parser@18.1.3
+yauzl@2.10.0
+yn@3.1.1
+z85@0.0.2
+zip-stream@1.2.0
+zod@3.25.76
diff --git a/labs/lab4/syft/grype-vuln-results.json b/labs/lab4/syft/grype-vuln-results.json
new file mode 100644
index 00000000..608b4156
--- /dev/null
+++ b/labs/lab4/syft/grype-vuln-results.json
@@ -0,0 +1 @@
+{"matches":[{"vulnerability":{"id":"GHSA-whpj-8f3w-67p5","dataSource":"https://github.com/advisories/GHSA-whpj-8f3w-67p5","namespace":"github:language:javascript","severity":"Critical","urls":[],"description":"vm2 Sandbox Escape vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32314","epss":0.69492,"percentile":0.98612,"date":"2025-10-01"}],"fix":{"versions":["3.9.18"],"state":"fixed","available":[{"version":"3.9.18","date":"2023-05-16","kind":"first-observed"}]},"advisories":[],"risk":65.32248},"relatedVulnerabilities":[{"id":"CVE-2023-32314","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32314","namespace":"nvd:cpe","severity":"Critical","urls":["https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac","https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5","https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac","https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5"],"description":"vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32314","epss":0.69492,"percentile":0.98612,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-whpj-8f3w-67p5","versionConstraint":"<3.9.18 (semantic)"},"fix":{"suggestedVersion":"3.9.18"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-c7hr-j4mj-j2w6","dataSource":"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6","namespace":"github:language:javascript","severity":"Critical","urls":[],"description":"Verification Bypass in jsonwebtoken","cvss":[],"epss":[{"cve":"CVE-2015-9235","epss":0.41149,"percentile":0.9731,"date":"2025-10-01"}],"fix":{"versions":["4.2.2"],"state":"fixed","available":[{"version":"4.2.2","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":37.0341},"relatedVulnerabilities":[{"id":"CVE-2015-9235","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-9235","namespace":"nvd:cpe","severity":"Critical","urls":["https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://nodesecurity.io/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://nodesecurity.io/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-9235","epss":0.41149,"percentile":0.9731,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-c7hr-j4mj-j2w6","versionConstraint":"<4.2.2 (semantic)"},"fix":{"suggestedVersion":"4.2.2"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c7hr-j4mj-j2w6","dataSource":"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6","namespace":"github:language:javascript","severity":"Critical","urls":[],"description":"Verification Bypass in jsonwebtoken","cvss":[],"epss":[{"cve":"CVE-2015-9235","epss":0.41149,"percentile":0.9731,"date":"2025-10-01"}],"fix":{"versions":["4.2.2"],"state":"fixed","available":[{"version":"4.2.2","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":37.0341},"relatedVulnerabilities":[{"id":"CVE-2015-9235","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-9235","namespace":"nvd:cpe","severity":"Critical","urls":["https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://nodesecurity.io/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://nodesecurity.io/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-9235","epss":0.41149,"percentile":0.9731,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-c7hr-j4mj-j2w6","versionConstraint":"<4.2.2 (semantic)"},"fix":{"suggestedVersion":"4.2.2"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g644-9gfx-q4q4","dataSource":"https://github.com/advisories/GHSA-g644-9gfx-q4q4","namespace":"github:language:javascript","severity":"Critical","urls":[],"description":"vm2 Sandbox Escape vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37903","epss":0.35568,"percentile":0.96958,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":33.43392},"relatedVulnerabilities":[{"id":"CVE-2023-37903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37903","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4","https://security.netapp.com/advisory/ntap-20230831-0007/","https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4","https://security.netapp.com/advisory/ntap-20230831-0007/"],"description":"vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37903","epss":0.35568,"percentile":0.96958,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-g644-9gfx-q4q4","versionConstraint":"<=3.9.19 (semantic)"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-cchq-frgv-rjh5","dataSource":"https://github.com/advisories/GHSA-cchq-frgv-rjh5","namespace":"github:language:javascript","severity":"Critical","urls":[],"description":"vm2 Sandbox Escape vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37466","epss":0.04732,"percentile":0.88989,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":4.44808},"relatedVulnerabilities":[{"id":"CVE-2023-37466","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37466","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5","https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5"],"description":"vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37466","epss":0.04732,"percentile":0.88989,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-cchq-frgv-rjh5","versionConstraint":"<=3.9.19 (semantic)"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-2p57-rm9w-gvfp","dataSource":"https://github.com/advisories/GHSA-2p57-rm9w-gvfp","namespace":"github:language:javascript","severity":"High","urls":[],"description":"ip SSRF improper categorization in isPublic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29415","epss":0.02922,"percentile":0.85936,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":2.27916},"relatedVulnerabilities":[{"id":"CVE-2024-29415","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29415","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/indutny/node-ip/issues/150","https://github.com/indutny/node-ip/pull/143","https://github.com/indutny/node-ip/pull/144","https://github.com/indutny/node-ip/issues/150","https://github.com/indutny/node-ip/pull/143","https://github.com/indutny/node-ip/pull/144","https://security.netapp.com/advisory/ntap-20250117-0010/"],"description":"The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29415","epss":0.02922,"percentile":0.85936,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-2p57-rm9w-gvfp","versionConstraint":"<=2.0.1 (semantic)"}}],"artifact":{"id":"80c437d1f8f690a8","name":"ip","version":"2.0.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/ip/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ip/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fedorindutny:ip:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r7qp-cfhv-p84w","dataSource":"https://github.com/advisories/GHSA-r7qp-cfhv-p84w","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Uncaught exception in engine.io","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-41940","epss":0.02779,"percentile":0.85569,"date":"2025-10-01"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2022-11-23","kind":"first-observed"}]},"advisories":[],"risk":1.5979249999999996},"relatedVulnerabilities":[{"id":"CVE-2022-41940","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41940","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6","https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085","https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w","https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6","https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085","https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w"],"description":"Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-41940","epss":0.02779,"percentile":0.85569,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"engine.io","version":"4.1.2"}},"found":{"vulnerabilityID":"GHSA-r7qp-cfhv-p84w","versionConstraint":">=4.0.0,<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"8c4af4f22e5de7e4","name":"engine.io","version":"4.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/engine.io/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:engine.io:4.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/engine.io@4.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-p6mc-m468-83gw","dataSource":"https://github.com/advisories/GHSA-p6mc-m468-83gw","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.01999,"percentile":0.8305,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":1.489255},"relatedVulnerabilities":[{"id":"CVE-2020-8203","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/lodash/lodash/issues/4874","https://hackerone.com/reports/712065","https://security.netapp.com/advisory/ntap-20200724-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://github.com/lodash/lodash/issues/4874","https://hackerone.com/reports/712065","https://security.netapp.com/advisory/ntap-20200724-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.01999,"percentile":0.8305,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash.set","version":"4.3.2"}},"found":{"vulnerabilityID":"GHSA-p6mc-m468-83gw","versionConstraint":">=3.7.0,<=4.3.2 (semantic)"}}],"artifact":{"id":"be8f210a7cd0fab3","name":"lodash.set","version":"4.3.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/lodash.set/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/lodash.set/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash.set:lodash.set:4.3.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/lodash.set@4.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-jf85-cpcp-j695","dataSource":"https://github.com/advisories/GHSA-jf85-cpcp-j695","namespace":"github:language:javascript","severity":"Critical","urls":[],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.01176,"percentile":0.78085,"date":"2025-10-01"}],"fix":{"versions":["4.17.12"],"state":"fixed","available":[{"version":"4.17.12","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.06428},"relatedVulnerabilities":[{"id":"CVE-2019-10744","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10744","namespace":"nvd:cpe","severity":"Critical","urls":["https://access.redhat.com/errata/RHSA-2019:3024","https://security.netapp.com/advisory/ntap-20191004-0005/","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://access.redhat.com/errata/RHSA-2019:3024","https://security.netapp.com/advisory/ntap-20191004-0005/","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"description":"Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.01176,"percentile":0.78085,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-jf85-cpcp-j695","versionConstraint":"<4.17.12 (semantic)"},"fix":{"suggestedVersion":"4.17.12"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xwcq-pm8m-c4vf","dataSource":"https://github.com/advisories/GHSA-xwcq-pm8m-c4vf","namespace":"github:language:javascript","severity":"Critical","urls":[],"description":"crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-46233","epss":0.00963,"percentile":0.75805,"date":"2025-10-01"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2023-10-26","kind":"first-observed"}]},"advisories":[],"risk":0.8715149999999999},"relatedVulnerabilities":[{"id":"CVE-2023-46233","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-46233","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a","https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf","https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html","https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a","https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf","https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html"],"description":"crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-46233","epss":0.00963,"percentile":0.75805,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"crypto-js","version":"3.3.0"}},"found":{"vulnerabilityID":"GHSA-xwcq-pm8m-c4vf","versionConstraint":"<4.2.0 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"c00a8b8b043aae72","name":"crypto-js","version":"3.3.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/crypto-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crypto-js/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:crypto-js:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto-js:crypto_js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto_js:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto_js:crypto_js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto:crypto_js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:brix:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:brix:crypto_js:3.3.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/crypto-js@3.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-87vv-r9j6-g5qv","dataSource":"https://github.com/advisories/GHSA-87vv-r9j6-g5qv","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Regular Expression Denial of Service in moment","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-4055","epss":0.01352,"percentile":0.79518,"date":"2025-10-01"}],"fix":{"versions":["2.11.2"],"state":"fixed","available":[{"version":"2.11.2","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":0.7774},"relatedVulnerabilities":[{"id":"CVE-2016-4055","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4055","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/95849","https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E","https://nodesecurity.io/advisories/55","https://www.tenable.com/security/tns-2019-02","http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/95849","https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E","https://nodesecurity.io/advisories/55","https://www.tenable.com/security/tns-2019-02"],"description":"The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a \"regular expression Denial of Service (ReDoS).\"","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-4055","epss":0.01352,"percentile":0.79518,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-87vv-r9j6-g5qv","versionConstraint":"<2.11.2 (semantic)"},"fix":{"suggestedVersion":"2.11.2"}}],"artifact":{"id":"fb07dad56d7726f5","name":"moment","version":"2.0.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:momentjs:moment:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rm97-x556-q36h","dataSource":"https://github.com/advisories/GHSA-rm97-x556-q36h","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"sanitize-html Information Exposure vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21501","epss":0.01341,"percentile":0.79412,"date":"2025-10-01"}],"fix":{"versions":["2.12.1"],"state":"fixed","available":[{"version":"2.12.1","date":"2024-03-02","kind":"first-observed"}]},"advisories":[],"risk":0.690615},"relatedVulnerabilities":[{"id":"CVE-2024-21501","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21501","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf","https://github.com/apostrophecms/apostrophe/discussions/4436","https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4","https://github.com/apostrophecms/sanitize-html/pull/650","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334","https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf","https://github.com/apostrophecms/apostrophe/discussions/4436","https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4","https://github.com/apostrophecms/sanitize-html/pull/650","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334"],"description":"Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21501","epss":0.01341,"percentile":0.79412,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-rm97-x556-q36h","versionConstraint":"<2.12.1 (semantic)"},"fix":{"suggestedVersion":"2.12.1"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8hfj-j24r-96c4","dataSource":"https://github.com/advisories/GHSA-8hfj-j24r-96c4","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Path Traversal: 'dir/../../filename' in moment.locale","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24785","epss":0.00694,"percentile":0.71131,"date":"2025-10-01"}],"fix":{"versions":["2.29.2"],"state":"fixed","available":[{"version":"2.29.2","date":"2022-04-09","kind":"first-observed"}]},"advisories":[],"risk":0.5205},"relatedVulnerabilities":[{"id":"CVE-2022-24785","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24785","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5","https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/","https://security.netapp.com/advisory/ntap-20220513-0006/","https://www.tenable.com/security/tns-2022-09","https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5","https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/","https://security.netapp.com/advisory/ntap-20220513-0006/","https://www.tenable.com/security/tns-2022-09"],"description":"Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24785","epss":0.00694,"percentile":0.71131,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-8hfj-j24r-96c4","versionConstraint":"<2.29.2 (semantic)"},"fix":{"suggestedVersion":"2.29.2"}}],"artifact":{"id":"fb07dad56d7726f5","name":"moment","version":"2.0.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:momentjs:moment:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pfrx-2q88-qq97","dataSource":"https://github.com/advisories/GHSA-pfrx-2q88-qq97","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Got allows a redirect to a UNIX socket","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.00788,"percentile":0.73147,"date":"2025-10-01"}],"fix":{"versions":["11.8.5"],"state":"fixed","available":[{"version":"11.8.5","date":"2022-06-22","kind":"first-observed"}]},"advisories":[],"risk":0.40581999999999996},"relatedVulnerabilities":[{"id":"CVE-2022-33987","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/releases/tag/v11.8.5","https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/releases/tag/v11.8.5"],"description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.00788,"percentile":0.73147,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"got","version":"8.3.2"}},"found":{"vulnerabilityID":"GHSA-pfrx-2q88-qq97","versionConstraint":"<11.8.5 (semantic)"},"fix":{"suggestedVersion":"11.8.5"}}],"artifact":{"id":"5bd1b0995776246c","name":"got","version":"8.3.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/got/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/got/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:got:got:8.3.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/got@8.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3h5v-q93c-6h6q","dataSource":"https://github.com/advisories/GHSA-3h5v-q93c-6h6q","namespace":"github:language:javascript","severity":"High","urls":[],"description":"ws affected by a DoS when handling a request with many HTTP headers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.00541,"percentile":0.66827,"date":"2025-10-01"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2024-06-18","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2024-37890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37890","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://nodejs.org/api/http.html#servermaxheaderscount","https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://nodejs.org/api/http.html#servermaxheaderscount"],"description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.00541,"percentile":0.66827,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"7.4.6"}},"found":{"vulnerabilityID":"GHSA-3h5v-q93c-6h6q","versionConstraint":">=7.0.0,<7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"670482146c83d660","name":"ws","version":"7.4.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/ws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/ws/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:7.4.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@7.4.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-p5gc-c584-jj6v","dataSource":"https://github.com/advisories/GHSA-p5gc-c584-jj6v","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"vm2 vulnerable to Inspect Manipulation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32313","epss":0.00653,"percentile":0.70145,"date":"2025-10-01"}],"fix":{"versions":["3.9.18"],"state":"fixed","available":[{"version":"3.9.18","date":"2023-05-18","kind":"first-observed"}]},"advisories":[],"risk":0.33629500000000007},"relatedVulnerabilities":[{"id":"CVE-2023-32313","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32313","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550","https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v","https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550","https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v"],"description":"vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32313","epss":0.00653,"percentile":0.70145,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-p5gc-c584-jj6v","versionConstraint":"<3.9.18 (semantic)"},"fix":{"suggestedVersion":"3.9.18"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.00322,"percentile":0.54851,"date":"2025-10-01"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2021-05-07","kind":"first-observed"}]},"advisories":[],"risk":0.23667000000000002},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.00322,"percentile":0.54851,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-446m-mv8f-q348","dataSource":"https://github.com/advisories/GHSA-446m-mv8f-q348","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Regular Expression Denial of Service in moment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-18214","epss":0.00243,"percentile":0.47749,"date":"2025-10-01"}],"fix":{"versions":["2.19.3"],"state":"fixed","available":[{"version":"2.19.3","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":0.18225},"relatedVulnerabilities":[{"id":"CVE-2017-18214","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18214","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moment/moment/issues/4163","https://nodesecurity.io/advisories/532","https://www.tenable.com/security/tns-2019-02","https://github.com/moment/moment/issues/4163","https://nodesecurity.io/advisories/532","https://www.tenable.com/security/tns-2019-02"],"description":"The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-18214","epss":0.00243,"percentile":0.47749,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-446m-mv8f-q348","versionConstraint":"<2.19.3 (semantic)"},"fix":{"suggestedVersion":"2.19.3"}}],"artifact":{"id":"fb07dad56d7726f5","name":"moment","version":"2.0.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:momentjs:moment:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3j7m-hmh3-9jmp","dataSource":"https://github.com/advisories/GHSA-3j7m-hmh3-9jmp","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Cross-Site Scripting in sanitize-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-1000237","epss":0.00328,"percentile":0.55335,"date":"2025-10-01"}],"fix":{"versions":["1.4.3"],"state":"fixed","available":[{"version":"1.4.3","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":0.18203999999999998},"relatedVulnerabilities":[{"id":"CVE-2016-1000237","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000237","namespace":"nvd:cpe","severity":"Medium","urls":["https://nodesecurity.io/advisories/135","https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json","https://nodesecurity.io/advisories/135","https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json"],"description":"sanitize-html before 1.4.3 has XSS.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-1000237","epss":0.00328,"percentile":0.55335,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-3j7m-hmh3-9jmp","versionConstraint":"<1.4.3 (semantic)"},"fix":{"suggestedVersion":"1.4.3"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8g4m-cjm2-96wq","dataSource":"https://github.com/advisories/GHSA-8g4m-cjm2-96wq","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Sandbox escape in notevil and argencoders-notevil","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23771","epss":0.00304,"percentile":0.53362,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1748},"relatedVulnerabilities":[{"id":"CVE-2021-23771","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23771","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587","https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946","https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587","https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946"],"description":"This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23771","epss":0.00304,"percentile":0.53362,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"notevil","version":"1.3.3"}},"found":{"vulnerabilityID":"GHSA-8g4m-cjm2-96wq","versionConstraint":"<=1.3.3 (semantic)"}}],"artifact":{"id":"06d4740823f7ae47","name":"notevil","version":"1.3.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/notevil/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/notevil/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:notevil_project:notevil:1.3.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/notevil@1.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-4xc9-xhrj-v574","dataSource":"https://github.com/advisories/GHSA-4xc9-xhrj-v574","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Prototype Pollution in lodash","cvss":[],"epss":[{"cve":"CVE-2018-16487","epss":0.00207,"percentile":0.43291,"date":"2025-10-01"}],"fix":{"versions":["4.17.11"],"state":"fixed","available":[{"version":"4.17.11","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":0.15524999999999997},"relatedVulnerabilities":[{"id":"CVE-2018-16487","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16487","namespace":"nvd:cpe","severity":"Medium","urls":["https://hackerone.com/reports/380873","https://security.netapp.com/advisory/ntap-20190919-0004/","https://hackerone.com/reports/380873","https://security.netapp.com/advisory/ntap-20190919-0004/"],"description":"A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-16487","epss":0.00207,"percentile":0.43291,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-4xc9-xhrj-v574","versionConstraint":"<4.17.11 (semantic)"},"fix":{"suggestedVersion":"4.17.11"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-mjxr-4v3x-q3m4","dataSource":"https://github.com/advisories/GHSA-mjxr-4v3x-q3m4","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Improper Input Validation in sanitize-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26540","epss":0.00288,"percentile":0.5212,"date":"2025-10-01"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2021-05-07","kind":"first-observed"}]},"advisories":[],"risk":0.14832},"relatedVulnerabilities":[{"id":"CVE-2021-26540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-26540","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CX-2021-4309","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26","https://github.com/apostrophecms/sanitize-html/pull/460","https://advisory.checkmarx.net/advisory/CX-2021-4309","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26","https://github.com/apostrophecms/sanitize-html/pull/460"],"description":"Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the \"allowedIframeHostnames\" option when the \"allowIframeRelativeUrls\" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with \"/\\\\example.com\".","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26540","epss":0.00288,"percentile":0.5212,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-mjxr-4v3x-q3m4","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rjqq-98f6-6j3r","dataSource":"https://github.com/advisories/GHSA-rjqq-98f6-6j3r","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Improper Input Validation in sanitize-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26539","epss":0.00288,"percentile":0.5212,"date":"2025-10-01"}],"fix":{"versions":["2.3.1"],"state":"fixed","available":[{"version":"2.3.1","date":"2021-05-07","kind":"first-observed"}]},"advisories":[],"risk":0.14832},"relatedVulnerabilities":[{"id":"CVE-2021-26539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-26539","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CX-2021-4308","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22","https://github.com/apostrophecms/sanitize-html/pull/458","https://advisory.checkmarx.net/advisory/CX-2021-4308","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22","https://github.com/apostrophecms/sanitize-html/pull/458"],"description":"Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the \"allowedIframeHostnames\" option.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26539","epss":0.00288,"percentile":0.5212,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-rjqq-98f6-6j3r","versionConstraint":"<2.3.1 (semantic)"},"fix":{"suggestedVersion":"2.3.1"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xc6g-ggrc-qq4r","dataSource":"https://github.com/advisories/GHSA-xc6g-ggrc-qq4r","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Cross-Site Scripting in sanitize-html","cvss":[],"epss":[{"cve":"CVE-2017-16016","epss":0.00286,"percentile":0.5189,"date":"2025-10-01"}],"fix":{"versions":["1.11.4"],"state":"fixed","available":[{"version":"1.11.4","date":"2021-03-30","kind":"first-observed"}]},"advisories":[],"risk":0.14300000000000002},"relatedVulnerabilities":[{"id":"CVE-2017-16016","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16016","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403","https://github.com/punkave/sanitize-html/issues/100","https://nodesecurity.io/advisories/154","https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403","https://github.com/punkave/sanitize-html/issues/100","https://nodesecurity.io/advisories/154"],"description":"Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16016","epss":0.00286,"percentile":0.5189,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-xc6g-ggrc-qq4r","versionConstraint":"<=1.11.1 (semantic)"},"fix":{"suggestedVersion":"1.11.4"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-grv7-fg5c-xmjg","dataSource":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Uncontrolled resource consumption in braces","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.00159,"percentile":0.37541,"date":"2025-10-01"}],"fix":{"versions":["3.0.3"],"state":"fixed","available":[{"version":"3.0.3","date":"2024-06-11","kind":"first-observed"}]},"advisories":[],"risk":0.11925},"relatedVulnerabilities":[{"id":"CVE-2024-4068","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4068","namespace":"nvd:cpe","severity":"High","urls":["https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff","https://github.com/micromatch/braces/issues/35","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40","https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff","https://github.com/micromatch/braces/issues/35","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40"],"description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.00159,"percentile":0.37541,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"braces","version":"2.3.2"}},"found":{"vulnerabilityID":"GHSA-grv7-fg5c-xmjg","versionConstraint":"<3.0.3 (semantic)"},"fix":{"suggestedVersion":"3.0.3"}}],"artifact":{"id":"e18c817c2057c675","name":"braces","version":"2.3.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:braces_project:braces:2.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/braces@2.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rc47-6667-2j5j","dataSource":"https://github.com/advisories/GHSA-rc47-6667-2j5j","namespace":"github:language:javascript","severity":"High","urls":[],"description":"http-cache-semantics vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25881","epss":0.00159,"percentile":0.37498,"date":"2025-10-01"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2023-02-03","kind":"first-observed"}]},"advisories":[],"risk":0.11925},"relatedVulnerabilities":[{"id":"CVE-2022-25881","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83","https://security.netapp.com/advisory/ntap-20230622-0008/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332","https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783","https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83","https://security.netapp.com/advisory/ntap-20230622-0008/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332","https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783"],"description":"This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25881","epss":0.00159,"percentile":0.37498,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"http-cache-semantics","version":"3.8.1"}},"found":{"vulnerabilityID":"GHSA-rc47-6667-2j5j","versionConstraint":"<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"bd9e0a0c5346494e","name":"http-cache-semantics","version":"3.8.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/http-cache-semantics/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/http-cache-semantics/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["BSD-2-Clause"],"cpes":["cpe:2.3:a:http-cache-semantics_project:http-cache-semantics:3.8.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/http-cache-semantics@3.8.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5x3-32g6-xq36","dataSource":"https://github.com/advisories/GHSA-f5x3-32g6-xq36","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Denial of service while parsing a tar file due to lack of folders count validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00198,"percentile":0.42247,"date":"2025-10-01"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2024-04-10","kind":"first-observed"}]},"advisories":[],"risk":0.11384999999999999},"relatedVulnerabilities":[{"id":"CVE-2024-28863","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://security.netapp.com/advisory/ntap-20240524-0005/","https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://security.netapp.com/advisory/ntap-20240524-0005/"],"description":"node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00198,"percentile":0.42247,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-f5x3-32g6-xq36","versionConstraint":"<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-cqmj-92xf-r6r9","dataSource":"https://github.com/advisories/GHSA-cqmj-92xf-r6r9","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Insufficient validation when decoding a Socket.IO packet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32695","epss":0.00162,"percentile":0.37918,"date":"2025-10-01"}],"fix":{"versions":["4.2.3"],"state":"fixed","available":[{"version":"4.2.3","date":"2023-05-24","kind":"first-observed"}]},"advisories":[],"risk":0.09962999999999998},"relatedVulnerabilities":[{"id":"CVE-2023-32695","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32695","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9","https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9"],"description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32695","epss":0.00162,"percentile":0.37918,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io-parser","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-cqmj-92xf-r6r9","versionConstraint":">=4.0.4,<4.2.3 (semantic)"},"fix":{"suggestedVersion":"4.2.3"}}],"artifact":{"id":"dd154d7bfbaea09c","name":"socket.io-parser","version":"4.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/socket.io-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socket.io-parser/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:socket.io-parser:4.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io-parser@4.0.5","upstreams":[]}},{"vulnerability":{"id":"CVE-2018-20796","dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.","cvss":[],"epss":[{"cve":"CVE-2018-20796","epss":0.01835,"percentile":0.82335,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.09175000000000001},"relatedVulnerabilities":[{"id":"CVE-2018-20796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","namespace":"nvd:cpe","severity":"High","urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS","http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20796","epss":0.01835,"percentile":0.82335,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-fvqr-27wr-82fm","dataSource":"https://github.com/advisories/GHSA-fvqr-27wr-82fm","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3721","epss":0.00139,"percentile":0.34826,"date":"2025-10-01"}],"fix":{"versions":["4.17.5"],"state":"fixed","available":[{"version":"4.17.5","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":0.079925},"relatedVulnerabilities":[{"id":"CVE-2018-3721","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3721","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a","https://hackerone.com/reports/310443","https://security.netapp.com/advisory/ntap-20190919-0004/","https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a","https://hackerone.com/reports/310443","https://security.netapp.com/advisory/ntap-20190919-0004/"],"description":"lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3721","epss":0.00139,"percentile":0.34826,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-fvqr-27wr-82fm","versionConstraint":"<4.17.5 (semantic)"},"fix":{"suggestedVersion":"4.17.5"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6g6m-m6h5-w9gf","dataSource":"https://github.com/advisories/GHSA-6g6m-m6h5-w9gf","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Authorization bypass in express-jwt","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.7,"exploitabilityScore":1.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15084","epss":0.00095,"percentile":0.27585,"date":"2025-10-01"}],"fix":{"versions":["6.0.0"],"state":"fixed","available":[{"version":"6.0.0","date":"2021-03-30","kind":"first-observed"}]},"advisories":[],"risk":0.0722},"relatedVulnerabilities":[{"id":"CVE-2020-15084","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15084","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef","https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf","https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef","https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf"],"description":"In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.7,"exploitabilityScore":1.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15084","epss":0.00095,"percentile":0.27585,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"express-jwt","version":"0.1.3"}},"found":{"vulnerabilityID":"GHSA-6g6m-m6h5-w9gf","versionConstraint":"<=5.3.3 (semantic)"},"fix":{"suggestedVersion":"6.0.0"}}],"artifact":{"id":"b057e452c5702954","name":"express-jwt","version":"0.1.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:express-jwt:0.1.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/express-jwt@0.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-25hc-qcg6-38wj","dataSource":"https://github.com/advisories/GHSA-25hc-qcg6-38wj","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"socket.io has an unhandled 'error' event","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-38355","epss":0.001,"percentile":0.28486,"date":"2025-10-01"}],"fix":{"versions":["4.6.2"],"state":"fixed","available":[{"version":"4.6.2","date":"2024-06-20","kind":"first-observed"}]},"advisories":[],"risk":0.0615},"relatedVulnerabilities":[{"id":"CVE-2024-38355","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38355","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115","https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj","https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115","https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj","https://www.vicarius.io/vsociety/posts/unhandled-exception-in-socketio-cve-2024-38355"],"description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-38355","epss":0.001,"percentile":0.28486,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-25hc-qcg6-38wj","versionConstraint":">=3.0.0,<4.6.2 (semantic)"},"fix":{"suggestedVersion":"4.6.2"}}],"artifact":{"id":"a59f241f8d484687","name":"socket.io","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/socket.io/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socket.io/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:socket.io:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.00105,"percentile":0.29299,"date":"2025-10-01"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.054075},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.00105,"percentile":0.29299,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"3.1.10"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"2f60ee768b1461a2","name":"micromatch","version":"3.1.10","type":"npm","locations":[{"path":"/juice-shop/node_modules/micromatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/micromatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:micromatch:micromatch:3.1.10:*:*:*:*:*:*:*"],"purl":"pkg:npm/micromatch@3.1.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-vj76-c3g6-qr5v","dataSource":"https://github.com/advisories/GHSA-vj76-c3g6-qr5v","namespace":"github:language:javascript","severity":"High","urls":[],"description":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","cvss":[],"epss":[{"cve":"CVE-2025-59343","epss":0.00066,"percentile":0.20928,"date":"2025-10-01"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2025-09-27","kind":"first-observed"}]},"advisories":[],"risk":0.0495},"relatedVulnerabilities":[{"id":"CVE-2025-59343","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59343","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v"],"description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59343","epss":0.00066,"percentile":0.20928,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar-fs","version":"2.1.3"}},"found":{"vulnerabilityID":"GHSA-vj76-c3g6-qr5v","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"9680d7d122bfb97a","name":"tar-fs","version":"2.1.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar-fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:mafintosh:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:mafintosh:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar_fs:2.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/tar-fs@2.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-g5hg-p3ph-g8qg","dataSource":"https://github.com/advisories/GHSA-g5hg-p3ph-g8qg","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Multer vulnerable to Denial of Service via unhandled exception","cvss":[],"epss":[{"cve":"CVE-2025-48997","epss":0.00063,"percentile":0.20113,"date":"2025-10-01"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2025-06-05","kind":"first-observed"}]},"advisories":[],"risk":0.04725000000000001},"relatedVulnerabilities":[{"id":"CVE-2025-48997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48997","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9","https://github.com/expressjs/multer/issues/1233","https://github.com/expressjs/multer/pull/1256","https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-48997","epss":0.00063,"percentile":0.20113,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-g5hg-p3ph-g8qg","versionConstraint":">=1.4.4-lts.1,<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8cf7-32gw-wr33","dataSource":"https://github.com/advisories/GHSA-8cf7-32gw-wr33","namespace":"github:language:javascript","severity":"High","urls":[],"description":"jsonwebtoken unrestricted key type could lead to legacy keys usage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00058,"percentile":0.18569,"date":"2025-10-01"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2022-12-23","kind":"first-observed"}]},"advisories":[],"risk":0.04524},"relatedVulnerabilities":[{"id":"CVE-2022-23539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23539","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://security.netapp.com/advisory/ntap-20240621-0007/","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00058,"percentile":0.18569,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-8cf7-32gw-wr33","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8cf7-32gw-wr33","dataSource":"https://github.com/advisories/GHSA-8cf7-32gw-wr33","namespace":"github:language:javascript","severity":"High","urls":[],"description":"jsonwebtoken unrestricted key type could lead to legacy keys usage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00058,"percentile":0.18569,"date":"2025-10-01"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2022-12-23","kind":"first-observed"}]},"advisories":[],"risk":0.04524},"relatedVulnerabilities":[{"id":"CVE-2022-23539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23539","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://security.netapp.com/advisory/ntap-20240621-0007/","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00058,"percentile":0.18569,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-8cf7-32gw-wr33","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-cgfm-xwp7-2cvr","dataSource":"https://github.com/advisories/GHSA-cgfm-xwp7-2cvr","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Sanitize-html Vulnerable To REDoS Attacks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25887","epss":0.00056,"percentile":0.17737,"date":"2025-10-01"}],"fix":{"versions":["2.7.1"],"state":"fixed","available":[{"version":"2.7.1","date":"2024-04-23","kind":"first-observed"}]},"advisories":[],"risk":0.041999999999999996},"relatedVulnerabilities":[{"id":"CVE-2022-25887","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25887","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c","https://github.com/apostrophecms/sanitize-html/pull/557","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526","https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c","https://github.com/apostrophecms/sanitize-html/pull/557","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526"],"description":"The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25887","epss":0.00056,"percentile":0.17737,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-cgfm-xwp7-2cvr","versionConstraint":"<2.7.1 (semantic)"},"fix":{"suggestedVersion":"2.7.1"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2019-1010023","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[],"epss":[{"cve":"CVE-2019-1010023","epss":0.00722,"percentile":0.71807,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0361},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","namespace":"nvd:cpe","severity":"High","urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023"],"description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","epss":0.00722,"percentile":0.71807,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-44fp-w29j-9vj5","dataSource":"https://github.com/advisories/GHSA-44fp-w29j-9vj5","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Multer vulnerable to Denial of Service via memory leaks from unclosed streams","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47935","epss":0.00037,"percentile":0.10461,"date":"2025-10-01"}],"fix":{"versions":["2.0.0"],"state":"fixed","available":[{"version":"2.0.0","date":"2025-05-22","kind":"first-observed"}]},"advisories":[],"risk":0.027749999999999997},"relatedVulnerabilities":[{"id":"CVE-2025-47935","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47935","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665","https://github.com/expressjs/multer/pull/1120","https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47935","epss":0.00037,"percentile":0.10461,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-44fp-w29j-9vj5","versionConstraint":"<2.0.0 (semantic)"},"fix":{"suggestedVersion":"2.0.0"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4pg4-qvpc-4q3h","dataSource":"https://github.com/advisories/GHSA-4pg4-qvpc-4q3h","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Multer vulnerable to Denial of Service from maliciously crafted requests","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47944","epss":0.00037,"percentile":0.10461,"date":"2025-10-01"}],"fix":{"versions":["2.0.0"],"state":"fixed","available":[{"version":"2.0.0","date":"2025-05-22","kind":"first-observed"}]},"advisories":[],"risk":0.027749999999999997},"relatedVulnerabilities":[{"id":"CVE-2025-47944","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47944","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665","https://github.com/expressjs/multer/issues/1176","https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47944","epss":0.00037,"percentile":0.10461,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-4pg4-qvpc-4q3h","versionConstraint":">=1.4.4-lts.1,<2.0.0 (semantic)"},"fix":{"suggestedVersion":"2.0.0"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-hjrf-2m68-5959","dataSource":"https://github.com/advisories/GHSA-hjrf-2m68-5959","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.00049,"percentile":0.14972,"date":"2025-10-01"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2022-12-23","kind":"first-observed"}]},"advisories":[],"risk":0.0245},"relatedVulnerabilities":[{"id":"CVE-2022-23541","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23541","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://security.netapp.com/advisory/ntap-20240621-0007/","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.00049,"percentile":0.14972,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-hjrf-2m68-5959","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hjrf-2m68-5959","dataSource":"https://github.com/advisories/GHSA-hjrf-2m68-5959","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.00049,"percentile":0.14972,"date":"2025-10-01"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2022-12-23","kind":"first-observed"}]},"advisories":[],"risk":0.0245},"relatedVulnerabilities":[{"id":"CVE-2022-23541","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23541","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://security.netapp.com/advisory/ntap-20240621-0007/","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.00049,"percentile":0.14972,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-hjrf-2m68-5959","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxg6-pf52-xh8x","dataSource":"https://github.com/advisories/GHSA-pxg6-pf52-xh8x","namespace":"github:language:javascript","severity":"Low","urls":[],"description":"cookie accepts cookie name, path, and domain with out of bounds characters","cvss":[],"epss":[{"cve":"CVE-2024-47764","epss":0.00069,"percentile":0.2178,"date":"2025-10-01"}],"fix":{"versions":["0.7.0"],"state":"fixed","available":[{"version":"0.7.0","date":"2024-10-05","kind":"first-observed"}]},"advisories":[],"risk":0.0207},"relatedVulnerabilities":[{"id":"CVE-2024-47764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x"],"description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47764","epss":0.00069,"percentile":0.2178,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cookie","version":"0.4.2"}},"found":{"vulnerabilityID":"GHSA-pxg6-pf52-xh8x","versionConstraint":"<0.7.0 (semantic)"},"fix":{"suggestedVersion":"0.7.0"}}],"artifact":{"id":"299182936c2fe78a","name":"cookie","version":"0.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:cookie:cookie:0.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/cookie@0.4.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2019-1010024","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[],"epss":[{"cve":"CVE-2019-1010024","epss":0.00375,"percentile":0.58544,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.01875},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024"],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010024","epss":0.00375,"percentile":0.58544,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2010-4756","dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.","cvss":[],"epss":[{"cve":"CVE-2010-4756","epss":0.00373,"percentile":0.58434,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.01865},"relatedVulnerabilities":[{"id":"CVE-2010-4756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","namespace":"nvd:cpe","severity":"Medium","urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756"],"description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4756","epss":0.00373,"percentile":0.58434,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2019-9192","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern","cvss":[],"epss":[{"cve":"CVE-2019-9192","epss":0.00363,"percentile":0.57816,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.018150000000000003},"relatedVulnerabilities":[{"id":"CVE-2019-9192","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS","https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-9192","epss":0.00363,"percentile":0.57816,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-qhxp-v273-g94h","dataSource":"https://github.com/advisories/GHSA-qhxp-v273-g94h","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"sanitize-html is vulnerable to XSS through incomprehensive sanitization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-25225","epss":0.0003,"percentile":0.07499,"date":"2025-10-01"}],"fix":{"versions":["2.0.0-beta"],"state":"fixed","available":[{"version":"2.0.0-beta","date":"2025-09-13","kind":"first-observed"}]},"advisories":[],"risk":0.016649999999999995},"relatedVulnerabilities":[{"id":"CVE-2019-25225","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-25225","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225","https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3","https://github.com/apostrophecms/sanitize-html/issues/293","https://github.com/apostrophecms/sanitize-html/pull/156"],"description":"`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-25225","epss":0.0003,"percentile":0.07499,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-qhxp-v273-g94h","versionConstraint":"<2.0.0-beta (semantic)"},"fix":{"suggestedVersion":"2.0.0-beta"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-9230","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-9230","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9230","epss":0.00022,"percentile":0.04669,"date":"2025-10-01"}],"fix":{"versions":["3.0.17-1~deb12u3"],"state":"fixed","available":[{"version":"3.0.17-1~deb12u3","date":"2025-10-01","kind":"advisory"}]},"advisories":[{"id":"","link":"https://security-tracker.debian.org/tracker/DSA-6015-1"}],"risk":0.0165},"relatedVulnerabilities":[{"id":"CVE-2025-9230","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt"],"description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9230","epss":0.00022,"percentile":0.04669,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"< 3.0.17-1~deb12u3 (deb)"},"fix":{"suggestedVersion":"3.0.17-1~deb12u3"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2025-9232","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-9232","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9232","epss":0.00028,"percentile":0.06632,"date":"2025-10-01"}],"fix":{"versions":["3.0.17-1~deb12u3"],"state":"fixed","available":[{"version":"3.0.17-1~deb12u3","date":"2025-10-01","kind":"advisory"}]},"advisories":[{"id":"","link":"https://security-tracker.debian.org/tracker/DSA-6015-1"}],"risk":0.01526},"relatedVulnerabilities":[{"id":"CVE-2025-9232","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35","https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b","https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3","https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf","https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0","https://openssl-library.org/news/secadv/20250930.txt"],"description":"Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9232","epss":0.00028,"percentile":0.06632,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-9232","versionConstraint":"< 3.0.17-1~deb12u3 (deb)"},"fix":{"suggestedVersion":"3.0.17-1~deb12u3"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-fjgf-rc76-4x9p","dataSource":"https://github.com/advisories/GHSA-fjgf-rc76-4x9p","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Multer vulnerable to Denial of Service via unhandled exception from malformed request","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7338","epss":0.00018,"percentile":0.03368,"date":"2025-10-01"}],"fix":{"versions":["2.0.2"],"state":"fixed","available":[{"version":"2.0.2","date":"2025-07-18","kind":"first-observed"}]},"advisories":[],"risk":0.0135},"relatedVulnerabilities":[{"id":"CVE-2025-7338","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7338","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b","https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7338","epss":0.00018,"percentile":0.03368,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-fjgf-rc76-4x9p","versionConstraint":">=1.4.4-lts.1,<2.0.2 (semantic)"},"fix":{"suggestedVersion":"2.0.2"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2019-1010025","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.","cvss":[],"epss":[{"cve":"CVE-2019-1010025","epss":0.00228,"percentile":0.45783,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0114},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","namespace":"nvd:cpe","severity":"Medium","urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025"],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010025","epss":0.00228,"percentile":0.45783,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-qwph-4952-7xr6","dataSource":"https://github.com/advisories/GHSA-qwph-4952-7xr6","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00016,"percentile":0.02667,"date":"2025-10-01"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2022-12-23","kind":"first-observed"}]},"advisories":[],"risk":0.009120000000000001},"relatedVulnerabilities":[{"id":"CVE-2022-23540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23540","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://security.netapp.com/advisory/ntap-20240621-0007/","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00016,"percentile":0.02667,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-qwph-4952-7xr6","versionConstraint":"<9.0.0 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qwph-4952-7xr6","dataSource":"https://github.com/advisories/GHSA-qwph-4952-7xr6","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00016,"percentile":0.02667,"date":"2025-10-01"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2022-12-23","kind":"first-observed"}]},"advisories":[],"risk":0.009120000000000001},"relatedVulnerabilities":[{"id":"CVE-2022-23540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23540","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://security.netapp.com/advisory/ntap-20240621-0007/","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00016,"percentile":0.02667,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-qwph-4952-7xr6","versionConstraint":"<9.0.0 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-4802","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-4802","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-4802","epss":0.00011,"percentile":0.00953,"date":"2025-10-01"}],"fix":{"versions":["2.36-9+deb12u11"],"state":"fixed","available":[{"version":"2.36-9+deb12u11","date":"2025-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.008415},"relatedVulnerabilities":[{"id":"CVE-2025-4802","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4802","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32976","https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e","http://www.openwall.com/lists/oss-security/2025/05/16/7","http://www.openwall.com/lists/oss-security/2025/05/17/2"],"description":"Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-4802","epss":0.00011,"percentile":0.00953,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-4802","versionConstraint":"< 2.36-9+deb12u11 (deb)"},"fix":{"suggestedVersion":"2.36-9+deb12u11"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2019-1010022","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[],"epss":[{"cve":"CVE-2019-1010022","epss":0.00145,"percentile":0.35658,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.00725},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","namespace":"nvd:cpe","severity":"Critical","urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022"],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010022","epss":0.00145,"percentile":0.35658,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2025-8058","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-8058","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8058","epss":0.0001,"percentile":0.00732,"date":"2025-10-01"}],"fix":{"versions":["2.36-9+deb12u13"],"state":"fixed","available":[{"version":"2.36-9+deb12u13","date":"2025-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.00545},"relatedVulnerabilities":[{"id":"CVE-2025-8058","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8058","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33185","https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f"],"description":"The regcomp function in the GNU C library version from 2.4 to 2.41 is \nsubject to a double free if some previous allocation fails. It can be \naccomplished either by a malloc failure or by using an interposed malloc\n that injects random malloc failures. The double free can allow buffer \nmanipulation depending of how the regex is constructed. This issue \naffects all architectures and ABIs supported by the GNU C library.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8058","epss":0.0001,"percentile":0.00732,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-8058","versionConstraint":"< 2.36-9+deb12u13 (deb)"},"fix":{"suggestedVersion":"2.36-9+deb12u13"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2025-27587","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-27587","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","cvss":[],"epss":[{"cve":"CVE-2025-27587","epss":0.00058,"percentile":0.18394,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0029},"relatedVulnerabilities":[{"id":"CVE-2025-27587","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27587","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/issues/24253","https://minerva.crocs.fi.muni.cz"],"description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27587","epss":0.00058,"percentile":0.18394,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-27587","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.00051,"percentile":0.15883,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.00255},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.00051,"percentile":0.15883,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0a534483a88e1e33","name":"gcc-12-base","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/gcc-12-base","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/var/lib/dpkg/status.d/gcc-12-base","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/gcc-12-base.md5sums","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/var/lib/dpkg/status.d/gcc-12-base.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.00051,"percentile":0.15883,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.00255},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.00051,"percentile":0.15883,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"74f0cf86f14f0675","name":"libgcc-s1","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libgcc-s1","layerID":"sha256:c3abae442368dc447f15c468933843c361f227f5d87b2bb86515b49f40583ed9","accessPath":"/var/lib/dpkg/status.d/libgcc-s1","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libgcc-s1.md5sums","layerID":"sha256:c3abae442368dc447f15c468933843c361f227f5d87b2bb86515b49f40583ed9","accessPath":"/var/lib/dpkg/status.d/libgcc-s1.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.00051,"percentile":0.15883,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.00255},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.00051,"percentile":0.15883,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"cd7473971e9d06dd","name":"libgomp1","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libgomp1","layerID":"sha256:2401c5ea32a75452bc4b02a664c80cf63f197704653926fca19e22e6cbc85652","accessPath":"/var/lib/dpkg/status.d/libgomp1","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/status.d/libgomp1.md5sums","layerID":"sha256:2401c5ea32a75452bc4b02a664c80cf63f197704653926fca19e22e6cbc85652","accessPath":"/var/lib/dpkg/status.d/libgomp1.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:libgomp1:libgomp1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libgomp1@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.00051,"percentile":0.15883,"date":"2025-10-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.00255},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.00051,"percentile":0.15883,"date":"2025-10-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9a37debf0d05047e","name":"libstdc++6","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libstdc++6","layerID":"sha256:6819a1af097df543d58dc30b51f737e55f3f42a9a04e641f175834a55bf0629c","accessPath":"/var/lib/dpkg/status.d/libstdc++6","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/status.d/libstdc++6.md5sums","layerID":"sha256:6819a1af097df543d58dc30b51f737e55f3f42a9a04e641f175834a55bf0629c","accessPath":"/var/lib/dpkg/status.d/libstdc++6.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"GHSA-5mrr-rgp6-x4gr","dataSource":"https://github.com/advisories/GHSA-5mrr-rgp6-x4gr","namespace":"github:language:javascript","severity":"Critical","urls":[],"description":"Command Injection in marsdb","cvss":[],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"marsdb","version":"0.6.11"}},"found":{"vulnerabilityID":"GHSA-5mrr-rgp6-x4gr","versionConstraint":">=0.0.0 (semantic)"}}],"artifact":{"id":"92d5870e9d43058d","name":"marsdb","version":"0.6.11","type":"npm","locations":[{"path":"/juice-shop/node_modules/marsdb/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/marsdb/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:marsdb:marsdb:0.6.11:*:*:*:*:*:*:*","cpe:2.3:a:c58:marsdb:0.6.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/marsdb@0.6.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-gjcw-v447-2w7q","dataSource":"https://github.com/advisories/GHSA-gjcw-v447-2w7q","namespace":"github:language:javascript","severity":"High","urls":[],"description":"Forgeable Public/Private Tokens in jws","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}}],"fix":{"versions":["3.0.0"],"state":"fixed","available":[{"version":"3.0.0","date":"2020-09-02","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2016-1000223","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jws","version":"0.2.6"}},"found":{"vulnerabilityID":"GHSA-gjcw-v447-2w7q","versionConstraint":"<3.0.0 (semantic)"},"fix":{"suggestedVersion":"3.0.0"}}],"artifact":{"id":"e3ae0c46d846c3b2","name":"jws","version":"0.2.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/jws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jws/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:brianloveswords:jws:0.2.6:*:*:*:*:*:*:*","cpe:2.3:a:jws:jws:0.2.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/jws@0.2.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-rvg8-pwq2-xj7q","dataSource":"https://github.com/advisories/GHSA-rvg8-pwq2-xj7q","namespace":"github:language:javascript","severity":"Medium","urls":[],"description":"Out-of-bounds Read in base64url","cvss":[],"fix":{"versions":["3.0.0"],"state":"fixed","available":[{"version":"3.0.0","date":"2020-09-02","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"base64url","version":"0.0.6"}},"found":{"vulnerabilityID":"GHSA-rvg8-pwq2-xj7q","versionConstraint":"<3.0.0 (semantic)"},"fix":{"suggestedVersion":"3.0.0"}}],"artifact":{"id":"2f8a9d6c7656ba10","name":"base64url","version":"0.0.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/base64url/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64url/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:brianloveswords:base64url:0.0.6:*:*:*:*:*:*:*","cpe:2.3:a:base64url:base64url:0.0.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/base64url@0.0.6","upstreams":[]}}],"source":{"type":"image","target":{"userInput":"bkimminich/juice-shop:v19.0.0","imageID":"sha256:37cc73163c4c269c044e890fee868d62637109cad126a26dab13dc442ef2ae76","manifestDigest":"sha256:547abd35794ef5435213b0bbd658d2e3f55528b390126334445124201eeefc1f","mediaType":"application/vnd.docker.distribution.manifest.v2+json","tags":["bkimminich/juice-shop:v19.0.0"],"imageSize":421051540,"layers":[{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","size":270682},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:8fa10c0194df9b7c054c90dbe482585f768a54428fc90a5b78a0066a123b1bba","size":22888},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:48c0fb67386ed713921fcc0468be23231d0872fa67ccc8ea3929df4656b6ddfc","size":1462778},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:114dde0fefebbca13165d0da9c500a66190e497a82a53dcaabc3172d630be1e9","size":82129},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:4d049f83d9cf21d1f5cc0e11deaf36df02790d0e60c1a3829538fb4b61685368","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:af5aa97ebe6ce1604747ec1e21af7136ded391bcabe4acef882e718a87c86bcc","size":149},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:bbb6cacb8c82e4da4e8143e03351e939eab5e21ce0ef333c42e637af86c5217b","size":64},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2a92d6ac9e4fcc274d5168b217ca4458a9fec6f094ead68d99c77073f08caac1","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:1a73b54f556b477f0a8b939d13c504a3b4f4db71f7a09c63afbc10acb3de5849","size":497},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:f4aee9e53c42a22ed82451218c3ea03d1eea8d6ca8fbe8eb4e950304ba8a8bb3","size":346},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:bfe9137a1b044e8097cdfcb6899137a8a984ed70931ed1e8ef0cf7e023a139fc","size":235531},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","size":12820707},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","size":5901043},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","size":94016},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2401c5ea32a75452bc4b02a664c80cf63f197704653926fca19e22e6cbc85652","size":291001},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:6819a1af097df543d58dc30b51f737e55f3f42a9a04e641f175834a55bf0629c","size":2311333},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:c3abae442368dc447f15c468933843c361f227f5d87b2bb86515b49f40583ed9","size":126113},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","size":121755661},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:3cd50cf8b20753e35bd3d82fb45a6a248ae993d889e104e0be02d309d2accbdc","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","size":275676602}],"manifest":"eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo1MzA5LCJkaWdlc3QiOiJzaGEyNTY6MzdjYzczMTYzYzRjMjY5YzA0NGU4OTBmZWU4NjhkNjI2MzcxMDljYWQxMjZhMjZkYWIxM2RjNDQyZWYyYWU3NiJ9LCJsYXllcnMiOlt7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoxMDQyMjYsImRpZ2VzdCI6InNoYTI1NjpmNDY0YWY0YjliMjUxZWJlOGE3YzJmMTg2YWZmNjU2ZjA4OTJmNmNiMTU5ODM3YTZjZThmZDYzODQyZTgzZTM1In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MTMzNTYsImRpZ2VzdCI6InNoYTI1Njo4ZmExMGMwMTk0ZGY5YjdjMDU0YzkwZGJlNDgyNTg1Zjc2OGE1NDQyOGZjOTBhNWI3OGEwMDY2YTEyM2IxYmJhIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6NTQ3NTkzLCJkaWdlc3QiOiJzaGEyNTY6NDhjMGZiNjczODZlZDcxMzkyMWZjYzA0NjhiZTIzMjMxZDA4NzJmYTY3Y2NjOGVhMzkyOWRmNDY1NmI2ZGRmYyJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjMxMjQwLCJkaWdlc3QiOiJzaGEyNTY6MTE0ZGRlMGZlZmViYmNhMTMxNjVkMGRhOWM1MDBhNjYxOTBlNDk3YTgyYTUzZGNhYWJjMzE3MmQ2MzBiZTFlOSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjY3LCJkaWdlc3QiOiJzaGEyNTY6NGQwNDlmODNkOWNmMjFkMWY1Y2MwZTExZGVhZjM2ZGYwMjc5MGQwZTYwYzFhMzgyOTUzOGZiNGI2MTY4NTM2OCJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjE4OCwiZGlnZXN0Ijoic2hhMjU2OmFmNWFhOTdlYmU2Y2UxNjA0NzQ3ZWMxZTIxYWY3MTM2ZGVkMzkxYmNhYmU0YWNlZjg4MmU3MThhODdjODZiY2MifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoxMjMsImRpZ2VzdCI6InNoYTI1Njo2ZjFjZGNlYjZhMzE0NmYwY2NiOTg2NTIxMTU2YmVmOGE0MjJjZGJiMDg2MzM5NmY3Zjc1MWY1NzViYTMwOGY0In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MTY4LCJkaWdlc3QiOiJzaGEyNTY6YmJiNmNhY2I4YzgyZTRkYTRlODE0M2UwMzM1MWU5MzllYWI1ZTIxY2UwZWYzMzNjNDJlNjM3YWY4NmM1MjE3YiJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjkzLCJkaWdlc3QiOiJzaGEyNTY6MmE5MmQ2YWM5ZTRmY2MyNzRkNTE2OGIyMTdjYTQ0NThhOWZlYzZmMDk0ZWFkNjhkOTljNzcwNzNmMDhjYWFjMSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjM4NSwiZGlnZXN0Ijoic2hhMjU2OjFhNzNiNTRmNTU2YjQ3N2YwYThiOTM5ZDEzYzUwNGEzYjRmNGRiNzFmN2EwOWM2M2FmYmMxMGFjYjNkZTU4NDkifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjozMjEsImRpZ2VzdCI6InNoYTI1NjpmNGFlZTllNTNjNDJhMjJlZDgyNDUxMjE4YzNlYTAzZDFlZWE4ZDZjYThmYmU4ZWI0ZTk1MDMwNGJhOGE4YmIzIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MTMxOTI3LCJkaWdlc3QiOiJzaGEyNTY6YmZlOTEzN2ExYjA0NGU4MDk3Y2RmY2I2ODk5MTM3YThhOTg0ZWQ3MDkzMWVkMWU4ZWYwY2Y3ZTAyM2ExMzlmYyJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjU4MzAyMTQsImRpZ2VzdCI6InNoYTI1NjpkNWEzZTAxNDE2MWJiNjAyZDg3YzIzMTJlMzcxYWQyZWE2ZjgwMGM3ZjdhZjI2MWFmNGZhYTY3MzAyYjUzYzg4In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjgyNzIyNSwiZGlnZXN0Ijoic2hhMjU2OjJlNDk4M2M3NjFjZTQ5MzNlY2VjMjNjMzExNzNmZWQ1NTFhMjM3YzhkMGJhMzU5YjY5N2RlNjRiZDk1M2E3YzMifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjo0NDk4MywiZGlnZXN0Ijoic2hhMjU2OjcwOTU0MTI0MTdkMmRjZTI4OWI3N2Y3YThjNjMyYTA3YzgyYjcwN2ZlNDNjZmVmNzM2OGMzYjY1YzhkMjUzOGEifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoxNTA4MDgsImRpZ2VzdCI6InNoYTI1NjoyNDAxYzVlYTMyYTc1NDUyYmM0YjAyYTY2NGM4MGNmNjNmMTk3NzA0NjUzOTI2ZmNhMTllMjJlNmNiYzg1NjUyIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6OTExODEyLCJkaWdlc3QiOiJzaGEyNTY6NjgxOWExYWYwOTdkZjU0M2Q1OGRjMzBiNTFmNzM3ZTU1ZjNmNDJhOWEwNGU2NDFmMTc1ODM0YTU1YmYwNjI5YyJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjY1MTE2LCJkaWdlc3QiOiJzaGEyNTY6YzNhYmFlNDQyMzY4ZGM0NDdmMTVjNDY4OTMzODQzYzM2MWYyMjdmNWQ4N2IyYmI4NjUxNWI0OWY0MDU4M2VkOSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjUwNjUzMzgyLCJkaWdlc3QiOiJzaGEyNTY6MmY1MjM5YzdiMmJmYmRhM2UyNzVhMDUzY2EwODY1ZmM0Y2I4YWFkNmQxZmQ1YWNhMjJkM2UxZTU0ZjMyZGY5OSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjEwMCwiZGlnZXN0Ijoic2hhMjU2OjNjZDUwY2Y4YjIwNzUzZTM1YmQzZDgyZmI0NWE2YTI0OGFlOTkzZDg4OWUxMDRlMGJlMDJkMzA5ZDJhY2NiZGMifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjo5NzA3NTI0MCwiZGlnZXN0Ijoic2hhMjU2OjFlOGRhNjU0YjJlMDU3ZWY0M2YyNjM4NGFhOWM3MWQyYmRhZmRjNGRlMDI0OGNmMWNmZDQ0YzQ4Njc1NTkxMjMifV19","config":"eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJVc2VyIjoiNjU1MzIiLCJFeHBvc2VkUG9ydHMiOnsiMzAwMC90Y3AiOnt9fSwiRW52IjpbIlBBVEg9L3Vzci9sb2NhbC9zYmluOi91c3IvbG9jYWwvYmluOi91c3Ivc2JpbjovdXNyL2Jpbjovc2JpbjovYmluIiwiU1NMX0NFUlRfRklMRT0vZXRjL3NzbC9jZXJ0cy9jYS1jZXJ0aWZpY2F0ZXMuY3J0Il0sIkVudHJ5cG9pbnQiOlsiL25vZGVqcy9iaW4vbm9kZSJdLCJDbWQiOlsiL2p1aWNlLXNob3AvYnVpbGQvYXBwLmpzIl0sIldvcmtpbmdEaXIiOiIvanVpY2Utc2hvcCIsIkxhYmVscyI6eyJtYWludGFpbmVyIjoiQmpvZXJuIEtpbW1pbmljaCBcdTAwM2Niam9lcm4ua2ltbWluaWNoQG93YXNwLm9yZ1x1MDAzZSIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5hdXRob3JzIjoiQmpvZXJuIEtpbW1pbmljaCBcdTAwM2Niam9lcm4ua2ltbWluaWNoQG93YXNwLm9yZ1x1MDAzZSIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5jcmVhdGVkIjoi4oCdMjAyNS0wOS0wNFQwNTozODoxMVrigJ0iLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuZGVzY3JpcHRpb24iOiJQcm9iYWJseSB0aGUgbW9zdCBtb2Rlcm4gYW5kIHNvcGhpc3RpY2F0ZWQgaW5zZWN1cmUgd2ViIGFwcGxpY2F0aW9uIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRvY3VtZW50YXRpb24iOiJodHRwczovL2hlbHAub3dhc3AtanVpY2Uuc2hvcCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5saWNlbnNlcyI6Ik1JVCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5yZXZpc2lvbiI6IjM2ODcwY2IiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlIjoiaHR0cHM6Ly9naXRodWIuY29tL2p1aWNlLXNob3AvanVpY2Utc2hvcCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS50aXRsZSI6Ik9XQVNQIEp1aWNlIFNob3AiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudXJsIjoiaHR0cHM6Ly9vd2FzcC1qdWljZS5zaG9wIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlbmRvciI6Ik9wZW4gV29ybGR3aWRlIEFwcGxpY2F0aW9uIFNlY3VyaXR5IFByb2plY3QiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVyc2lvbiI6IjE5LjAuMCJ9LCJBcmdzRXNjYXBlZCI6dHJ1ZX0sImNyZWF0ZWQiOiIyMDI1LTA5LTA0VDA1OjQyOjI3LjI1NDQyNzU5NloiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIyMDI1LTA5LTA0VDA1OjM4OjE4Ljg4MDcyMTk0MloiLCJjcmVhdGVkX2J5IjoiQVJHIEJVSUxEX0RBVEU94oCdMjAyNS0wOS0wNFQwNTozODoxMVrigJ0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI1LTA5LTA0VDA1OjM4OjE4Ljg4MDcyMTk0MloiLCJjcmVhdGVkX2J5IjoiQVJHIFZDU19SRUY9MzY4NzBjYiIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjUtMDktMDRUMDU6Mzg6MTguODgwNzIxOTQyWiIsImNyZWF0ZWRfYnkiOiJMQUJFTCBtYWludGFpbmVyPUJqb2VybiBLaW1taW5pY2ggXHUwMDNjYmpvZXJuLmtpbW1pbmljaEBvd2FzcC5vcmdcdTAwM2Ugb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnRpdGxlPU9XQVNQIEp1aWNlIFNob3Agb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRlc2NyaXB0aW9uPVByb2JhYmx5IHRoZSBtb3N0IG1vZGVybiBhbmQgc29waGlzdGljYXRlZCBpbnNlY3VyZSB3ZWIgYXBwbGljYXRpb24gb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmF1dGhvcnM9QmpvZXJuIEtpbW1pbmljaCBcdTAwM2Niam9lcm4ua2ltbWluaWNoQG93YXNwLm9yZ1x1MDAzZSBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yPU9wZW4gV29ybGR3aWRlIEFwcGxpY2F0aW9uIFNlY3VyaXR5IFByb2plY3Qgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRvY3VtZW50YXRpb249aHR0cHM6Ly9oZWxwLm93YXNwLWp1aWNlLnNob3Agb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmxpY2Vuc2VzPU1JVCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVyc2lvbj0xOS4wLjAgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnVybD1odHRwczovL293YXNwLWp1aWNlLnNob3Agb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnNvdXJjZT1odHRwczovL2dpdGh1Yi5jb20vanVpY2Utc2hvcC9qdWljZS1zaG9wIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5yZXZpc2lvbj0zNjg3MGNiIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5jcmVhdGVkPeKAnTIwMjUtMDktMDRUMDU6Mzg6MTFa4oCdIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNS0wOS0wNFQwNTozODoxOC44ODA3MjE5NDJaIiwiY3JlYXRlZF9ieSI6IldPUktESVIgL2p1aWNlLXNob3AiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjUtMDktMDRUMDU6NDI6MjcuMjU0NDI3NTk2WiIsImNyZWF0ZWRfYnkiOiJDT1BZIC0tY2hvd249NjU1MzI6MCAvanVpY2Utc2hvcCAuICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjUtMDktMDRUMDU6NDI6MjcuMjU0NDI3NTk2WiIsImNyZWF0ZWRfYnkiOiJVU0VSIDY1NTMyIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNS0wOS0wNFQwNTo0MjoyNy4yNTQ0Mjc1OTZaIiwiY3JlYXRlZF9ieSI6IkVYUE9TRSBtYXBbMzAwMC90Y3A6e31dIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNS0wOS0wNFQwNTo0MjoyNy4yNTQ0Mjc1OTZaIiwiY3JlYXRlZF9ieSI6IkNNRCBbXCIvanVpY2Utc2hvcC9idWlsZC9hcHAuanNcIl0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfV0sIm9zIjoibGludXgiLCJyb290ZnMiOnsidHlwZSI6ImxheWVycyIsImRpZmZfaWRzIjpbInNoYTI1NjpmNDY0YWY0YjliMjUxZWJlOGE3YzJmMTg2YWZmNjU2ZjA4OTJmNmNiMTU5ODM3YTZjZThmZDYzODQyZTgzZTM1Iiwic2hhMjU2OjhmYTEwYzAxOTRkZjliN2MwNTRjOTBkYmU0ODI1ODVmNzY4YTU0NDI4ZmM5MGE1Yjc4YTAwNjZhMTIzYjFiYmEiLCJzaGEyNTY6NDhjMGZiNjczODZlZDcxMzkyMWZjYzA0NjhiZTIzMjMxZDA4NzJmYTY3Y2NjOGVhMzkyOWRmNDY1NmI2ZGRmYyIsInNoYTI1NjoxMTRkZGUwZmVmZWJiY2ExMzE2NWQwZGE5YzUwMGE2NjE5MGU0OTdhODJhNTNkY2FhYmMzMTcyZDYzMGJlMWU5Iiwic2hhMjU2OjRkMDQ5ZjgzZDljZjIxZDFmNWNjMGUxMWRlYWYzNmRmMDI3OTBkMGU2MGMxYTM4Mjk1MzhmYjRiNjE2ODUzNjgiLCJzaGEyNTY6YWY1YWE5N2ViZTZjZTE2MDQ3NDdlYzFlMjFhZjcxMzZkZWQzOTFiY2FiZTRhY2VmODgyZTcxOGE4N2M4NmJjYyIsInNoYTI1Njo2ZjFjZGNlYjZhMzE0NmYwY2NiOTg2NTIxMTU2YmVmOGE0MjJjZGJiMDg2MzM5NmY3Zjc1MWY1NzViYTMwOGY0Iiwic2hhMjU2OmJiYjZjYWNiOGM4MmU0ZGE0ZTgxNDNlMDMzNTFlOTM5ZWFiNWUyMWNlMGVmMzMzYzQyZTYzN2FmODZjNTIxN2IiLCJzaGEyNTY6MmE5MmQ2YWM5ZTRmY2MyNzRkNTE2OGIyMTdjYTQ0NThhOWZlYzZmMDk0ZWFkNjhkOTljNzcwNzNmMDhjYWFjMSIsInNoYTI1NjoxYTczYjU0ZjU1NmI0NzdmMGE4YjkzOWQxM2M1MDRhM2I0ZjRkYjcxZjdhMDljNjNhZmJjMTBhY2IzZGU1ODQ5Iiwic2hhMjU2OmY0YWVlOWU1M2M0MmEyMmVkODI0NTEyMThjM2VhMDNkMWVlYThkNmNhOGZiZThlYjRlOTUwMzA0YmE4YThiYjMiLCJzaGEyNTY6YmZlOTEzN2ExYjA0NGU4MDk3Y2RmY2I2ODk5MTM3YThhOTg0ZWQ3MDkzMWVkMWU4ZWYwY2Y3ZTAyM2ExMzlmYyIsInNoYTI1NjpkNWEzZTAxNDE2MWJiNjAyZDg3YzIzMTJlMzcxYWQyZWE2ZjgwMGM3ZjdhZjI2MWFmNGZhYTY3MzAyYjUzYzg4Iiwic2hhMjU2OjJlNDk4M2M3NjFjZTQ5MzNlY2VjMjNjMzExNzNmZWQ1NTFhMjM3YzhkMGJhMzU5YjY5N2RlNjRiZDk1M2E3YzMiLCJzaGEyNTY6NzA5NTQxMjQxN2QyZGNlMjg5Yjc3ZjdhOGM2MzJhMDdjODJiNzA3ZmU0M2NmZWY3MzY4YzNiNjVjOGQyNTM4YSIsInNoYTI1NjoyNDAxYzVlYTMyYTc1NDUyYmM0YjAyYTY2NGM4MGNmNjNmMTk3NzA0NjUzOTI2ZmNhMTllMjJlNmNiYzg1NjUyIiwic2hhMjU2OjY4MTlhMWFmMDk3ZGY1NDNkNThkYzMwYjUxZjczN2U1NWYzZjQyYTlhMDRlNjQxZjE3NTgzNGE1NWJmMDYyOWMiLCJzaGEyNTY6YzNhYmFlNDQyMzY4ZGM0NDdmMTVjNDY4OTMzODQzYzM2MWYyMjdmNWQ4N2IyYmI4NjUxNWI0OWY0MDU4M2VkOSIsInNoYTI1NjoyZjUyMzljN2IyYmZiZGEzZTI3NWEwNTNjYTA4NjVmYzRjYjhhYWQ2ZDFmZDVhY2EyMmQzZTFlNTRmMzJkZjk5Iiwic2hhMjU2OjNjZDUwY2Y4YjIwNzUzZTM1YmQzZDgyZmI0NWE2YTI0OGFlOTkzZDg4OWUxMDRlMGJlMDJkMzA5ZDJhY2NiZGMiLCJzaGEyNTY6MWU4ZGE2NTRiMmUwNTdlZjQzZjI2Mzg0YWE5YzcxZDJiZGFmZGM0ZGUwMjQ4Y2YxY2ZkNDRjNDg2NzU1OTEyMyJdfX0=","repoDigests":["bkimminich/juice-shop@sha256:2765a26de7647609099a338d5b7f61085d95903c8703bb70f03fcc4b12f0818d"],"architecture":"amd64","os":"linux","labels":{"maintainer":"Bjoern Kimminich ","org.opencontainers.image.authors":"Bjoern Kimminich ","org.opencontainers.image.created":"”2025-09-04T05:38:11Z”","org.opencontainers.image.description":"Probably the most modern and sophisticated insecure web application","org.opencontainers.image.documentation":"https://help.owasp-juice.shop","org.opencontainers.image.licenses":"MIT","org.opencontainers.image.revision":"36870cb","org.opencontainers.image.source":"https://github.com/juice-shop/juice-shop","org.opencontainers.image.title":"OWASP Juice Shop","org.opencontainers.image.url":"https://owasp-juice.shop","org.opencontainers.image.vendor":"Open Worldwide Application Security Project","org.opencontainers.image.version":"19.0.0"}}},"distro":{"name":"debian","version":"12","idLike":[]},"descriptor":{"name":"grype","version":"0.100.0","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":true,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"stock":{"using-cpes":true}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"auth":null,"ca-cert":""},"show-suppressed":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"}},"timestamp":true,"db":{"cache-dir":"/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.1","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.1_2025-10-02T07:55:43Z_1759405832.tar.zst?checksum=sha256%3A1ccd2e6b98c88b0f3e5873332267025eab468c96d36a5363f6c0fd2fef73d429","built":"2025-10-02T11:50:32Z","path":"/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alpine":{"captured":"2025-10-02T07:56:46Z","input":"xxh64:38452298db87fc7e"},"amazon":{"captured":"2025-10-02T07:56:54Z","input":"xxh64:34c1f5008ca75c4c"},"bitnami":{"captured":"2025-10-02T07:56:56Z","input":"xxh64:d0cf1bf89a6ece56"},"chainguard":{"captured":"2025-10-02T07:56:42Z","input":"xxh64:8ed4d04ab0d8fe04"},"chainguard-libraries":{"captured":"2025-10-02T07:56:29Z","input":"xxh64:fcdc249b0f5d9b78"},"debian":{"captured":"2025-10-02T07:56:56Z","input":"xxh64:d59821a6c5ca4736"},"echo":{"captured":"2025-10-02T07:56:43Z","input":"xxh64:de61741a1d191265"},"epss":{"captured":"2025-10-02T07:57:09Z","input":"xxh64:cad4d0451e12cd41"},"github":{"captured":"2025-10-02T07:56:58Z","input":"xxh64:0d4eb4136e4b7e6f"},"kev":{"captured":"2025-10-02T07:56:55Z","input":"xxh64:fe16882289df8587"},"mariner":{"captured":"2025-10-02T07:56:28Z","input":"xxh64:519d725f2e34e528"},"minimos":{"captured":"2025-10-02T07:56:30Z","input":"xxh64:cb75949161392ac2"},"nvd":{"captured":"2025-10-02T07:57:32Z","input":"xxh64:4fbbb637225c16e0"},"oracle":{"captured":"2025-10-02T07:55:43Z","input":"xxh64:86cd00cbafa9b2db"},"rhel":{"captured":"2025-10-02T07:57:13Z","input":"xxh64:2ea392df5801a934"},"sles":{"captured":"2025-10-02T07:57:04Z","input":"xxh64:582b9a6aab9eaf51"},"ubuntu":{"captured":"2025-10-02T07:58:16Z","input":"xxh64:37ebd50e329e500f"},"wolfi":{"captured":"2025-10-02T07:56:51Z","input":"xxh64:ad7e3e790796110c"}}},"timestamp":"2025-10-02T13:56:41.870294993Z"}}
diff --git a/labs/lab4/syft/grype-vuln-table.txt b/labs/lab4/syft/grype-vuln-table.txt
new file mode 100644
index 00000000..51fd0c41
--- /dev/null
+++ b/labs/lab4/syft/grype-vuln-table.txt
@@ -0,0 +1,66 @@
+NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
+vm2 3.9.17 3.9.18 npm GHSA-whpj-8f3w-67p5 Critical 69.5% (98th) 65.3
+jsonwebtoken 0.1.0 4.2.2 npm GHSA-c7hr-j4mj-j2w6 Critical 41.1% (97th) 37.0
+jsonwebtoken 0.4.0 4.2.2 npm GHSA-c7hr-j4mj-j2w6 Critical 41.1% (97th) 37.0
+vm2 3.9.17 npm GHSA-g644-9gfx-q4q4 Critical 35.6% (96th) 33.4
+vm2 3.9.17 npm GHSA-cchq-frgv-rjh5 Critical 4.7% (88th) 4.4
+ip 2.0.1 npm GHSA-2p57-rm9w-gvfp High 2.9% (85th) 2.3
+engine.io 4.1.2 6.2.1 npm GHSA-r7qp-cfhv-p84w Medium 2.8% (85th) 1.6
+lodash.set 4.3.2 npm GHSA-p6mc-m468-83gw High 2.0% (83rd) 1.5
+lodash 2.4.2 4.17.12 npm GHSA-jf85-cpcp-j695 Critical 1.2% (78th) 1.1
+crypto-js 3.3.0 4.2.0 npm GHSA-xwcq-pm8m-c4vf Critical 1.0% (75th) 0.9
+moment 2.0.0 2.11.2 npm GHSA-87vv-r9j6-g5qv Medium 1.4% (79th) 0.8
+sanitize-html 1.4.2 2.12.1 npm GHSA-rm97-x556-q36h Medium 1.3% (79th) 0.7
+moment 2.0.0 2.29.2 npm GHSA-8hfj-j24r-96c4 High 0.7% (71st) 0.5
+got 8.3.2 11.8.5 npm GHSA-pfrx-2q88-qq97 Medium 0.8% (73rd) 0.4
+ws 7.4.6 7.5.10 npm GHSA-3h5v-q93c-6h6q High 0.5% (66th) 0.4
+vm2 3.9.17 3.9.18 npm GHSA-p5gc-c584-jj6v Medium 0.7% (70th) 0.3
+lodash 2.4.2 4.17.21 npm GHSA-35jh-r3h4-6jhm High 0.3% (54th) 0.2
+moment 2.0.0 2.19.3 npm GHSA-446m-mv8f-q348 High 0.2% (47th) 0.2
+sanitize-html 1.4.2 1.4.3 npm GHSA-3j7m-hmh3-9jmp Medium 0.3% (55th) 0.2
+notevil 1.3.3 npm GHSA-8g4m-cjm2-96wq Medium 0.3% (53rd) 0.2
+lodash 2.4.2 4.17.11 npm GHSA-4xc9-xhrj-v574 High 0.2% (43rd) 0.2
+sanitize-html 1.4.2 2.3.2 npm GHSA-mjxr-4v3x-q3m4 Medium 0.3% (52nd) 0.1
+sanitize-html 1.4.2 2.3.1 npm GHSA-rjqq-98f6-6j3r Medium 0.3% (52nd) 0.1
+sanitize-html 1.4.2 1.11.4 npm GHSA-xc6g-ggrc-qq4r Medium 0.3% (51st) 0.1
+braces 2.3.2 3.0.3 npm GHSA-grv7-fg5c-xmjg High 0.2% (37th) 0.1
+http-cache-semantics 3.8.1 4.1.1 npm GHSA-rc47-6667-2j5j High 0.2% (37th) 0.1
+tar 4.4.19 6.2.1 npm GHSA-f5x3-32g6-xq36 Medium 0.2% (42nd) 0.1
+socket.io-parser 4.0.5 4.2.3 npm GHSA-cqmj-92xf-r6r9 Medium 0.2% (37th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.8% (82nd) < 0.1
+lodash 2.4.2 4.17.5 npm GHSA-fvqr-27wr-82fm Medium 0.1% (34th) < 0.1
+express-jwt 0.1.3 6.0.0 npm GHSA-6g6m-m6h5-w9gf High < 0.1% (27th) < 0.1
+socket.io 3.1.2 4.6.2 npm GHSA-25hc-qcg6-38wj Medium 0.1% (28th) < 0.1
+micromatch 3.1.10 4.0.8 npm GHSA-952p-6rrq-rcjv Medium 0.1% (29th) < 0.1
+tar-fs 2.1.3 2.1.4 npm GHSA-vj76-c3g6-qr5v High < 0.1% (20th) < 0.1
+multer 1.4.5-lts.2 2.0.1 npm GHSA-g5hg-p3ph-g8qg High < 0.1% (20th) < 0.1
+jsonwebtoken 0.1.0 9.0.0 npm GHSA-8cf7-32gw-wr33 High < 0.1% (18th) < 0.1
+jsonwebtoken 0.4.0 9.0.0 npm GHSA-8cf7-32gw-wr33 High < 0.1% (18th) < 0.1
+sanitize-html 1.4.2 2.7.1 npm GHSA-cgfm-xwp7-2cvr High < 0.1% (17th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010023 Negligible 0.7% (71st) < 0.1
+multer 1.4.5-lts.2 2.0.0 npm GHSA-44fp-w29j-9vj5 High < 0.1% (10th) < 0.1
+multer 1.4.5-lts.2 2.0.0 npm GHSA-4pg4-qvpc-4q3h High < 0.1% (10th) < 0.1
+jsonwebtoken 0.1.0 9.0.0 npm GHSA-hjrf-2m68-5959 Medium < 0.1% (14th) < 0.1
+jsonwebtoken 0.4.0 9.0.0 npm GHSA-hjrf-2m68-5959 Medium < 0.1% (14th) < 0.1
+cookie 0.4.2 0.7.0 npm GHSA-pxg6-pf52-xh8x Low < 0.1% (21st) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010024 Negligible 0.4% (58th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2010-4756 Negligible 0.4% (58th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-9192 Negligible 0.4% (57th) < 0.1
+sanitize-html 1.4.2 2.0.0-beta npm GHSA-qhxp-v273-g94h Medium < 0.1% (7th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.17-1~deb12u3 deb CVE-2025-9230 High < 0.1% (4th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.17-1~deb12u3 deb CVE-2025-9232 Medium < 0.1% (6th) < 0.1
+multer 1.4.5-lts.2 2.0.2 npm GHSA-fjgf-rc76-4x9p High < 0.1% (3rd) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010025 Negligible 0.2% (45th) < 0.1
+jsonwebtoken 0.1.0 9.0.0 npm GHSA-qwph-4952-7xr6 Medium < 0.1% (2nd) < 0.1
+jsonwebtoken 0.4.0 9.0.0 npm GHSA-qwph-4952-7xr6 Medium < 0.1% (2nd) < 0.1
+libc6 2.36-9+deb12u10 2.36-9+deb12u11 deb CVE-2025-4802 High < 0.1% (0th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010022 Negligible 0.1% (35th) < 0.1
+libc6 2.36-9+deb12u10 2.36-9+deb12u13 deb CVE-2025-8058 Medium < 0.1% (0th) < 0.1
+libssl3 3.0.17-1~deb12u2 deb CVE-2025-27587 Negligible < 0.1% (18th) < 0.1
+gcc-12-base 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libgcc-s1 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libgomp1 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libstdc++6 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+marsdb 0.6.11 npm GHSA-5mrr-rgp6-x4gr Critical N/A N/A
+jws 0.2.6 3.0.0 npm GHSA-gjcw-v447-2w7q High N/A N/A
+base64url 0.0.6 3.0.0 npm GHSA-rvg8-pwq2-xj7q Medium N/A N/A
diff --git a/labs/lab4/syft/juice-shop-licenses.txt b/labs/lab4/syft/juice-shop-licenses.txt
new file mode 100644
index 00000000..207f4125
--- /dev/null
+++ b/labs/lab4/syft/juice-shop-licenses.txt
@@ -0,0 +1,1123 @@
+Extracting licenses from Syft SBOM...
+1to2 | 1.0.0 | MIT
+@adraffy/ens-normalize | 1.10.1 | MIT
+@babel/helper-string-parser | 7.27.1 | MIT
+@babel/helper-validator-identifier | 7.27.1 | MIT
+@babel/parser | 7.28.3 | MIT
+@babel/types | 7.28.2 | MIT
+@colors/colors | 1.6.0 | MIT
+@colors/colors | 1.6.0 | MIT
+@dabh/diagnostics | 2.0.3 | MIT
+@ethereumjs/rlp | 4.0.1 | MPL-2.0
+@ethereumjs/rlp | 5.0.2 | MPL-2.0
+@gar/promisify | 1.1.3 | MIT
+@isaacs/cliui | 8.0.2 | ISC
+@isaacs/fs-minipass | 4.0.1 | ISC
+@my-scope/package-a | 0.0.0 | MIT
+@my-scope/package-b | 0.0.0 | MIT
+@nlpjs/core | 4.26.1 | MIT
+@nlpjs/core-loader | 4.26.1 | MIT
+@nlpjs/evaluator | 4.26.1 | MIT
+@nlpjs/lang-en | 4.26.1 | MIT
+@nlpjs/lang-en-min | 4.26.1 | MIT
+@nlpjs/language | 4.25.0 | MIT
+@nlpjs/language-min | 4.25.0 | MIT
+@nlpjs/ner | 4.27.0 | MIT
+@nlpjs/neural | 4.25.0 | MIT
+@nlpjs/nlg | 4.26.1 | MIT
+@nlpjs/nlp | 4.27.0 | MIT
+@nlpjs/nlu | 4.27.0 | MIT
+@nlpjs/request | 4.25.0 | MIT
+@nlpjs/sentiment | 4.26.1 | MIT
+@nlpjs/similarity | 4.26.1 | MIT
+@nlpjs/slot | 4.26.1 | MIT
+@noble/curves | 1.2.0 | MIT
+@noble/curves | 1.4.2 | MIT
+@noble/curves | 1.4.2 | MIT
+@noble/hashes | 1.3.2 | MIT
+@noble/hashes | 1.4.0 | MIT
+@noble/hashes | 1.4.0 | MIT
+@noble/hashes | 1.4.0 | MIT
+@npmcli/agent | 3.0.0 | ISC
+@npmcli/fs | 1.1.1 | ISC
+@npmcli/fs | 4.0.0 | ISC
+@npmcli/move-file | 1.1.2 | MIT
+@otplib/core | 12.0.1 | MIT
+@otplib/plugin-crypto | 12.0.1 | MIT
+@otplib/plugin-thirty-two | 12.0.1 | MIT
+@otplib/preset-default | 12.0.1 | MIT
+@otplib/preset-v11 | 12.0.1 | MIT
+@pkgjs/parseargs | 0.11.0 | MIT
+@scarf/scarf | 1.4.0 | Apache-2.0
+@scure/base | 1.1.9 | MIT
+@scure/bip32 | 1.4.0 | MIT
+@scure/bip39 | 1.3.0 | MIT
+@sindresorhus/is | 0.7.0 | MIT
+@swc/helpers | 0.3.17 | MIT
+@tokenizer/token | 0.3.0 | MIT
+@tootallnate/once | 1.1.2 | MIT
+@tootallnate/once | 2.0.0 | MIT
+@types/component-emitter | 1.2.14 | MIT
+@types/cookie | 0.4.1 | MIT
+@types/cors | 2.8.19 | MIT
+@types/debug | 4.1.12 | MIT
+@types/ms | 2.1.0 | MIT
+@types/node | 20.19.12 | MIT
+@types/node | 22.7.5 | MIT
+@types/strip-bom | 3.0.0 | MIT
+@types/strip-json-comments | 0.0.30 | MIT
+@types/triple-beam | 1.3.5 | MIT
+@types/validator | 13.15.3 | MIT
+@types/ws | 8.5.3 | MIT
+abbrev | 1.1.1 | ISC
+abbrev | 3.0.1 | ISC
+abitype | 0.7.1 | MIT
+abort-controller | 3.0.0 | MIT
+accepts | 1.3.8 | MIT
+acorn | 7.4.1 | MIT
+acorn | 8.15.0 | MIT
+acorn-walk | 8.3.4 | MIT
+aes-js | 4.0.0-beta.5 | MIT
+agent-base | 6.0.2 | MIT
+agent-base | 7.1.4 | MIT
+agent-base | 7.1.4 | MIT
+agentkeepalive | 4.6.0 | MIT
+aggregate-error | 3.1.0 | MIT
+ansi-regex | 2.1.1 | MIT
+ansi-regex | 2.1.1 | MIT
+ansi-regex | 2.1.1 | MIT
+ansi-regex | 3.0.1 | MIT
+ansi-regex | 5.0.1 | MIT
+ansi-regex | 6.2.0 | MIT
+ansi-regex | 6.2.0 | MIT
+ansi-styles | 2.2.1 | MIT
+ansi-styles | 3.2.1 | MIT
+ansi-styles | 4.3.0 | MIT
+ansi-styles | 4.3.0 | MIT
+ansi-styles | 4.3.0 | MIT
+ansi-styles | 6.2.1 | MIT
+anymatch | 3.1.3 | ISC
+append-field | 1.0.0 | MIT
+aproba | 1.2.0 | ISC
+archive-type | 4.0.0 | MIT
+archiver | 1.3.0 | MIT
+archiver-utils | 1.3.0 | MIT
+are-we-there-yet | 1.1.7 | ISC
+are-we-there-yet | 3.0.1 | ISC
+arg | 4.1.3 | MIT
+argparse | 1.0.10 | MIT
+arr-diff | 4.0.0 | MIT
+arr-flatten | 1.1.0 | MIT
+arr-union | 3.1.0 | MIT
+array-buffer-byte-length | 1.0.2 | MIT
+array-each | 1.0.1 | MIT
+array-flatten | 1.1.1 | MIT
+array-slice | 1.1.0 | MIT
+array-unique | 0.3.2 | MIT
+asap | 2.0.6 | MIT
+assert-never | 1.4.0 | MIT
+assign-symbols | 1.0.0 | MIT
+async | 2.6.4 | MIT
+async | 2.6.4 | MIT
+async | 3.2.6 | MIT
+at-least-node | 1.0.0 | ISC
+atob | 2.1.2 | (MIT OR Apache-2.0)
+available-typed-arrays | 1.0.7 | MIT
+babel-walk | 3.0.0-canary-5 | MIT
+balanced-match | 1.0.2 | MIT
+base | 0.11.2 | MIT
+base-files | 12.4+deb12u11 | GPL
+base64-arraybuffer | 0.1.4 | MIT
+base64-js | 0.0.8 | MIT
+base64-js | 1.5.1 | MIT
+base64id | 2.0.0 | MIT
+base64url | 0.0.6 | MIT
+basic-auth | 2.0.1 | MIT
+batch | 0.6.1 | MIT
+big-integer | 1.6.52 | Unlicense
+binary | 0.3.0 | MIT
+binary-extensions | 2.3.0 | MIT
+bindings | 1.5.0 | MIT
+bintrees | 1.0.2 | MIT
+bl | 1.2.3 | MIT
+bl | 4.1.0 | MIT
+bluebird | 3.4.7 | MIT
+bluebird | 3.7.2 | MIT
+body-parser | 1.20.3 | MIT
+bower-config | 1.4.3 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 2.0.2 | MIT
+braces | 2.3.2 | MIT
+braces | 3.0.3 | MIT
+braces | 3.0.3 | MIT
+braces | 3.0.3 | MIT
+brotli | 1.3.3 | MIT
+buffer | 5.7.1 | MIT
+buffer | 6.0.3 | MIT
+buffer-alloc | 1.2.0 | MIT
+buffer-alloc-unsafe | 1.1.0 | MIT
+buffer-crc32 | 0.2.13 | MIT
+buffer-fill | 1.0.0 | MIT
+buffer-from | 1.1.2 | MIT
+buffer-indexof-polyfill | 1.0.2 | MIT
+busboy | 1.6.0 | MIT
+byline | 4.2.2 | MIT
+bytes | 3.1.2 | MIT
+cacache | 15.3.0 | ISC
+cacache | 19.0.1 | ISC
+cache-base | 1.0.1 | MIT
+cacheable-request | 2.1.4 | MIT
+call-bind | 1.0.8 | MIT
+call-bind-apply-helpers | 1.0.2 | MIT
+call-bound | 1.0.4 | MIT
+camelcase | 5.3.1 | MIT
+chainsaw | 0.1.0 | MIT/X11
+chalk | 1.1.3 | MIT
+chalk | 2.4.2 | MIT
+chalk | 4.1.2 | MIT
+character-parser | 2.2.0 | MIT
+check-dependencies | 1.1.1 | MIT
+check-internet-connected | 2.0.6 | MIT
+check-types | 6.0.0 | MIT
+chokidar | 3.5.1 | MIT
+chownr | 1.1.4 | ISC
+chownr | 1.1.4 | ISC
+chownr | 2.0.0 | ISC
+chownr | 3.0.0 | BlueOak-1.0.0
+clarinet | 0.12.6 | BSD-2-Clause
+class-utils | 0.3.6 | MIT
+clean-stack | 2.2.0 | MIT
+cliui | 6.0.0 | ISC
+clone | 2.1.2 | MIT
+clone-response | 1.0.2 | MIT
+code-point-at | 1.1.0 | MIT
+collection-visit | 1.0.0 | MIT
+color | 3.2.1 | MIT
+color-convert | 1.9.3 | MIT
+color-convert | 2.0.1 | MIT
+color-convert | 2.0.1 | MIT
+color-convert | 2.0.1 | MIT
+color-name | 1.1.3 | MIT
+color-name | 1.1.4 | MIT
+color-name | 1.1.4 | MIT
+color-name | 1.1.4 | MIT
+color-string | 1.9.1 | MIT
+color-support | 1.1.3 | ISC
+colors | 1.1.2 | MIT
+colors | 1.4.0 | MIT
+colorspace | 1.1.4 | MIT
+commander | 2.20.3 | MIT
+commander | 2.20.3 | MIT
+component-emitter | 1.3.1 | MIT
+component-type | 1.2.1 | MIT
+compress-commons | 1.2.2 | MIT
+compressible | 2.0.18 | MIT
+compression | 1.8.1 | MIT
+concat-map | 0.0.1 | MIT
+concat-stream | 1.6.2 | MIT
+config | 3.3.12 | MIT
+console-control-strings | 1.1.0 | ISC
+constantinople | 4.0.1 | MIT
+content-disposition | 0.5.4 | MIT
+content-type | 1.0.5 | MIT
+cookie | 0.4.2 | MIT
+cookie | 0.7.1 | MIT
+cookie | 0.7.2 | MIT
+cookie-parser | 1.4.7 | MIT
+cookie-signature | 1.0.6 | MIT
+copy-descriptor | 0.1.1 | MIT
+core-util-is | 1.0.2 | MIT
+cors | 2.8.5 | MIT
+crc | 3.8.0 | MIT
+crc-32 | 1.2.2 | Apache-2.0
+crc32-stream | 2.0.0 | MIT
+create-require | 1.1.1 | MIT
+cross-fetch | 4.1.0 | MIT
+cross-fetch-polyfill | 0.0.0 | MIT
+cross-spawn | 7.0.6 | MIT
+crypto-js | 3.3.0 | MIT
+dateformat | 4.6.3 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 3.2.7 | MIT
+debug | 4.3.7 | MIT
+decamelize | 1.2.0 | MIT
+decode-uri-component | 0.2.2 | MIT
+decompress | 4.2.1 | MIT
+decompress-response | 3.3.0 | MIT
+decompress-response | 4.2.1 | MIT
+decompress-response | 6.0.0 | MIT
+decompress-response | 6.0.0 | MIT
+decompress-tar | 4.1.1 | MIT
+decompress-tarbz2 | 4.1.1 | MIT
+decompress-targz | 4.1.1 | MIT
+decompress-unzip | 4.0.1 | MIT
+deep-equal | 2.2.3 | MIT
+deep-extend | 0.6.0 | MIT
+define-data-property | 1.1.4 | MIT
+define-properties | 1.2.1 | MIT
+define-property | 0.2.5 | MIT
+define-property | 0.2.5 | MIT
+define-property | 0.2.5 | MIT
+define-property | 0.2.5 | MIT
+define-property | 0.2.5 | MIT
+define-property | 1.0.0 | MIT
+define-property | 1.0.0 | MIT
+define-property | 1.0.0 | MIT
+define-property | 2.0.2 | MIT
+delegates | 1.0.0 | MIT
+depd | 1.1.2 | MIT
+depd | 2.0.0 | MIT
+destroy | 1.2.0 | MIT
+detect-file | 1.0.0 | MIT
+detect-libc | 1.0.3 | Apache-2.0
+detect-libc | 2.0.4 | Apache-2.0
+detect-libc | 2.0.4 | Apache-2.0
+dfa | 1.2.0 | MIT
+diff | 4.0.2 | BSD-3-Clause
+doctypes | 1.1.0 | MIT
+domelementtype | 1.3.1 | BSD-2-Clause
+dottie | 2.0.6 | MIT
+double-ended-queue | 0.9.7 | MIT
+download | 8.0.0 | MIT
+dunder-proto | 1.0.1 | MIT
+duplexer2 | 0.1.4 | BSD-3-Clause
+duplexer3 | 0.1.5 | BSD-3-Clause
+dynamic-dedupe | 0.3.0 | MIT
+eastasianwidth | 0.2.0 | MIT
+ee-first | 1.1.1 | MIT
+eivindfjeldstad-dot | 0.0.1 | MIT
+emoji-regex | 8.0.0 | MIT
+emoji-regex | 9.2.2 | MIT
+emoji-regex | 9.2.2 | MIT
+enabled | 2.0.0 | MIT
+encodeurl | 1.0.2 | MIT
+encodeurl | 2.0.0 | MIT
+encoding | 0.1.13 | MIT
+end-of-stream | 1.4.5 | MIT
+engine.io | 4.1.2 | MIT
+engine.io-parser | 4.0.3 | MIT
+env-paths | 2.2.1 | MIT
+err-code | 1.1.2 | MIT
+err-code | 2.0.3 | MIT
+errorhandler | 1.5.1 | MIT
+es-define-property | 1.0.1 | MIT
+es-errors | 1.3.0 | MIT
+es-get-iterator | 1.1.3 | MIT
+es-object-atoms | 1.1.1 | MIT
+escape-html | 1.0.3 | MIT
+escape-string-regexp | 1.0.5 | MIT
+escodegen | 2.1.0 | BSD-2-Clause
+esprima | 1.0.4 | BSD
+esprima | 4.0.1 | BSD-2-Clause
+estraverse | 5.3.0 | BSD-2-Clause
+esutils | 2.0.3 | BSD-2-Clause
+etag | 1.8.1 | MIT
+ethereum-cryptography | 2.2.1 | MIT
+ethers | 6.15.0 | MIT
+event-target-shim | 5.0.1 | MIT
+eventemitter2 | 0.4.14 | MIT
+eventemitter3 | 1.1.1 | MIT
+eventemitter3 | 5.0.1 | MIT
+events | 3.3.0 | MIT
+exit | 0.1.2 | MIT
+expand-brackets | 2.1.4 | MIT
+expand-template | 2.0.3 | (MIT OR WTFPL)
+expand-tilde | 2.0.2 | MIT
+exponential-backoff | 3.1.2 | Apache-2.0
+express | 4.21.2 | MIT
+express-ipfilter | 1.3.2 | MIT
+express-jwt | 0.1.3 | MIT
+express-rate-limit | 7.5.1 | MIT
+express-robots-txt | 0.4.1 | MIT
+express-security.txt | 2.0.0 | ISC
+ext-list | 2.2.2 | MIT
+ext-name | 5.0.0 | MIT
+extend | 3.0.2 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 3.0.2 | MIT
+extglob | 2.0.4 | MIT
+fast.js | 0.1.1 | MIT
+fd-slicer | 1.1.0 | MIT
+fdir | 6.5.0 | MIT
+feature-policy | 0.5.0 | MIT
+fecha | 4.2.3 | MIT
+file-js | 0.3.0 | MIT
+file-stream-rotator | 1.0.0 | MIT
+file-type | 11.1.0 | MIT
+file-type | 16.5.4 | MIT
+file-type | 3.9.0 | MIT
+file-type | 4.4.0 | MIT
+file-type | 5.2.0 | MIT
+file-type | 5.2.0 | MIT
+file-type | 6.2.0 | MIT
+file-uri-to-path | 1.0.0 | MIT
+filehound | 1.17.6 | MIT
+filename-reserved-regex | 2.0.0 | MIT
+filenamify | 3.0.0 | MIT
+filesniffer | 1.0.3 | Apache-2.0
+fill-range | 4.0.0 | MIT
+fill-range | 7.1.1 | MIT
+fill-range | 7.1.1 | MIT
+fill-range | 7.1.1 | MIT
+finale-rest | 1.2.2 | MIT
+finalhandler | 1.3.1 | MIT
+find-up | 4.1.0 | MIT
+findup-sync | 2.0.0 | MIT
+findup-sync | 4.0.0 | MIT
+findup-sync | 5.0.0 | MIT
+fined | 1.2.0 | MIT
+flagged-respawn | 1.0.1 | MIT
+fn.name | 1.1.0 | MIT
+fontkit | 1.9.0 | MIT
+for-each | 0.3.5 | MIT
+for-in | 1.0.2 | MIT
+for-own | 1.0.0 | MIT
+foreachasync | 3.0.0 | Apache2
+foreground-child | 3.3.1 | ISC
+forwarded | 0.2.0 | MIT
+fragment-cache | 0.2.1 | MIT
+fresh | 0.5.2 | MIT
+from2 | 2.3.0 | MIT
+fs-constants | 1.0.0 | MIT
+fs-extra | 9.1.0 | MIT
+fs-minipass | 1.2.7 | ISC
+fs-minipass | 2.1.0 | ISC
+fs-minipass | 3.0.3 | ISC
+fs.realpath | 1.0.0 | ISC
+fstream | 1.0.12 | ISC
+function-bind | 1.1.2 | MIT
+functions-have-names | 1.2.3 | MIT
+fuzzball | 1.4.0 | GPL-2.0
+gauge | 2.7.4 | ISC
+gauge | 4.0.4 | ISC
+gcc-12-base | 12.2.0-14+deb12u1 | Artistic, GFDL-1.2, GPL, GPL-2, GPL-3, LGPL
+geojson-utils | 1.1.0 | MIT
+get-caller-file | 2.0.5 | ISC
+get-intrinsic | 1.3.0 | MIT
+get-proto | 1.0.1 | MIT
+get-stream | 2.3.1 | MIT
+get-stream | 3.0.0 | MIT
+get-stream | 3.0.0 | MIT
+get-stream | 4.1.0 | MIT
+get-value | 2.0.6 | MIT
+getobject | 1.0.2 | MIT
+github-from-package | 0.0.0 | MIT
+glob | 10.4.5 | ISC
+glob | 7.1.7 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob-parent | 5.1.2 | ISC
+global-modules | 1.0.0 | MIT
+global-prefix | 1.0.2 | MIT
+gopd | 1.2.0 | MIT
+got | 8.3.2 | MIT
+graceful-fs | 4.2.11 | ISC
+grunt | 1.6.1 | MIT
+grunt-cli | 1.4.3 | MIT
+grunt-contrib-compress | 1.6.0 | MIT
+grunt-known-options | 2.0.0 | MIT
+grunt-legacy-log | 3.0.0 | MIT
+grunt-legacy-log-utils | 2.1.0 | MIT
+grunt-legacy-util | 2.0.1 | MIT
+grunt-replace-json | 0.1.0 | MIT
+handlebars | 4.7.7 | MIT
+has-ansi | 2.0.0 | MIT
+has-bigints | 1.1.0 | MIT
+has-flag | 3.0.0 | MIT
+has-flag | 4.0.0 | MIT
+has-property-descriptors | 1.0.2 | MIT
+has-symbol-support-x | 1.4.2 | MIT
+has-symbols | 1.1.0 | MIT
+has-to-string-tag-x | 1.4.1 | MIT
+has-tostringtag | 1.0.2 | MIT
+has-unicode | 2.0.1 | ISC
+has-value | 0.3.1 | MIT
+has-value | 1.0.0 | MIT
+has-values | 0.1.4 | MIT
+has-values | 1.0.0 | MIT
+hashids | 2.3.0 | MIT
+hasown | 2.0.2 | MIT
+hbs | 4.2.0 | MIT
+he | 0.4.1 | MIT
+heap | 0.2.7 | MIT
+helmet | 4.6.0 | MIT
+hoister | 0.0.2 | MIT
+homedir-polyfill | 1.0.3 | MIT
+hooker | 0.2.3 | MIT
+html-entities | 1.4.0 | MIT
+htmlparser2 | 3.3.0 | MIT
+http-cache-semantics | 3.8.1 | BSD-2-Clause
+http-cache-semantics | 4.2.0 | BSD-2-Clause
+http-cache-semantics | 4.2.0 | BSD-2-Clause
+http-errors | 1.6.3 | MIT
+http-errors | 2.0.0 | MIT
+http-proxy-agent | 4.0.1 | MIT
+http-proxy-agent | 5.0.0 | MIT
+http-proxy-agent | 7.0.2 | MIT
+https-proxy-agent | 5.0.1 | MIT
+https-proxy-agent | 7.0.6 | MIT
+humanize-ms | 1.2.1 | MIT
+i18n | 0.11.1 | MIT
+iconv-lite | 0.4.24 | MIT
+iconv-lite | 0.6.3 | MIT
+iconv-lite | 0.6.3 | MIT
+ieee754 | 1.2.1 | BSD-3-Clause
+ignore-walk | 3.0.4 | ISC
+iltorb | 2.4.5 | MIT
+imurmurhash | 0.1.4 | MIT
+indent-string | 4.0.0 | MIT
+infer-owner | 1.0.4 | ISC
+inflection | 1.13.4 | MIT
+inflight | 1.0.6 | ISC
+inherits | 2.0.3 | ISC
+inherits | 2.0.4 | ISC
+ini | 1.3.8 | ISC
+ini | 1.3.8 | ISC
+internal-slot | 1.1.0 | MIT
+interpret | 1.1.0 | MIT
+into-stream | 3.1.0 | MIT
+invariant | 2.2.4 | MIT
+ip | 2.0.1 | MIT
+ip-address | 10.0.1 | MIT
+ip6 | 0.2.11 | MIT
+ipaddr.js | 1.9.1 | MIT
+is-absolute | 1.0.0 | MIT
+is-accessor-descriptor | 1.0.1 | MIT
+is-arguments | 1.2.0 | MIT
+is-array-buffer | 3.0.5 | MIT
+is-arrayish | 0.3.2 | MIT
+is-bigint | 1.1.0 | MIT
+is-binary-path | 2.1.0 | MIT
+is-boolean-object | 1.2.2 | MIT
+is-buffer | 1.1.6 | MIT
+is-callable | 1.2.7 | MIT
+is-core-module | 2.16.1 | MIT
+is-data-descriptor | 1.0.1 | MIT
+is-date-object | 1.1.0 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 1.0.3 | MIT
+is-expression | 4.0.0 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 1.0.1 | MIT
+is-extglob | 2.1.1 | MIT
+is-fullwidth-code-point | 1.0.0 | MIT
+is-fullwidth-code-point | 2.0.0 | MIT
+is-fullwidth-code-point | 3.0.0 | MIT
+is-generator-function | 1.1.0 | MIT
+is-glob | 3.1.0 | MIT
+is-glob | 4.0.3 | MIT
+is-lambda | 1.0.1 | MIT
+is-map | 2.0.3 | MIT
+is-natural-number | 4.0.1 | MIT
+is-number | 3.0.0 | MIT
+is-number | 7.0.0 | MIT
+is-number | 7.0.0 | MIT
+is-number | 7.0.0 | MIT
+is-number-like | 1.0.8 | ISC
+is-number-object | 1.1.1 | MIT
+is-object | 1.0.2 | MIT
+is-plain-obj | 1.1.0 | MIT
+is-plain-object | 2.0.4 | MIT
+is-promise | 2.2.2 | MIT
+is-regex | 1.2.1 | MIT
+is-relative | 1.0.0 | MIT
+is-retry-allowed | 1.2.0 | MIT
+is-set | 2.0.3 | MIT
+is-shared-array-buffer | 1.0.4 | MIT
+is-stream | 1.1.0 | MIT
+is-stream | 2.0.1 | MIT
+is-string | 1.1.1 | MIT
+is-symbol | 1.1.1 | MIT
+is-typed-array | 1.1.15 | MIT
+is-unc-path | 1.0.0 | MIT
+is-weakmap | 2.0.2 | MIT
+is-weakset | 2.0.4 | MIT
+is-windows | 1.0.2 | MIT
+isarray | 0.0.1 | MIT
+isarray | 1.0.0 | MIT
+isarray | 1.0.0 | MIT
+isarray | 2.0.5 | MIT
+isexe | 2.0.0 | ISC
+isexe | 3.1.1 | ISC
+isobject | 2.1.0 | MIT
+isobject | 3.0.1 | MIT
+isomorphic-ws | 5.0.0 | MIT
+isurl | 1.0.0 | MIT
+jackspeak | 3.4.3 | BlueOak-1.0.0
+js-stringify | 1.0.2 | MIT
+js-tokens | 4.0.0 | MIT
+js-yaml | 3.14.1 | MIT
+json-buffer | 3.0.0 | MIT
+json5 | 2.2.3 | MIT
+jsonfile | 6.2.0 | MIT
+jsonwebtoken | 0.1.0 | MIT
+jsonwebtoken | 0.4.0 | MIT
+jssha | 3.3.1 | BSD-3-Clause
+jstransformer | 1.0.0 | MIT
+juice-shop | 19.0.0 | MIT
+juice-shop | 19.0.0 | MIT
+juicy-chat-bot | 0.9.0 | MIT
+jwa | 0.0.1 | MIT
+jws | 0.2.6 | MIT
+keyv | 3.0.0 | MIT
+kind-of | 3.2.2 | MIT
+kind-of | 3.2.2 | MIT
+kind-of | 3.2.2 | MIT
+kind-of | 3.2.2 | MIT
+kind-of | 4.0.0 | MIT
+kind-of | 6.0.3 | MIT
+kuler | 2.0.0 | MIT
+lazystream | 1.0.1 | MIT
+libc6 | 2.36-9+deb12u10 | GPL-2, LGPL-2.1
+libgcc-s1 | 12.2.0-14+deb12u1 | Artistic, GFDL-1.2, GPL, GPL-2, GPL-3, LGPL
+libgomp1 | 12.2.0-14+deb12u1 | Artistic, GFDL-1.2, GPL, GPL-2, GPL-3, LGPL
+libssl3 | 3.0.17-1~deb12u2 | Apache-2.0, Artistic, GPL-1, GPL-1+
+libstdc++6 | 12.2.0-14+deb12u1 | Artistic, GFDL-1.2, GPL, GPL-2, GPL-3, LGPL
+libxmljs2 | 0.37.0 | MIT
+liftup | 3.0.1 | MIT
+linebreak | 1.1.0 | MIT
+listenercount | 1.0.1 | ISC
+ljharb-monorepo-symlink-test | 0.0.0 | MIT
+locate-path | 5.0.0 | MIT
+lodash | 2.4.2 | MIT
+lodash | 4.17.21 | MIT
+lodash.camelcase | 4.3.0 | MIT
+lodash.isfinite | 3.3.2 | MIT
+lodash.set | 4.3.2 | MIT
+logform | 2.7.0 | MIT
+lolex | 1.3.2 | BSD-3-Clause
+loose-envify | 1.4.0 | MIT
+lowercase-keys | 1.0.0 | MIT
+lru-cache | 10.4.3 | ISC
+lru-cache | 10.4.3 | ISC
+lru-cache | 10.4.3 | ISC
+lru-cache | 6.0.0 | ISC
+make-dir | 1.3.0 | MIT
+make-dir | 2.1.0 | MIT
+make-error | 1.3.6 | ISC
+make-fetch-happen | 14.0.3 | ISC
+make-fetch-happen | 9.1.0 | ISC
+make-iterator | 1.0.1 | MIT
+make-plural | 4.3.0 | ISC
+make-plural | 6.2.2 | ISC
+map-cache | 0.2.2 | MIT
+map-visit | 1.0.0 | MIT
+marsdb | 0.6.11 | MIT
+math-interval-parser | 2.0.1 | MIT
+math-intrinsics | 1.1.0 | MIT
+media-typer | 0.3.0 | MIT
+media-types | 10.0.0 | ad-hoc
+median | 0.0.2 | MIT
+merge-descriptors | 1.0.3 | MIT
+messageformat | 2.3.0 | MIT
+messageformat-formatters | 2.0.1 | MIT
+messageformat-parser | 4.1.3 | MIT
+methods | 1.1.2 | MIT
+micromatch | 3.1.10 | MIT
+micromatch | 4.0.8 | MIT
+micromatch | 4.0.8 | MIT
+mime | 1.6.0 | MIT
+mime-db | 1.52.0 | MIT
+mime-types | 2.1.35 | MIT
+mimic-response | 1.0.1 | MIT
+mimic-response | 2.1.0 | MIT
+mimic-response | 3.1.0 | MIT
+mimic-response | 3.1.0 | MIT
+minami | 1.1.1 | Apache-2.0
+minami | 1.1.1 | Apache-2.0
+minami | 1.1.1 | Apache-2.0
+minimatch | 3.0.5 | ISC
+minimatch | 3.0.8 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 5.1.6 | ISC
+minimatch | 9.0.5 | ISC
+minimist | 0.2.4 | MIT
+minimist | 1.2.8 | MIT
+minipass | 2.9.0 | ISC
+minipass | 3.3.6 | ISC
+minipass | 3.3.6 | ISC
+minipass | 3.3.6 | ISC
+minipass | 3.3.6 | ISC
+minipass | 5.0.0 | ISC
+minipass | 7.1.2 | ISC
+minipass-collect | 1.0.2 | ISC
+minipass-collect | 2.0.1 | ISC
+minipass-fetch | 1.4.1 | MIT
+minipass-fetch | 4.0.1 | MIT
+minipass-flush | 1.0.5 | ISC
+minipass-pipeline | 1.2.4 | ISC
+minipass-sized | 1.0.3 | ISC
+minizlib | 1.3.3 | MIT
+minizlib | 2.1.2 | MIT
+minizlib | 3.0.2 | MIT
+mixin-deep | 1.3.2 | MIT
+mkdirp | 0.5.6 | MIT
+mkdirp | 0.5.6 | MIT
+mkdirp | 0.5.6 | MIT
+mkdirp | 1.0.4 | MIT
+mkdirp | 3.0.1 | MIT
+mkdirp | 3.0.1 | MIT
+mkdirp-classic | 0.5.3 | MIT
+moment | 2.0.0 | MIT
+moment | 2.30.1 | MIT
+moment-timezone | 0.5.48 | MIT
+morgan | 1.10.1 | MIT
+mout | 1.2.4 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.1.3 | MIT
+multer | 1.4.5-lts.2 | MIT
+mustache | 4.2.0 | MIT
+mylib | 0.0.0 | ISC
+nan | 2.22.2 | MIT
+nanomatch | 1.2.13 | MIT
+napi-build-utils | 1.0.2 | MIT
+napi-build-utils | 2.0.0 | MIT
+napi-build-utils | 2.0.0 | MIT
+needle | 2.9.1 | MIT
+negotiator | 0.6.3 | MIT
+negotiator | 0.6.4 | MIT
+negotiator | 1.0.0 | MIT
+neo-async | 2.6.2 | MIT
+netbase | 6.4 | GPL-2
+node-abi | 2.30.1 | MIT
+node-abi | 3.77.0 | MIT
+node-abi | 3.77.0 | MIT
+node-addon-api | 7.1.1 | MIT
+node-fetch | 2.7.0 | MIT
+node-gyp | 11.4.2 | MIT
+node-gyp | 8.4.1 | MIT
+node-pre-gyp | 0.15.0 | BSD-3-Clause
+noop-logger | 0.1.1 | MIT
+nopt | 3.0.6 | ISC
+nopt | 4.0.3 | ISC
+nopt | 4.0.3 | ISC
+nopt | 5.0.0 | ISC
+nopt | 8.1.0 | ISC
+normalize-path | 2.1.1 | MIT
+normalize-path | 3.0.0 | MIT
+normalize-path | 3.0.0 | MIT
+normalize-url | 2.0.1 | MIT
+notevil | 1.3.3 | MIT
+npm-bundled | 1.1.2 | ISC
+npm-normalize-package-bin | 1.0.1 | ISC
+npm-packlist | 1.4.8 | ISC
+npmlog | 4.1.2 | ISC
+npmlog | 6.0.2 | ISC
+number-is-nan | 1.0.1 | MIT
+object-assign | 4.1.1 | MIT
+object-copy | 0.1.0 | MIT
+object-inspect | 1.13.4 | MIT
+object-is | 1.1.6 | MIT
+object-keys | 1.1.1 | MIT
+object-visit | 1.0.1 | MIT
+object.assign | 4.1.7 | MIT
+object.defaults | 1.1.0 | MIT
+object.map | 1.0.1 | MIT
+object.pick | 1.3.0 | MIT
+on-finished | 2.3.0 | MIT
+on-finished | 2.4.1 | MIT
+on-headers | 1.1.0 | MIT
+once | 1.4.0 | ISC
+one-time | 1.0.0 | MIT
+opentype.js | 0.7.3 | MIT
+os-homedir | 1.0.2 | MIT
+os-tmpdir | 1.0.2 | MIT
+osenv | 0.1.5 | ISC
+otplib | 12.0.1 | MIT
+p-cancelable | 0.4.1 | MIT
+p-event | 2.3.1 | MIT
+p-finally | 1.0.0 | MIT
+p-is-promise | 1.1.0 | MIT
+p-limit | 2.3.0 | MIT
+p-locate | 4.1.0 | MIT
+p-map | 4.0.0 | MIT
+p-map | 7.0.3 | MIT
+p-timeout | 2.0.1 | MIT
+p-try | 2.2.0 | MIT
+package-json-from-dist | 1.0.1 | BlueOak-1.0.0
+pako | 0.2.9 | MIT
+parse-filepath | 1.0.2 | MIT
+parse-passwd | 1.0.0 | MIT
+parseurl | 1.3.3 | MIT
+pascalcase | 0.1.1 | MIT
+path-exists | 4.0.0 | MIT
+path-is-absolute | 1.0.1 | MIT
+path-key | 3.1.1 | MIT
+path-parse | 1.0.7 | MIT
+path-root | 0.1.1 | MIT
+path-root-regex | 0.1.2 | MIT
+path-scurry | 1.11.1 | BlueOak-1.0.0
+path-to-regexp | 0.1.12 | MIT
+pdfkit | 0.11.0 | MIT
+peek-readable | 4.1.0 | MIT
+pend | 1.2.0 | MIT
+pg-connection-string | 2.9.1 | MIT
+picomatch | 2.3.1 | MIT
+picomatch | 4.0.3 | MIT
+pify | 2.3.0 | MIT
+pify | 2.3.0 | MIT
+pify | 3.0.0 | MIT
+pify | 3.0.0 | MIT
+pify | 4.0.1 | MIT
+pinkie | 2.0.4 | MIT
+pinkie-promise | 2.0.1 | MIT
+posix-character-classes | 0.1.1 | MIT
+possible-typed-array-names | 1.1.0 | MIT
+prebuild-install | 5.3.6 | MIT
+prebuild-install | 7.1.3 | MIT
+prebuild-install | 7.1.3 | MIT
+prepend-http | 2.0.0 | MIT
+pretty-bytes | 4.0.2 | MIT
+proc-log | 5.0.0 | ISC
+process | 0.11.10 | MIT
+process-nextick-args | 2.0.1 | MIT
+prom-client | 14.2.0 | Apache-2.0
+promise | 7.3.1 | MIT
+promise-inflight | 1.0.1 | ISC
+promise-retry | 2.0.1 | MIT
+proper-lockfile | 1.2.0 | MIT
+proxy-addr | 2.0.7 | MIT
+pug | 3.0.3 | MIT
+pug-attrs | 3.0.0 | MIT
+pug-code-gen | 3.0.3 | MIT
+pug-error | 2.1.0 | MIT
+pug-filters | 4.0.0 | MIT
+pug-lexer | 5.0.1 | MIT
+pug-linker | 4.0.0 | MIT
+pug-load | 3.0.0 | MIT
+pug-parser | 6.0.0 | MIT
+pug-runtime | 3.0.1 | MIT
+pug-strip-comments | 2.0.0 | MIT
+pug-walk | 2.0.0 | MIT
+pump | 3.0.3 | MIT
+qs | 6.13.0 | BSD-3-Clause
+query-string | 5.1.1 | MIT
+range-parser | 1.2.1 | MIT
+range_check | 2.0.4 | BSD-2-Clause
+raw-body | 2.5.2 | MIT
+rc | 1.2.8 | (BSD-2-Clause OR MIT OR Apache-2.0)
+readable-stream | 1.0.34 | MIT
+readable-stream | 2.3.8 | MIT
+readable-stream | 3.6.2 | MIT
+readable-stream | 3.6.2 | MIT
+readable-stream | 3.6.2 | MIT
+readable-stream | 3.6.2 | MIT
+readable-stream | 4.7.0 | MIT
+readable-web-to-node-stream | 3.0.4 | MIT
+readdirp | 3.5.0 | MIT
+rechoir | 0.7.1 | MIT
+regex-not | 1.0.2 | MIT
+regexp.prototype.flags | 1.5.4 | MIT
+remove-trailing-separator | 1.1.0 | ISC
+repeat-element | 1.1.4 | MIT
+repeat-string | 1.6.1 | MIT
+replace | 1.2.2 | MIT
+require-directory | 2.1.1 | MIT
+require-main-filename | 2.0.0 | ISC
+resolve | 1.22.10 | MIT
+resolve-dir | 1.0.1 | MIT
+resolve-url | 0.2.1 | MIT
+responselike | 1.0.2 | MIT
+restructure | 2.0.1 | MIT
+ret | 0.1.15 | MIT
+retry | 0.10.1 | MIT
+retry | 0.12.0 | MIT
+retry-as-promised | 7.1.1 | MIT
+rimraf | 2.7.1 | ISC
+rimraf | 2.7.1 | ISC
+rimraf | 2.7.1 | ISC
+rimraf | 3.0.2 | ISC
+safe-buffer | 5.1.2 | MIT
+safe-buffer | 5.1.2 | MIT
+safe-buffer | 5.1.2 | MIT
+safe-buffer | 5.2.1 | MIT
+safe-regex | 1.1.0 | MIT
+safe-regex-test | 1.1.0 | MIT
+safe-stable-stringify | 2.5.0 | MIT
+safer-buffer | 2.1.2 | MIT
+sanitize-filename | 1.6.3 | WTFPL OR ISC
+sanitize-html | 1.4.2 | MIT
+sax | 1.4.1 | ISC
+seek-bzip | 1.0.6 | MIT
+semver | 5.7.2 | ISC
+semver | 5.7.2 | ISC
+semver | 5.7.2 | ISC
+semver | 5.7.2 | ISC
+semver | 7.7.2 | ISC
+send | 0.19.0 | MIT
+sequelize | 6.37.7 | MIT
+sequelize-pool | 7.1.0 | MIT
+serve-index | 1.9.1 | MIT
+serve-static | 1.16.2 | MIT
+set-blocking | 2.0.0 | ISC
+set-function-length | 1.2.2 | MIT
+set-function-name | 2.0.2 | MIT
+set-value | 2.0.1 | MIT
+setimmediate | 1.0.5 | MIT
+setprototypeof | 1.1.0 | ISC
+setprototypeof | 1.2.0 | ISC
+shebang-command | 2.0.0 | MIT
+shebang-regex | 3.0.0 | MIT
+side-channel | 1.1.0 | MIT
+side-channel-list | 1.0.0 | MIT
+side-channel-map | 1.0.1 | MIT
+side-channel-weakmap | 1.0.2 | MIT
+signal-exit | 3.0.7 | ISC
+signal-exit | 4.1.0 | ISC
+simple-concat | 1.0.1 | MIT
+simple-get | 3.1.1 | MIT
+simple-get | 4.0.1 | MIT
+simple-get | 4.0.1 | MIT
+simple-swizzle | 0.2.2 | MIT
+sinon | 1.17.7 | BSD-3-Clause
+smart-buffer | 4.2.0 | MIT
+snapdragon | 0.8.2 | MIT
+snapdragon-node | 2.1.1 | MIT
+snapdragon-util | 3.0.1 | MIT
+socket.io | 3.1.2 | MIT
+socket.io-adapter | 2.1.0 | MIT
+socket.io-parser | 4.0.5 | MIT
+socks | 2.8.7 | MIT
+socks-proxy-agent | 6.2.1 | MIT
+socks-proxy-agent | 8.0.5 | MIT
+sort-keys | 1.1.2 | MIT
+sort-keys | 2.0.0 | MIT
+sort-keys-length | 1.0.1 | MIT
+source-map | 0.5.7 | BSD-3-Clause
+source-map | 0.6.1 | BSD-3-Clause
+source-map-resolve | 0.5.3 | MIT
+source-map-support | 0.5.21 | MIT
+source-map-url | 0.4.1 | MIT
+split-string | 3.1.0 | MIT
+sprintf-js | 1.0.3 | BSD-3-Clause
+sprintf-js | 1.1.3 | BSD-3-Clause
+sqlite3 | 5.1.7 | BSD-3-Clause
+ssri | 12.0.0 | ISC
+ssri | 8.0.1 | ISC
+stack-trace | 0.0.10 | MIT
+static-extend | 0.1.2 | MIT
+statuses | 1.5.0 | MIT
+statuses | 2.0.1 | MIT
+stop-iteration-iterator | 1.1.0 | MIT
+stream-buffers | 2.2.0 | Unlicense
+streamsearch | 1.1.0 | MIT
+strict-uri-encode | 1.1.0 | MIT
+string-width | 1.0.2 | MIT
+string-width | 2.1.1 | MIT
+string-width | 4.2.3 | MIT
+string-width | 4.2.3 | MIT
+string-width | 5.1.2 | MIT
+string-width | 5.1.2 | MIT
+string.fromcodepoint | 0.2.1 | MIT
+string.prototype.codepointat | 0.2.1 | MIT
+string_decoder | 0.10.31 | MIT
+string_decoder | 1.1.1 | MIT
+string_decoder | 1.3.0 | MIT
+strip-ansi | 3.0.1 | MIT
+strip-ansi | 3.0.1 | MIT
+strip-ansi | 4.0.0 | MIT
+strip-ansi | 6.0.1 | MIT
+strip-ansi | 6.0.1 | MIT
+strip-ansi | 7.1.0 | MIT
+strip-ansi | 7.1.0 | MIT
+strip-bom | 3.0.0 | MIT
+strip-dirs | 2.1.0 | MIT
+strip-json-comments | 2.0.1 | MIT
+strip-json-comments | 2.0.1 | MIT
+strip-outer | 1.0.1 | MIT
+strtok3 | 6.3.0 | MIT
+supports-color | 2.0.0 | MIT
+supports-color | 5.5.0 | MIT
+supports-color | 7.2.0 | MIT
+supports-preserve-symlinks-flag | 1.0.0 | MIT
+svg-captcha | 1.4.0 | MIT
+swagger-ui-dist | 5.28.1 | Apache-2.0
+swagger-ui-express | 5.0.1 | MIT
+tar | 4.4.19 | ISC
+tar | 6.2.1 | ISC
+tar | 7.4.3 | ISC
+tar-fs | 2.1.3 | MIT
+tar-stream | 1.6.2 | MIT
+tar-stream | 2.2.0 | MIT
+tdigest | 0.1.2 | MIT
+text-hex | 1.0.0 | MIT
+through | 2.3.8 | MIT
+timed-out | 4.0.1 | MIT
+tiny-inflate | 1.0.3 | MIT
+tinyglobby | 0.2.14 | MIT
+to-buffer | 1.2.1 | MIT
+to-object-path | 0.3.0 | MIT
+to-regex | 3.0.2 | MIT
+to-regex-range | 2.1.1 | MIT
+to-regex-range | 5.0.1 | MIT
+to-regex-range | 5.0.1 | MIT
+to-regex-range | 5.0.1 | MIT
+toidentifier | 1.0.1 | MIT
+token-stream | 1.0.0 | MIT
+token-types | 4.2.1 | MIT
+tr46 | 0.0.3 | MIT
+traverse | 0.3.9 | MIT/X11
+tree-kill | 1.2.2 | MIT
+trim-repeated | 1.0.0 | MIT
+triple-beam | 1.4.1 | MIT
+truncate-utf8-bytes | 1.0.2 | WTFPL
+ts-node | 9.1.1 | MIT
+ts-node-dev | 1.1.8 | MIT
+tsconfig | 7.0.0 | MIT
+tslib | 2.7.0 | 0BSD
+tunnel-agent | 0.6.0 | Apache-2.0
+type-is | 1.6.18 | MIT
+typecast | 0.0.1 | MIT
+typed-array-buffer | 1.0.3 | MIT
+typedarray | 0.0.6 | MIT
+typescript | 5.3.3 | Apache-2.0
+tzdata | 2025b-0+deb12u1 | public-domain
+uglify-js | 3.19.3 | BSD-2-Clause
+unbzip2-stream | 1.4.3 | MIT
+unc-path-regex | 0.1.2 | MIT
+underscore.string | 3.3.6 | MIT
+undici-types | 6.19.8 | MIT
+undici-types | 6.21.0 | MIT
+unicode-properties | 1.4.1 | MIT
+unicode-trie | 2.0.0 | MIT
+union-value | 1.0.1 | MIT
+unique-filename | 1.1.1 | ISC
+unique-filename | 4.0.0 | ISC
+unique-slug | 2.0.2 | ISC
+unique-slug | 5.0.0 | ISC
+unit-compare | 1.0.1 | ISC
+universalify | 2.0.1 | MIT
+unpipe | 1.0.0 | MIT
+unset-value | 1.0.0 | MIT
+untildify | 2.1.0 | MIT
+unzipper | 0.9.15 | MIT
+urix | 0.1.0 | MIT
+url-parse-lax | 3.0.0 | MIT
+url-to-options | 1.0.1 | MIT
+use | 3.1.1 | MIT
+utf8-byte-length | 1.0.5 | (WTFPL OR MIT)
+util | 0.12.5 | MIT
+util-deprecate | 1.0.2 | MIT
+utils-merge | 1.0.1 | MIT
+uuid | 8.3.2 | MIT
+v8flags | 3.2.0 | MIT
+validate | 4.5.1 | MIT
+validator | 13.15.15 | MIT
+vary | 1.1.2 | MIT
+vm2 | 3.9.17 | MIT
+void-elements | 3.1.0 | MIT
+walk | 2.3.15 | (MIT OR Apache-2.0)
+walkdir | 0.0.11 | MIT
+web3 | 4.16.0 | LGPL-3.0
+web3-core | 4.7.1 | LGPL-3.0
+web3-errors | 1.3.1 | LGPL-3.0
+web3-eth | 4.11.1 | LGPL-3.0
+web3-eth-abi | 4.4.1 | LGPL-3.0
+web3-eth-accounts | 4.3.1 | LGPL-3.0
+web3-eth-contract | 4.7.2 | LGPL-3.0
+web3-eth-ens | 4.4.0 | LGPL-3.0
+web3-eth-iban | 4.0.7 | LGPL-3.0
+web3-eth-personal | 4.1.0 | LGPL-3.0
+web3-net | 4.1.0 | LGPL-3.0
+web3-providers-http | 4.2.0 | LGPL-3.0
+web3-providers-ipc | 4.0.7 | LGPL-3.0
+web3-providers-ws | 4.0.8 | LGPL-3.0
+web3-rpc-methods | 1.3.0 | LGPL-3.0
+web3-rpc-providers | 1.0.0-rc.4 | LGPL-3.0
+web3-types | 1.10.0 | LGPL-3.0
+web3-utils | 4.3.3 | LGPL-3.0
+web3-validator | 2.0.6 | LGPL-3.0
+webidl-conversions | 3.0.1 | BSD-2-Clause
+whatwg-url | 5.0.0 | MIT
+which | 1.3.1 | ISC
+which | 2.0.2 | ISC
+which | 5.0.0 | ISC
+which-boxed-primitive | 1.1.1 | MIT
+which-collection | 1.0.2 | MIT
+which-module | 2.0.1 | ISC
+which-pm-runs | 1.1.0 | MIT
+which-typed-array | 1.1.19 | MIT
+wide-align | 1.1.3 | ISC
+wide-align | 1.1.5 | ISC
+winston | 3.17.0 | MIT
+winston-transport | 4.9.0 | MIT
+with | 7.0.2 | MIT
+wkx | 0.5.0 | MIT
+wordwrap | 0.0.3 | MIT
+wordwrap | 1.0.0 | MIT
+wrap-ansi | 6.2.0 | MIT
+wrap-ansi | 7.0.0 | MIT
+wrap-ansi | 8.1.0 | MIT
+wrappy | 1.0.2 | ISC
+ws | 7.4.6 | MIT
+ws | 8.17.1 | MIT
+xtend | 4.0.2 | MIT
+y18n | 4.0.3 | ISC
+yallist | 3.1.1 | ISC
+yallist | 4.0.0 | ISC
+yallist | 4.0.0 | ISC
+yallist | 4.0.0 | ISC
+yallist | 4.0.0 | ISC
+yallist | 5.0.0 | BlueOak-1.0.0
+yaml-schema-validator | 1.2.3 | MIT
+yargs | 15.4.1 | MIT
+yargs-parser | 18.1.3 | ISC
+yauzl | 2.10.0 | MIT
+yn | 3.1.1 | MIT
+z85 | 0.0.2 | MIT
+zip-stream | 1.2.0 | MIT
+zod | 3.25.76 | MIT
diff --git a/labs/lab4/syft/juice-shop-syft-native.json b/labs/lab4/syft/juice-shop-syft-native.json
new file mode 100644
index 00000000..527de910
--- /dev/null
+++ b/labs/lab4/syft/juice-shop-syft-native.json
@@ -0,0 +1 @@
+{"artifacts":[{"id":"3cea2309a653e6ed","name":"1to2","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/nan/tools/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/nan/tools/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/nan/tools/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/nan/tools/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:nodejs:1to2:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:1to2:1to2:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/1to2@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"1to2","version":"1.0.0","author":"Benjamin Byholm (https://github.com/kkoopa/), Mathias Küsel (https://github.com/mathiask88/)","homepage":"","description":"NAN 1 -> 2 Migration Script","url":"git://github.com/nodejs/nan.git","private":false}},{"id":"08449108469244be","name":"@adraffy/ens-normalize","version":"1.10.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@adraffy\\/ens-normalize:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens-normalize:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens_normalize:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens_normalize:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:adraffy:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:adraffy:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40adraffy/ens-normalize@1.10.1","metadataType":"javascript-npm-package","metadata":{"name":"@adraffy/ens-normalize","version":"1.10.1","author":"raffy.eth (http://raffy.antistupid.com)","homepage":"https://github.com/adraffy/ens-normalize.js#readme","description":"Ethereum Name Service (ENS) Name Normalizer","url":"git+https://github.com/adraffy/ens-normalize.js.git","private":false}},{"id":"27b0de0facbfc672","name":"@babel/helper-string-parser","version":"7.27.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/helper-string-parser:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-string-parser:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string_parser:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string_parser:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-string:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-string:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/helper-string-parser@7.27.1","metadataType":"javascript-npm-package","metadata":{"name":"@babel/helper-string-parser","version":"7.27.1","author":"The Babel Team (https://babel.dev/team)","homepage":"https://babel.dev/docs/en/next/babel-helper-string-parser","description":"A utility package to parse strings","url":"https://github.com/babel/babel.git","private":false}},{"id":"d07675d36f7c1136","name":"@babel/helper-validator-identifier","version":"7.27.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator-identifier:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator-identifier:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator_identifier:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator_identifier:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/helper-validator-identifier@7.27.1","metadataType":"javascript-npm-package","metadata":{"name":"@babel/helper-validator-identifier","version":"7.27.1","author":"The Babel Team (https://babel.dev/team)","homepage":"","description":"Validate identifier/keywords name","url":"https://github.com/babel/babel.git","private":false}},{"id":"489d0f5c79137732","name":"@babel/parser","version":"7.28.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/parser:\\@babel\\/parser:7.28.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/parser:7.28.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/parser@7.28.3","metadataType":"javascript-npm-package","metadata":{"name":"@babel/parser","version":"7.28.3","author":"The Babel Team (https://babel.dev/team)","homepage":"https://babel.dev/docs/en/next/babel-parser","description":"A JavaScript parser","url":"https://github.com/babel/babel.git","private":false}},{"id":"045074f58c58eebb","name":"@babel/types","version":"7.28.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/types/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/types/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/types:\\@babel\\/types:7.28.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/types:7.28.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/types@7.28.2","metadataType":"javascript-npm-package","metadata":{"name":"@babel/types","version":"7.28.2","author":"The Babel Team (https://babel.dev/team)","homepage":"https://babel.dev/docs/en/next/babel-types","description":"Babel Types is a Lodash-esque utility library for AST nodes","url":"https://github.com/babel/babel.git","private":false}},{"id":"2aaa7cc50004f91b","name":"@colors/colors","version":"1.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@colors\\/colors:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DABH:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40colors/colors@1.6.0","metadataType":"javascript-npm-package","metadata":{"name":"@colors/colors","version":"1.6.0","author":"DABH, DABH (https://github.com/DABH)","homepage":"https://github.com/DABH/colors.js","description":"get colors in your node.js console","url":"http://github.com/DABH/colors.js.git","private":false}},{"id":"3b8ecc6044fe8e57","name":"@colors/colors","version":"1.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@colors\\/colors:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DABH:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40colors/colors@1.6.0","metadataType":"javascript-npm-package","metadata":{"name":"@colors/colors","version":"1.6.0","author":"DABH, DABH (https://github.com/DABH)","homepage":"https://github.com/DABH/colors.js","description":"get colors in your node.js console","url":"http://github.com/DABH/colors.js.git","private":false}},{"id":"22bb15b4ca9d4d3f","name":"@dabh/diagnostics","version":"2.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@dabh/diagnostics/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@dabh/diagnostics/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@dabh/diagnostics/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@dabh/diagnostics/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@dabh\\/diagnostics:\\@dabh\\/diagnostics:2.0.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:3rd-Eden:\\@dabh\\/diagnostics:2.0.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40dabh/diagnostics@2.0.3","metadataType":"javascript-npm-package","metadata":{"name":"@dabh/diagnostics","version":"2.0.3","author":"Arnout Kazemier, Martijn Swaagman (https://github.com/swaagie), Jarrett Cruger (https://github.com/jcrugzz), Sevastos (https://github.com/sevastos)","homepage":"https://github.com/3rd-Eden/diagnostics","description":"Tools for debugging your node.js modules and event loop","url":"git://github.com/3rd-Eden/diagnostics.git","private":false}},{"id":"2b283938a1553b38","name":"@ethereumjs/rlp","version":"4.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MPL-2.0","spdxExpression":"MPL-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@ethereumjs\\/rlp:\\@ethereumjs\\/rlp:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ethereumjs:\\@ethereumjs\\/rlp:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40ethereumjs/rlp@4.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@ethereumjs/rlp","version":"4.0.1","author":"martin becze , Alex Beregszaszi , Holger Drewes , Paul Miller ","homepage":"https://github.com/ethereumjs/ethereumjs-monorepo/tree/master/packages/rlp#readme","description":"Recursive Length Prefix Encoding Module","url":"https://github.com/ethereumjs/ethereumjs-monorepo.git","private":false}},{"id":"e264462c29df43ed","name":"@ethereumjs/rlp","version":"5.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MPL-2.0","spdxExpression":"MPL-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@ethereumjs\\/rlp:\\@ethereumjs\\/rlp:5.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ethereumjs:\\@ethereumjs\\/rlp:5.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40ethereumjs/rlp@5.0.2","metadataType":"javascript-npm-package","metadata":{"name":"@ethereumjs/rlp","version":"5.0.2","author":"martin becze , Alex Beregszaszi , Holger Drewes , Paul Miller ","homepage":"https://github.com/ethereumjs/ethereumjs-monorepo/tree/master/packages/rlp#readme","description":"Recursive Length Prefix Encoding Module","url":"https://github.com/ethereumjs/ethereumjs-monorepo.git","private":false}},{"id":"8e41d6aa1fe261a3","name":"@gar/promisify","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@gar/promisify/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@gar/promisify/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@gar/promisify/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@gar/promisify/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@gar\\/promisify:\\@gar\\/promisify:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:wraithgar:\\@gar\\/promisify:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40gar/promisify@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"@gar/promisify","version":"1.1.3","author":"Gar ","homepage":"","description":"Promisify an entire class or object","url":"https://github.com/wraithgar/gar-promisify.git","private":false}},{"id":"1b734807f495fb6f","name":"@isaacs/cliui","version":"8.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@isaacs\\/cliui:\\@isaacs\\/cliui:8.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40isaacs/cliui@8.0.2","metadataType":"javascript-npm-package","metadata":{"name":"@isaacs/cliui","version":"8.0.2","author":"Ben Coe ","homepage":"","description":"easily create complex multi-column command-line-interfaces","url":"yargs/cliui","private":false}},{"id":"0ab257647e45f4d4","name":"@isaacs/fs-minipass","version":"4.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@isaacs\\/fs-minipass:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs-minipass:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs_minipass:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs_minipass:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40isaacs/fs-minipass@4.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@isaacs/fs-minipass","version":"4.0.1","author":"Isaac Z. Schlueter","homepage":"","description":"fs read and write streams based on minipass","url":"https://github.com/npm/fs-minipass.git","private":false}},{"id":"e38f30a540597121","name":"@my-scope/package-a","version":"0.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@my-scope\\/package-a:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package-a:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_a:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_a:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40my-scope/package-a@0.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@my-scope/package-a","version":"0.0.0","author":"","homepage":"","description":"","url":"","private":true}},{"id":"7c30bf5441790ef5","name":"@my-scope/package-b","version":"0.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@my-scope\\/package-b:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package-b:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_b:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_b:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40my-scope/package-b@0.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@my-scope/package-b","version":"0.0.0","author":"","homepage":"","description":"","url":"","private":true}},{"id":"49cbc756c02b244b","name":"@nlpjs/core","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/core:\\@nlpjs\\/core:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/core@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/core","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"52af61e4284d993b","name":"@nlpjs/core-loader","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/core-loader:\\@nlpjs\\/core-loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core-loader:\\@nlpjs\\/core_loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core_loader:\\@nlpjs\\/core-loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core_loader:\\@nlpjs\\/core_loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core:\\@nlpjs\\/core-loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core:\\@nlpjs\\/core_loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/core-loader@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/core-loader","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"19329a82b3c04a97","name":"@nlpjs/evaluator","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/evaluator:\\@nlpjs\\/evaluator:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/evaluator@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/evaluator","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Evaluator","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"3b35c82860541774","name":"@nlpjs/lang-en","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang-en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang_en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang-en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang_en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang-en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang_en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/lang-en@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/lang-en","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"f478f743a248aca5","name":"@nlpjs/lang-en-min","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en-min:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en-min:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en_min:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en_min:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/lang-en-min@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/lang-en-min","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"ca1d4c9cc3d649fe","name":"@nlpjs/language","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/language/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/language/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/language:\\@nlpjs\\/language:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/language@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/language","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Language guesser","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"49713e5e64515107","name":"@nlpjs/language-min","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/language-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language-min/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/language-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language-min/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/language-min:\\@nlpjs\\/language-min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language-min:\\@nlpjs\\/language_min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language_min:\\@nlpjs\\/language-min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language_min:\\@nlpjs\\/language_min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language:\\@nlpjs\\/language-min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language:\\@nlpjs\\/language_min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/language-min@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/language-min","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Language guesser","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"3bf94ec08da3b281","name":"@nlpjs/ner","version":"4.27.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/ner/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/ner/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/ner/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/ner/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/ner:\\@nlpjs\\/ner:4.27.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/ner@4.27.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/ner","version":"4.27.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Named Entity Recognition","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"d2908794d58fc9bc","name":"@nlpjs/neural","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/neural/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/neural/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/neural/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/neural/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/neural:\\@nlpjs\\/neural:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/neural@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/neural","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Neural Network","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"d41f6d4e68e9c43d","name":"@nlpjs/nlg","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlg/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlg/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/nlg:\\@nlpjs\\/nlg:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/nlg@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/nlg","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Natural Language Generation","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"f85c5456d515aafd","name":"@nlpjs/nlp","version":"4.27.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlp/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlp/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/nlp:\\@nlpjs\\/nlp:4.27.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/nlp@4.27.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/nlp","version":"4.27.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Natural Language Processing","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"c449b8b8cc6afd27","name":"@nlpjs/nlu","version":"4.27.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlu/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlu/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlu/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlu/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/nlu:\\@nlpjs\\/nlu:4.27.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/nlu@4.27.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/nlu","version":"4.27.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Natural Language Understanding","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"8d993f0ba3c63bb7","name":"@nlpjs/request","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/request/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/request/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/request:\\@nlpjs\\/request:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/request@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/request","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Request","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"1b3eb8c3cb77af23","name":"@nlpjs/sentiment","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/sentiment:\\@nlpjs\\/sentiment:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/sentiment@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/sentiment","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Sentiment Analysis","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"203a7b556fc354dd","name":"@nlpjs/similarity","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/similarity/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/similarity/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/similarity/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/similarity/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/similarity:\\@nlpjs\\/similarity:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/similarity@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/similarity","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Similarity","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"6b6febefa6106c5d","name":"@nlpjs/slot","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/slot/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/slot/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/slot/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/slot/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/slot:\\@nlpjs\\/slot:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/slot@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/slot","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Slot filling manager","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"2a40db3b54912cbf","name":"@noble/curves","version":"1.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/curves:\\@noble\\/curves:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:paulmillr:\\@noble\\/curves:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/curves@1.2.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/curves","version":"1.2.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal JS implementation of elliptic curve cryptography","url":"https://github.com/paulmillr/noble-curves.git","private":false}},{"id":"a86e0237429a5827","name":"@noble/curves","version":"1.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/curves:\\@noble\\/curves:1.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/curves@1.4.2","metadataType":"javascript-npm-package","metadata":{"name":"@noble/curves","version":"1.4.2","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal JS implementation of elliptic curve cryptography","url":"git+https://github.com/paulmillr/noble-curves.git","private":false}},{"id":"306de5e5675f2410","name":"@noble/curves","version":"1.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/curves:\\@noble\\/curves:1.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/curves@1.4.2","metadataType":"javascript-npm-package","metadata":{"name":"@noble/curves","version":"1.4.2","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal JS implementation of elliptic curve cryptography","url":"git+https://github.com/paulmillr/noble-curves.git","private":false}},{"id":"46670510cb133f58","name":"@noble/hashes","version":"1.3.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:paulmillr:\\@noble\\/hashes:1.3.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.3.2","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.3.2","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA2, SHA3, RIPEMD, BLAKE2/3, HMAC, HKDF, PBKDF2, Scrypt","url":"https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"749573321ee941d7","name":"@noble/hashes","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.4.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt","url":"git+https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"a3139241ec1643e6","name":"@noble/hashes","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.4.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt","url":"git+https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"c2a39289ece0eefe","name":"@noble/hashes","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.4.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt","url":"git+https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"114921a3f2bc9d12","name":"@npmcli/agent","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/agent:\\@npmcli\\/agent:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:\\@npmcli\\/agent:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/agent@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/agent","version":"3.0.0","author":"GitHub Inc.","homepage":"https://github.com/npm/agent#readme","description":"the http/https agent used by the npm cli","url":"git+https://github.com/npm/agent.git","private":false}},{"id":"644572bbb1e01679","name":"@npmcli/fs","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/fs:\\@npmcli\\/fs:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/fs@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/fs","version":"1.1.1","author":"GitHub Inc.","homepage":"","description":"filesystem utilities for the npm cli","url":"","private":false}},{"id":"2f7974422b4dc793","name":"@npmcli/fs","version":"4.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/fs:\\@npmcli\\/fs:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/fs@4.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/fs","version":"4.0.0","author":"GitHub Inc.","homepage":"","description":"filesystem utilities for the npm cli","url":"git+https://github.com/npm/fs.git","private":false}},{"id":"a988a9e98434d4e0","name":"@npmcli/move-file","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/move-file/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/move-file/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/move-file/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/move-file/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/move-file:\\@npmcli\\/move-file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move-file:\\@npmcli\\/move_file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move_file:\\@npmcli\\/move-file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move_file:\\@npmcli\\/move_file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move:\\@npmcli\\/move-file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move:\\@npmcli\\/move_file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/move-file@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/move-file","version":"1.1.2","author":"","homepage":"","description":"move a file (fork of move-file)","url":"git+https://github.com/npm/move-file","private":false}},{"id":"80ec3c5b78ad0cd1","name":"@otplib/core","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/core/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/core/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/core:\\@otplib\\/core:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/core:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/core@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/core","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"core method for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-core","private":false}},{"id":"a30b3113039a0207","name":"@otplib/plugin-crypto","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-crypto:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-crypto:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_crypto:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_crypto:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/plugin-crypto@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/plugin-crypto","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"node crypto plugin for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-plugin-crypto","private":false}},{"id":"e9e61a8a5751393d","name":"@otplib/plugin-thirty-two","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty-two:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty-two:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty_two:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty_two:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/plugin-thirty-two@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/plugin-thirty-two","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"thirty-two plugin for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-plugin-thirty-two","private":false}},{"id":"8171b09a48e9d93f","name":"@otplib/preset-default","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/preset-default/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-default/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/preset-default/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-default/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/preset-default:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset-default:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_default:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_default:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/preset-default@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/preset-default","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"basic preset for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-preset-default","private":false}},{"id":"1aa44437b113ebed","name":"@otplib/preset-v11","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/preset-v11/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-v11/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/preset-v11/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-v11/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/preset-v11:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset-v11:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_v11:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_v11:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/preset-v11@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/preset-v11","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"v11.x compatible interface preset for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-preset-v11","private":false}},{"id":"80ef1a2248d5a920","name":"@pkgjs/parseargs","version":"0.11.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@pkgjs\\/parseargs:\\@pkgjs\\/parseargs:0.11.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pkgjs:\\@pkgjs\\/parseargs:0.11.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40pkgjs/parseargs@0.11.0","metadataType":"javascript-npm-package","metadata":{"name":"@pkgjs/parseargs","version":"0.11.0","author":"","homepage":"https://github.com/pkgjs/parseargs#readme","description":"Polyfill of future proposal for `util.parseArgs()`","url":"git@github.com:pkgjs/parseargs.git","private":false}},{"id":"19e6077d1014f2df","name":"@scarf/scarf","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scarf/scarf/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scarf/scarf/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"Apache-2.0","spdxExpression":"Apache-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scarf/scarf/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scarf/scarf/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scarf\\/scarf:\\@scarf\\/scarf:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:scarf-sh:\\@scarf\\/scarf:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scarf/scarf@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@scarf/scarf","version":"1.4.0","author":"Scarf Systems","homepage":"https://github.com/scarf-sh/scarf-js","description":"Scarf is like Google Analytics for your npm packages. Gain insights into how your packages are installed and used, and by which companies.","url":"git+https://github.com/scarf-sh/scarf-js.git","private":false}},{"id":"8a8c401a9f2b2c51","name":"@scure/base","version":"1.1.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scure\\/base:\\@scure\\/base:1.1.9:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scure/base@1.1.9","metadataType":"javascript-npm-package","metadata":{"name":"@scure/base","version":"1.1.9","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/#scure","description":"Secure, audited & 0-dep implementation of base64, bech32, base58, base32 & base16","url":"git+https://github.com/paulmillr/scure-base.git","private":false}},{"id":"5f4817f39b8e1c4d","name":"@scure/bip32","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scure\\/bip32:\\@scure\\/bip32:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scure/bip32@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@scure/bip32","version":"1.4.0","author":"Paul Miller (https://paulmillr.com), Patricio Palladino , Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/#scure","description":"Secure, audited & minimal implementation of BIP32 hierarchical deterministic (HD) wallets over secp256k1","url":"git+https://github.com/paulmillr/scure-bip32.git","private":false}},{"id":"0f92a1c1ac31f6b0","name":"@scure/bip39","version":"1.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip39/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip39/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scure\\/bip39:\\@scure\\/bip39:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scure/bip39@1.3.0","metadataType":"javascript-npm-package","metadata":{"name":"@scure/bip39","version":"1.3.0","author":"Paul Miller (https://paulmillr.com), Patricio Palladino , Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/","description":"Secure, audited & minimal implementation of BIP39 mnemonic phrases","url":"git+https://github.com/paulmillr/scure-bip39.git","private":false}},{"id":"a29ebe9c01a24b05","name":"@sindresorhus/is","version":"0.7.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@sindresorhus/is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@sindresorhus/is/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@sindresorhus/is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@sindresorhus/is/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@sindresorhus\\/is:\\@sindresorhus\\/is:0.7.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40sindresorhus/is@0.7.0","metadataType":"javascript-npm-package","metadata":{"name":"@sindresorhus/is","version":"0.7.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Type check values: `is.string('🦄') //=> true`","url":"sindresorhus/is","private":false}},{"id":"079d0d4fdf762801","name":"@swc/helpers","version":"0.3.17","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@swc/helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@swc/helpers/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@swc/helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@swc/helpers/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@swc\\/helpers:\\@swc\\/helpers:0.3.17:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40swc/helpers@0.3.17","metadataType":"javascript-npm-package","metadata":{"name":"@swc/helpers","version":"0.3.17","author":"강동윤 ","homepage":"https://swc.rs","description":"External helpers for the swc project.","url":"git+https://github.com/swc-project/swc.git","private":false}},{"id":"43352d2f6855caf1","name":"@tokenizer/token","version":"0.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@tokenizer/token/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tokenizer/token/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@tokenizer/token/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tokenizer/token/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@tokenizer\\/token:\\@tokenizer\\/token:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:Borewit:\\@tokenizer\\/token:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40tokenizer/token@0.3.0","metadataType":"javascript-npm-package","metadata":{"name":"@tokenizer/token","version":"0.3.0","author":"Borewit (https://github.com/Borewit)","homepage":"","description":"TypeScript definition for strtok3 token","url":"https://github.com/Borewit/tokenizer-token.git","private":false}},{"id":"c5d7a329145ffcc6","name":"@tootallnate/once","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@tootallnate\\/once:\\@tootallnate\\/once:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:\\@tootallnate\\/once:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40tootallnate/once@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"@tootallnate/once","version":"1.1.2","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Creates a Promise that waits for a single event","url":"git://github.com/TooTallNate/once.git","private":false}},{"id":"f544b09023665970","name":"@tootallnate/once","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@tootallnate\\/once:\\@tootallnate\\/once:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:\\@tootallnate\\/once:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40tootallnate/once@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@tootallnate/once","version":"2.0.0","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Creates a Promise that waits for a single event","url":"git://github.com/TooTallNate/once.git","private":false}},{"id":"ae93160dfc27d07c","name":"@types/component-emitter","version":"1.2.14","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/component-emitter/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/component-emitter/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/component-emitter:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component-emitter:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component_emitter:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component_emitter:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/component-emitter@1.2.14","metadataType":"javascript-npm-package","metadata":{"name":"@types/component-emitter","version":"1.2.14","author":"Peter Snider (https://github.com/psnider)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/component-emitter","description":"TypeScript definitions for component-emitter","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"1339467e13b5c752","name":"@types/cookie","version":"0.4.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/cookie:0.4.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/cookie:\\@types\\/cookie:0.4.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/cookie@0.4.1","metadataType":"javascript-npm-package","metadata":{"name":"@types/cookie","version":"0.4.1","author":"Pine Mizune (https://github.com/pine), Piotr Błażejewicz (https://github.com/peterblazejewicz)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/cookie","description":"TypeScript definitions for cookie","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"bc4bb778990d4ea4","name":"@types/cors","version":"2.8.19","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/cors:2.8.19:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/cors:\\@types\\/cors:2.8.19:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/cors@2.8.19","metadataType":"javascript-npm-package","metadata":{"name":"@types/cors","version":"2.8.19","author":"Alan Plum (https://github.com/pluma), Gaurav Sharma (https://github.com/gtpan77), Sebastian Beltran (https://github.com/bjohansebas)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/cors","description":"TypeScript definitions for cors","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"6c978939ffb311b0","name":"@types/debug","version":"4.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/debug:4.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/debug:\\@types\\/debug:4.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/debug@4.1.12","metadataType":"javascript-npm-package","metadata":{"name":"@types/debug","version":"4.1.12","author":"Seon-Wook Park (https://github.com/swook), Gal Talmor (https://github.com/galtalmor), John McLaughlin (https://github.com/zamb3zi), Brasten Sager (https://github.com/brasten), Nicolas Penin (https://github.com/npenin), Kristian Brünn (https://github.com/kristianmitk), Caleb Gregory (https://github.com/calebgregory)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/debug","description":"TypeScript definitions for debug","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"495a18008d72fd0f","name":"@types/ms","version":"2.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/ms/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ms/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/ms/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ms/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/ms:2.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/ms:\\@types\\/ms:2.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/ms@2.1.0","metadataType":"javascript-npm-package","metadata":{"name":"@types/ms","version":"2.1.0","author":"Zhiyuan Wang (https://github.com/danny8002)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/ms","description":"TypeScript definitions for ms","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"1a396f39fa44decd","name":"@types/node","version":"20.19.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/node:20.19.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/node:\\@types\\/node:20.19.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/node@20.19.12","metadataType":"javascript-npm-package","metadata":{"name":"@types/node","version":"20.19.12","author":"Microsoft TypeScript (https://github.com/Microsoft), Alberto Schiabel (https://github.com/jkomyno), Andrew Makarov (https://github.com/r3nya), Benjamin Toueg (https://github.com/btoueg), David Junger (https://github.com/touffy), Mohsen Azimi (https://github.com/mohsen1), Nikita Galkin (https://github.com/galkin), Sebastian Silbermann (https://github.com/eps1lon), Wilco Bakker (https://github.com/WilcoBakker), Marcin Kopacz (https://github.com/chyzwar), Trivikram Kamat (https://github.com/trivikr), Junxiao Shi (https://github.com/yoursunny), Ilia Baryshnikov (https://github.com/qwelias), ExE Boss (https://github.com/ExE-Boss), Piotr Błażejewicz (https://github.com/peterblazejewicz), Anna Henningsen (https://github.com/addaleax), Victor Perin (https://github.com/victorperin), NodeJS Contributors (https://github.com/NodeJS), Linus Unnebäck (https://github.com/LinusU), wafuwafu13 (https://github.com/wafuwafu13), Matteo Collina (https://github.com/mcollina), Dmitry Semigradsky (https://github.com/Semigradsky)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node","description":"TypeScript definitions for node","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"6fe716e8b0927a9d","name":"@types/node","version":"22.7.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/node:22.7.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/node:\\@types\\/node:22.7.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/node@22.7.5","metadataType":"javascript-npm-package","metadata":{"name":"@types/node","version":"22.7.5","author":"Microsoft TypeScript (https://github.com/Microsoft), Alberto Schiabel (https://github.com/jkomyno), Alvis HT Tang (https://github.com/alvis), Andrew Makarov (https://github.com/r3nya), Benjamin Toueg (https://github.com/btoueg), Chigozirim C. (https://github.com/smac89), David Junger (https://github.com/touffy), Deividas Bakanas (https://github.com/DeividasBakanas), Eugene Y. Q. Shen (https://github.com/eyqs), Hannes Magnusson (https://github.com/Hannes-Magnusson-CK), Huw (https://github.com/hoo29), Kelvin Jin (https://github.com/kjin), Klaus Meinhardt (https://github.com/ajafff), Lishude (https://github.com/islishude), Mariusz Wiktorczyk (https://github.com/mwiktorczyk), Mohsen Azimi (https://github.com/mohsen1), Nikita Galkin (https://github.com/galkin), Parambir Singh (https://github.com/parambirs), Sebastian Silbermann (https://github.com/eps1lon), Thomas den Hollander (https://github.com/ThomasdenH), Wilco Bakker (https://github.com/WilcoBakker), wwwy3y3 (https://github.com/wwwy3y3), Samuel Ainsworth (https://github.com/samuela), Kyle Uehlein (https://github.com/kuehlein), Thanik Bhongbhibhat (https://github.com/bhongy), Marcin Kopacz (https://github.com/chyzwar), Trivikram Kamat (https://github.com/trivikr), Junxiao Shi (https://github.com/yoursunny), Ilia Baryshnikov (https://github.com/qwelias), ExE Boss (https://github.com/ExE-Boss), Piotr Błażejewicz (https://github.com/peterblazejewicz), Anna Henningsen (https://github.com/addaleax), Victor Perin (https://github.com/victorperin), Yongsheng Zhang (https://github.com/ZYSzys), NodeJS Contributors (https://github.com/NodeJS), Linus Unnebäck (https://github.com/LinusU), wafuwafu13 (https://github.com/wafuwafu13), Matteo Collina (https://github.com/mcollina), Dmitry Semigradsky (https://github.com/Semigradsky)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node","description":"TypeScript definitions for node","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"d3c68c4be4da21f8","name":"@types/strip-bom","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/strip-bom/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-bom/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/strip-bom/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-bom/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/strip-bom:\\@types\\/strip-bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-bom:\\@types\\/strip_bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_bom:\\@types\\/strip-bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_bom:\\@types\\/strip_bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip-bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip_bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/strip-bom@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@types/strip-bom","version":"3.0.0","author":"Mohamed Hegazy ","homepage":"","description":"TypeScript definitions for strip-bom","url":"https://www.github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"a1b120935894d604","name":"@types/strip-json-comments","version":"0.0.30","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/strip-json-comments/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-json-comments/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/strip-json-comments/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-json-comments/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/strip-json-comments:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-json-comments:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json_comments:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json_comments:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-json:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-json:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/strip-json-comments@0.0.30","metadataType":"javascript-npm-package","metadata":{"name":"@types/strip-json-comments","version":"0.0.30","author":"Dylan R. E. Moonfire (https://github.com/dmoonfire)","homepage":"","description":"TypeScript definitions for strip-json-comments","url":"https://www.github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"3e3be5c397de8382","name":"@types/triple-beam","version":"1.3.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/triple-beam/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/triple-beam/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/triple-beam/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/triple-beam/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/triple-beam:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple-beam:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple_beam:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple_beam:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/triple-beam@1.3.5","metadataType":"javascript-npm-package","metadata":{"name":"@types/triple-beam","version":"1.3.5","author":"Daniel Byrne (https://github.com/danwbyrne)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/triple-beam","description":"TypeScript definitions for triple-beam","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"28a4e010c7ae7198","name":"@types/validator","version":"13.15.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/validator/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/validator/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/validator:\\@types\\/validator:13.15.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/validator:13.15.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/validator@13.15.3","metadataType":"javascript-npm-package","metadata":{"name":"@types/validator","version":"13.15.3","author":"tgfjt (https://github.com/tgfjt), Ilya Mochalov (https://github.com/chrootsu), Ayman Nedjmeddine (https://github.com/IOAyman), Louay Alakkad (https://github.com/louy), Bonggyun Lee (https://github.com/deptno), Naoto Yokoyama (https://github.com/builtinnya), Philipp Katz (https://github.com/qqilihq), Jace Warren (https://github.com/keatz55), Munif Tanjim (https://github.com/MunifTanjim), Vlad Poluch (https://github.com/vlapo), Piotr Błażejewicz (https://github.com/peterblazejewicz), Matteo Nista (https://github.com/Mattewn99), Daniel Freire (https://github.com/dcfreire), Rik Smale (https://github.com/WikiRik)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/validator","description":"TypeScript definitions for validator","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"bc7a53b52d363adb","name":"@types/ws","version":"8.5.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/ws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ws/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/ws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ws/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/ws:8.5.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/ws:\\@types\\/ws:8.5.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/ws@8.5.3","metadataType":"javascript-npm-package","metadata":{"name":"@types/ws","version":"8.5.3","author":"Paul Loyd (https://github.com/loyd), Margus Lamp (https://github.com/mlamp), Philippe D'Alva (https://github.com/TitaneBoy), reduckted (https://github.com/reduckted), teidesu (https://github.com/teidesu), Bartosz Wojtkowiak (https://github.com/wojtkowiak), Kyle Hensel (https://github.com/k-yle), Samuel Skeen (https://github.com/cwadrupldijjit)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/ws","description":"TypeScript definitions for ws","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"7797aed52ef29847","name":"abbrev","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:abbrev:abbrev:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:abbrev:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abbrev@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"abbrev","version":"1.1.1","author":"Isaac Z. Schlueter ","homepage":"","description":"Like ruby's abbrev module, but in js","url":"http://github.com/isaacs/abbrev-js","private":false}},{"id":"bfcf5eaa5daa3133","name":"abbrev","version":"3.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:abbrev:abbrev:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abbrev@3.0.1","metadataType":"javascript-npm-package","metadata":{"name":"abbrev","version":"3.0.1","author":"GitHub Inc.","homepage":"","description":"Like ruby's abbrev module, but in js","url":"git+https://github.com/npm/abbrev-js.git","private":false}},{"id":"663ac1c9b870ce8a","name":"abitype","version":"0.7.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/abitype/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abitype/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/abitype/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abitype/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:wagmi-dev:abitype:0.7.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abitype:abitype:0.7.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abitype@0.7.1","metadataType":"javascript-npm-package","metadata":{"name":"abitype","version":"0.7.1","author":"","homepage":"","description":"Strict TypeScript types for Ethereum ABIs","url":"https://github.com/wagmi-dev/abitype.git","private":false}},{"id":"7832aa1cacf310b2","name":"abort-controller","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/abort-controller/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abort-controller/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/abort-controller/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abort-controller/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:abort-controller:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort-controller:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort_controller:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort_controller:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mysticatea:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mysticatea:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abort-controller@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"abort-controller","version":"3.0.0","author":"Toru Nagashima (https://github.com/mysticatea)","homepage":"https://github.com/mysticatea/abort-controller#readme","description":"An implementation of WHATWG AbortController interface.","url":"git+https://github.com/mysticatea/abort-controller.git","private":false}},{"id":"fe1f2ff03fb9475c","name":"accepts","version":"1.3.8","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/accepts/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/accepts/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/accepts/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/accepts/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:accepts:accepts:1.3.8:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/accepts@1.3.8","metadataType":"javascript-npm-package","metadata":{"name":"accepts","version":"1.3.8","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com)","homepage":"","description":"Higher-level content negotiation","url":"jshttp/accepts","private":false}},{"id":"c0f7127acbceb420","name":"acorn","version":"7.4.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:acornjs:acorn:7.4.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn:7.4.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/acorn@7.4.1","metadataType":"javascript-npm-package","metadata":{"name":"acorn","version":"7.4.1","author":"Marijn Haverbeke , Ingvar Stepanyan , Adrian Heine","homepage":"https://github.com/acornjs/acorn","description":"ECMAScript parser","url":"https://github.com/acornjs/acorn.git","private":false}},{"id":"facfba058a0afa86","name":"acorn","version":"8.15.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:acornjs:acorn:8.15.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn:8.15.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/acorn@8.15.0","metadataType":"javascript-npm-package","metadata":{"name":"acorn","version":"8.15.0","author":"Marijn Haverbeke , Ingvar Stepanyan , Adrian Heine","homepage":"https://github.com/acornjs/acorn","description":"ECMAScript parser","url":"git+https://github.com/acornjs/acorn.git","private":false}},{"id":"dbdb98fb9b57cb53","name":"acorn-walk","version":"8.3.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/acorn-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn-walk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/acorn-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn-walk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:acorn-walk:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn-walk:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn_walk:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn_walk:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acornjs:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acornjs:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/acorn-walk@8.3.4","metadataType":"javascript-npm-package","metadata":{"name":"acorn-walk","version":"8.3.4","author":"Marijn Haverbeke , Ingvar Stepanyan , Adrian Heine","homepage":"https://github.com/acornjs/acorn","description":"ECMAScript (ESTree) AST walker","url":"https://github.com/acornjs/acorn.git","private":false}},{"id":"6ad4b0036eebc3a0","name":"aes-js","version":"4.0.0-beta.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/aes-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aes-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/aes-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aes-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:aes-js:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes-js:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes_js:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes_js:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ricmoo:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ricmoo:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/aes-js@4.0.0-beta.5","metadataType":"javascript-npm-package","metadata":{"name":"aes-js","version":"4.0.0-beta.5","author":"Richard Moore ","homepage":"","description":"A pure JavaScript implementation of the AES block cipher and all common modes of operation.","url":"git://github.com/ricmoo/aes-js.git","private":false}},{"id":"aeef16c972765f3c","name":"agent-base","version":"6.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agent-base@6.0.2","metadataType":"javascript-npm-package","metadata":{"name":"agent-base","version":"6.0.2","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Turn a function into an `http.Agent` instance","url":"git://github.com/TooTallNate/node-agent-base.git","private":false}},{"id":"96ecb0353e427e76","name":"agent-base","version":"7.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agent-base@7.1.4","metadataType":"javascript-npm-package","metadata":{"name":"agent-base","version":"7.1.4","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Turn a function into an `http.Agent` instance","url":"https://github.com/TooTallNate/proxy-agents.git","private":false}},{"id":"89a76184ab2e6db2","name":"agent-base","version":"7.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agent-base@7.1.4","metadataType":"javascript-npm-package","metadata":{"name":"agent-base","version":"7.1.4","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Turn a function into an `http.Agent` instance","url":"https://github.com/TooTallNate/proxy-agents.git","private":false}},{"id":"c6a7724321f5beae","name":"agentkeepalive","version":"4.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/agentkeepalive/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agentkeepalive/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/agentkeepalive/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agentkeepalive/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:agentkeepalive:agentkeepalive:4.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:node-modules:agentkeepalive:4.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agentkeepalive@4.6.0","metadataType":"javascript-npm-package","metadata":{"name":"agentkeepalive","version":"4.6.0","author":"fengmk2 (https://github.com/fengmk2)","homepage":"","description":"Missing keepalive http.Agent","url":"git://github.com/node-modules/agentkeepalive.git","private":false}},{"id":"7cedce27af4fa8d6","name":"aggregate-error","version":"3.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/aggregate-error/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aggregate-error/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/aggregate-error/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aggregate-error/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:aggregate-error:aggregate-error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate-error:aggregate_error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate_error:aggregate-error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate_error:aggregate_error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate:aggregate-error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate:aggregate_error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/aggregate-error@3.1.0","metadataType":"javascript-npm-package","metadata":{"name":"aggregate-error","version":"3.1.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Create an error from multiple errors","url":"sindresorhus/aggregate-error","private":false}},{"id":"ba5607392e56dee9","name":"ansi-regex","version":"2.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@2.1.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"2.1.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"2b280fc78a93d0b1","name":"ansi-regex","version":"2.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@2.1.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"2.1.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"b93db3f55b850b14","name":"ansi-regex","version":"2.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@2.1.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"2.1.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"dddd120589f7009b","name":"ansi-regex","version":"3.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:3.0.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@3.0.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"3.0.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"215b7da2acde9858","name":"ansi-regex","version":"5.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:5.0.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@5.0.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"5.0.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"3f33beb59e12eb10","name":"ansi-regex","version":"6.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:6.2.0:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@6.2.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"6.2.0","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"c7daa267534d8282","name":"ansi-regex","version":"6.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:6.2.0:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@6.2.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"6.2.0","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"65b4c3eb14b71ee6","name":"ansi-styles","version":"2.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@2.2.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"2.2.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"f879ff424c2ec284","name":"ansi-styles","version":"3.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@3.2.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"3.2.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"c3f3679aac65318b","name":"ansi-styles","version":"4.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@4.3.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"4.3.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"c365b03d53f8ca80","name":"ansi-styles","version":"4.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@4.3.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"4.3.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"f3dee5a49bb85e72","name":"ansi-styles","version":"4.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@4.3.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"4.3.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"8270a49368d729a2","name":"ansi-styles","version":"6.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@6.2.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"6.2.1","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"1fdc06fdab01441e","name":"anymatch","version":"3.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/anymatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/anymatch/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/anymatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/anymatch/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:micromatch:anymatch:3.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:anymatch:anymatch:3.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/anymatch@3.1.3","metadataType":"javascript-npm-package","metadata":{"name":"anymatch","version":"3.1.3","author":"Elan Shanker (https://github.com/es128)","homepage":"https://github.com/micromatch/anymatch","description":"Matches strings against configurable strings, globs, regular expressions, and/or functions","url":"https://github.com/micromatch/anymatch","private":false}},{"id":"40d1f9967f309c48","name":"append-field","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/append-field/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/append-field/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/append-field/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/append-field/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:append-field:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append-field:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append_field:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append_field:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:LinusU:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:LinusU:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/append-field@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"append-field","version":"1.0.0","author":"Linus Unnebäck ","homepage":"","description":"","url":"http://github.com/LinusU/node-append-field.git","private":false}},{"id":"81de4b22dbb401d0","name":"aproba","version":"1.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/aproba/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aproba/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/aproba/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aproba/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:aproba:aproba:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:aproba:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/aproba@1.2.0","metadataType":"javascript-npm-package","metadata":{"name":"aproba","version":"1.2.0","author":"Rebecca Turner ","homepage":"https://github.com/iarna/aproba","description":"A ridiculously light-weight argument validator (now browser friendly)","url":"https://github.com/iarna/aproba","private":false}},{"id":"3fb8ce78823b4311","name":"archive-type","version":"4.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archive-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archive-type/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archive-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archive-type/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:archive-type:archive-type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive-type:archive_type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive_type:archive-type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive_type:archive_type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive:archive-type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive:archive_type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/archive-type@4.0.0","metadataType":"javascript-npm-package","metadata":{"name":"archive-type","version":"4.0.0","author":"Kevin Mårtensson (https://github.com/kevva)","homepage":"","description":"Detect the archive type of a Buffer/Uint8Array","url":"kevva/archive-type","private":false}},{"id":"dec4b5088a113d49","name":"archiver","version":"1.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:archiverjs:archiver:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver:archiver:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/archiver@1.3.0","metadataType":"javascript-npm-package","metadata":{"name":"archiver","version":"1.3.0","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/node-archiver","description":"a streaming interface for archive generation","url":"https://github.com/archiverjs/node-archiver.git","private":false}},{"id":"35ab1a4a9ad1f907","name":"archiver-utils","version":"1.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:archiver-utils:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver-utils:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver_utils:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver_utils:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/archiver-utils@1.3.0","metadataType":"javascript-npm-package","metadata":{"name":"archiver-utils","version":"1.3.0","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/archiver-utils#readme","description":"utility functions for archiver","url":"https://github.com/archiverjs/archiver-utils.git","private":false}},{"id":"38e39a5c3788e5c4","name":"are-we-there-yet","version":"1.1.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:are-we-there-yet:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there-yet:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/are-we-there-yet@1.1.7","metadataType":"javascript-npm-package","metadata":{"name":"are-we-there-yet","version":"1.1.7","author":"Rebecca Turner (http://re-becca.org)","homepage":"https://github.com/iarna/are-we-there-yet","description":"Keep track of the overall completion of many disparate processes","url":"https://github.com/iarna/are-we-there-yet.git","private":false}},{"id":"a1e5dbdcb445cc0b","name":"are-we-there-yet","version":"3.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:are-we-there-yet:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there-yet:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/are-we-there-yet@3.0.1","metadataType":"javascript-npm-package","metadata":{"name":"are-we-there-yet","version":"3.0.1","author":"GitHub Inc.","homepage":"https://github.com/npm/are-we-there-yet","description":"Keep track of the overall completion of many disparate processes","url":"https://github.com/npm/are-we-there-yet.git","private":false}},{"id":"1d7fb08b7a508a14","name":"arg","version":"4.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arg/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arg/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:arg:arg:4.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arg@4.1.3","metadataType":"javascript-npm-package","metadata":{"name":"arg","version":"4.1.3","author":"Josh Junon ","homepage":"","description":"Another simple argument parser","url":"zeit/arg","private":false}},{"id":"d60313d70eaae47d","name":"argparse","version":"1.0.10","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/argparse/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/argparse/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/argparse/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/argparse/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:argparse:argparse:1.0.10:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/argparse@1.0.10","metadataType":"javascript-npm-package","metadata":{"name":"argparse","version":"1.0.10","author":"Eugene Shkuropat, Paul Jacobson","homepage":"","description":"Very powerful CLI arguments parser. Native port of argparse - python's options parsing library","url":"nodeca/argparse","private":false}},{"id":"79c9f00f6f2bc886","name":"arr-diff","version":"4.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arr-diff/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-diff/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arr-diff/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-diff/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-diff:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-diff:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_diff:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_diff:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arr-diff@4.0.0","metadataType":"javascript-npm-package","metadata":{"name":"arr-diff","version":"4.0.0","author":"Jon Schlinkert (https://github.com/jonschlinkert), Jon Schlinkert (http://twitter.com/jonschlinkert), Paul Miller (paulmillr.com)","homepage":"https://github.com/jonschlinkert/arr-diff","description":"Returns an array with only the unique values from the first array, by excluding all values from additional arrays using strict equality for comparisons.","url":"jonschlinkert/arr-diff","private":false}},{"id":"af48b36479290ede","name":"arr-flatten","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arr-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-flatten/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arr-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-flatten/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-flatten:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-flatten:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_flatten:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_flatten:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arr-flatten@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"arr-flatten","version":"1.1.0","author":"Jon Schlinkert (https://github.com/jonschlinkert), Jon Schlinkert (http://twitter.com/jonschlinkert), Luke Edwards (https://lukeed.com)","homepage":"https://github.com/jonschlinkert/arr-flatten","description":"Recursively flatten an array or arrays.","url":"jonschlinkert/arr-flatten","private":false}},{"id":"93ff899831bd49b7","name":"arr-union","version":"3.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arr-union/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-union/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arr-union/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-union/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-union:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-union:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_union:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_union:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arr-union@3.1.0","metadataType":"javascript-npm-package","metadata":{"name":"arr-union","version":"3.1.0","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/arr-union","description":"Combines a list of arrays, returning a single array with unique values, using strict equality for comparisons.","url":"jonschlinkert/arr-union","private":false}},{"id":"f2867470e7b27597","name":"array-buffer-byte-length","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-buffer-byte-length/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-buffer-byte-length/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-buffer-byte-length/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-buffer-byte-length/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:array-buffer-byte-length:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer-byte-length:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte_length:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte_length:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer-byte:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer-byte:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-buffer-byte-length@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"array-buffer-byte-length","version":"1.0.2","author":"Jordan Harband ","homepage":"https://github.com/inspect-js/array-buffer-byte-length#readme","description":"Get the byte length of an ArrayBuffer, even in engines without a `.byteLength` method.","url":"git+https://github.com/inspect-js/array-buffer-byte-length.git","private":false}},{"id":"7aadb2fc6095104c","name":"array-each","version":"1.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-each/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-each/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-each/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-each/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-each:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-each:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_each:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_each:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-each@1.0.1","metadataType":"javascript-npm-package","metadata":{"name":"array-each","version":"1.0.1","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/array-each","description":"Loop over each item in an array and call the given function on every element.","url":"jonschlinkert/array-each","private":false}},{"id":"5041c141565d0833","name":"array-flatten","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-flatten/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-flatten/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:array-flatten:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-flatten:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_flatten:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_flatten:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:blakeembrey:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:blakeembrey:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-flatten@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"array-flatten","version":"1.1.1","author":"Blake Embrey (http://blakeembrey.me)","homepage":"https://github.com/blakeembrey/array-flatten","description":"Flatten an array of nested arrays into a single flat array","url":"git://github.com/blakeembrey/array-flatten.git","private":false}},{"id":"a261f10f751ab469","name":"array-slice","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-slice/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-slice/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-slice/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-slice/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-slice:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-slice:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_slice:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_slice:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-slice@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"array-slice","version":"1.1.0","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/array-slice","description":"Array-slice method. Slices `array` from the `start` index up to, but not including, the `end` index.","url":"jonschlinkert/array-slice","private":false}},{"id":"9bb35b54a028e73b","name":"array-unique","version":"0.3.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-unique/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-unique/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-unique/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-unique/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-unique:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-unique:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_unique:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_unique:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-unique@0.3.2","metadataType":"javascript-npm-package","metadata":{"name":"array-unique","version":"0.3.2","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/array-unique","description":"Remove duplicate values from an array. Fastest ES5 implementation.","url":"jonschlinkert/array-unique","private":false}},{"id":"1c54e38011c51e5b","name":"asap","version":"2.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/asap/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/asap/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/asap/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/asap/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:kriskowal:asap:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:asap:asap:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/asap@2.0.6","metadataType":"javascript-npm-package","metadata":{"name":"asap","version":"2.0.6","author":"","homepage":"","description":"High-priority task queue for Node.js and browsers","url":"https://github.com/kriskowal/asap.git","private":false}},{"id":"e57cc97cb7061a4e","name":"assert-never","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/assert-never/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assert-never/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/assert-never/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assert-never/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:assert-never:assert-never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert-never:assert_never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert_never:assert-never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert_never:assert_never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert:assert-never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert:assert_never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/assert-never@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"assert-never","version":"1.4.0","author":"Daniel Lytkin ","homepage":"","description":"Helper function for exhaustive checks of discriminated unions in TypeScript","url":"aikoven/assert-never","private":false}},{"id":"e6db49d199a690ef","name":"assign-symbols","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/assign-symbols/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assign-symbols/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/assign-symbols/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assign-symbols/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:assign-symbols:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign-symbols:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign_symbols:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign_symbols:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/assign-symbols@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"assign-symbols","version":"1.0.0","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/assign-symbols","description":"Assign the enumerable es6 Symbol properties from an object (or objects) to the first object passed on the arguments. Can be used as a supplement to other extend, assign or merge methods as a polyfill for the Symbols part of the es6 Object.assign method.","url":"jonschlinkert/assign-symbols","private":false}},{"id":"50f2f4c26ff2ccab","name":"async","version":"2.6.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/async/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/async/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:caolan:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:async:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/async@2.6.4","metadataType":"javascript-npm-package","metadata":{"name":"async","version":"2.6.4","author":"Caolan McMahon","homepage":"https://caolan.github.io/async/","description":"Higher-order functions and common patterns for asynchronous code","url":"https://github.com/caolan/async.git","private":false}},{"id":"5aa21ddd678e2c5a","name":"async","version":"2.6.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:caolan:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:async:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/async@2.6.4","metadataType":"javascript-npm-package","metadata":{"name":"async","version":"2.6.4","author":"Caolan McMahon","homepage":"https://caolan.github.io/async/","description":"Higher-order functions and common patterns for asynchronous code","url":"https://github.com/caolan/async.git","private":false}},{"id":"6753e2a5837ba461","name":"async","version":"3.2.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/async/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/async/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:caolan:async:3.2.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:async:async:3.2.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/async@3.2.6","metadataType":"javascript-npm-package","metadata":{"name":"async","version":"3.2.6","author":"Caolan McMahon","homepage":"https://caolan.github.io/async/","description":"Higher-order functions and common patterns for asynchronous code","url":"https://github.com/caolan/async.git","private":false}},{"id":"dd9e19320bbf0929","name":"at-least-node","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/at-least-node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/at-least-node/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/at-least-node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/at-least-node/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:at-least-node:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at-least-node:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least_node:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least_node:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at-least:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at-least:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:RyanZim:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:RyanZim:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/at-least-node@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"at-least-node","version":"1.0.0","author":"Ryan Zimmerman ","homepage":"https://github.com/RyanZim/at-least-node#readme","description":"Lightweight Node.js version sniffing/comparison","url":"git+https://github.com/RyanZim/at-least-node.git","private":false}},{"id":"27aacb47fbbddd97","name":"atob","version":"2.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/atob/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/atob/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"(MIT OR Apache-2.0)","spdxExpression":"(MIT OR Apache-2.0)","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/atob/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/atob/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:atob_project:atob:2.1.2:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/atob@2.1.2","metadataType":"javascript-npm-package","metadata":{"name":"atob","version":"2.1.2","author":"AJ ONeal (https://coolaj86.com)","homepage":"https://git.coolaj86.com/coolaj86/atob.js.git","description":"atob for Node.JS and Linux / Mac / Windows CLI (it's a one-liner)","url":"git://git.coolaj86.com/coolaj86/atob.js.git","private":false}},{"id":"91c13e4c18804052","name":"available-typed-arrays","version":"1.0.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/available-typed-arrays/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/available-typed-arrays/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/available-typed-arrays/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/available-typed-arrays/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:available-typed-arrays:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available-typed-arrays:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed_arrays:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed_arrays:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available-typed:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available-typed:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/available-typed-arrays@1.0.7","metadataType":"javascript-npm-package","metadata":{"name":"available-typed-arrays","version":"1.0.7","author":"Jordan Harband ","homepage":"https://github.com/inspect-js/available-typed-arrays#readme","description":"Returns an array of Typed Array names that are available in the current environment","url":"git+https://github.com/inspect-js/available-typed-arrays.git","private":false}},{"id":"716281520579424d","name":"babel-walk","version":"3.0.0-canary-5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/babel-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/babel-walk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/babel-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/babel-walk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:babel-walk:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel-walk:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel_walk:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel_walk:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pugjs:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pugjs:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/babel-walk@3.0.0-canary-5","metadataType":"javascript-npm-package","metadata":{"name":"babel-walk","version":"3.0.0-canary-5","author":"Timothy Gu ","homepage":"","description":"Lightweight Babel AST traversal","url":"https://github.com/pugjs/babel-walk.git","private":false}},{"id":"956658d078dc7d57","name":"balanced-match","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/balanced-match/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/balanced-match/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/balanced-match/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/balanced-match/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:balanced-match:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced-match:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced_match:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced_match:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/balanced-match@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"balanced-match","version":"1.0.2","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/balanced-match","description":"Match balanced character pairs, like \"{\" and \"}\"","url":"git://github.com/juliangruber/balanced-match.git","private":false}},{"id":"1921674c9fb6eba8","name":"base","version":"0.11.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:node-base:base:0.11.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base:base:0.11.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base@0.11.2","metadataType":"javascript-npm-package","metadata":{"name":"base","version":"0.11.2","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), John O'Donnell (https://github.com/criticalmash), Jon Schlinkert (http://twitter.com/jonschlinkert), tunnckoCore (https://i.am.charlike.online), , Brian Woodward (https://github.com/doowb), Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/node-base/base","description":"base is the foundation for creating modular, unit testable and highly pluggable node.js applications, starting with a handful of common methods, like `set`, `get`, `del` and `use`.","url":"node-base/base","private":false}},{"id":"c91bc2e84142f428","name":"base-files","version":"12.4+deb12u11","type":"deb","foundBy":"dpkg-db-cataloger","locations":[{"path":"/var/lib/dpkg/status.d/base-files","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/var/lib/dpkg/status.d/base-files","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/base-files/copyright","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/usr/share/doc/base-files/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/base-files.md5sums","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/var/lib/dpkg/status.d/base-files.md5sums","annotations":{"evidence":"supporting"}}],"licenses":[{"value":"GPL","spdxExpression":"","type":"declared","urls":[],"locations":[{"path":"/usr/share/doc/base-files/copyright","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/usr/share/doc/base-files/copyright"}]}],"language":"","cpes":[{"cpe":"cpe:2.3:a:base-files:base-files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base-files:base_files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base_files:base-files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base_files:base_files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base:base-files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base:base_files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:deb/debian/base-files@12.4%2Bdeb12u11?arch=amd64&distro=debian-12","metadataType":"dpkg-db-entry","metadata":{"package":"base-files","source":"","version":"12.4+deb12u11","sourceVersion":"","architecture":"amd64","maintainer":"Santiago Vila ","installedSize":341,"provides":["base"],"preDepends":["awk"],"files":[{"path":"/usr/lib/os-release","digest":{"algorithm":"md5","value":"07d31e7e63800ab1b7966980709c51eb"},"isConfigFile":false},{"path":"/usr/share/base-files/dot.bashrc","digest":{"algorithm":"md5","value":"0a540d50c157ed0070459b82c358a05a"},"isConfigFile":false},{"path":"/usr/share/base-files/dot.profile","digest":{"algorithm":"md5","value":"d68ce7c7d7d2bb7d48aeb2f137b828e4"},"isConfigFile":false},{"path":"/usr/share/base-files/dot.profile.md5sums","digest":{"algorithm":"md5","value":"6db82730e03aaeeecb8fee76b73d96d4"},"isConfigFile":false},{"path":"/usr/share/base-files/info.dir","digest":{"algorithm":"md5","value":"f9128f409878ce10d54d06488e3ce136"},"isConfigFile":false},{"path":"/usr/share/base-files/motd","digest":{"algorithm":"md5","value":"9830e3dbb6a828f2cc824db8db0ceaf7"},"isConfigFile":false},{"path":"/usr/share/base-files/profile","digest":{"algorithm":"md5","value":"48a30a427d1794feb49f102b87ddce2b"},"isConfigFile":false},{"path":"/usr/share/base-files/profile.md5sums","digest":{"algorithm":"md5","value":"9be77181dd5dcc2b87956e3d45ed191d"},"isConfigFile":false},{"path":"/usr/share/base-files/staff-group-for-usr-local","digest":{"algorithm":"md5","value":"f3b332b9a376a0567236f54d7d87f85e"},"isConfigFile":false},{"path":"/usr/share/common-licenses/Apache-2.0","digest":{"algorithm":"md5","value":"3b83ef96387f14655fc854ddc3c6bd57"},"isConfigFile":false},{"path":"/usr/share/common-licenses/Artistic","digest":{"algorithm":"md5","value":"f921793d03cc6d63ec4b15e9be8fd3f8"},"isConfigFile":false},{"path":"/usr/share/common-licenses/BSD","digest":{"algorithm":"md5","value":"3775480a712fc46a69647678acb234cb"},"isConfigFile":false},{"path":"/usr/share/common-licenses/CC0-1.0","digest":{"algorithm":"md5","value":"65d3616852dbf7b1a6d4b53b00626032"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GFDL-1.2","digest":{"algorithm":"md5","value":"cfe2a5472d5eaa226eae091d4114ce29"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GFDL-1.3","digest":{"algorithm":"md5","value":"a22d0be1ce2284b67950a4d1673dd1b0"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GPL-1","digest":{"algorithm":"md5","value":"5b122a36d0f6dc55279a0ebc69f3c60b"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GPL-2","digest":{"algorithm":"md5","value":"b234ee4d69f5fce4486a80fdaf4a4263"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GPL-3","digest":{"algorithm":"md5","value":"1ebbd3e34237af26da5dc08a4e440464"},"isConfigFile":false},{"path":"/usr/share/common-licenses/LGPL-2","digest":{"algorithm":"md5","value":"4cf66a4984120007c9881cc871cf49db"},"isConfigFile":false},{"path":"/usr/share/common-licenses/LGPL-2.1","digest":{"algorithm":"md5","value":"4fbd65380cdd255951079008b364516c"},"isConfigFile":false},{"path":"/usr/share/common-licenses/LGPL-3","digest":{"algorithm":"md5","value":"3000208d539ec061b899bce1d9ce9404"},"isConfigFile":false},{"path":"/usr/share/common-licenses/MPL-1.1","digest":{"algorithm":"md5","value":"0c5913925d40b124fb52ce84c5deb3f3"},"isConfigFile":false},{"path":"/usr/share/common-licenses/MPL-2.0","digest":{"algorithm":"md5","value":"815ca599c9df247a0c7f619bab123dad"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/README","digest":{"algorithm":"md5","value":"af032ddc1821dfc3eb1dbb5883910119"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/README.FHS","digest":{"algorithm":"md5","value":"fbd937e067f0a83fb9422713a6b84a8a"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/changelog.gz","digest":{"algorithm":"md5","value":"3fa5ee8dc0d994cdc2c4f7022606f81e"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/copyright","digest":{"algorithm":"md5","value":"1b8bb96d42614948cb7de2882e191734"},"isConfigFile":false},{"path":"/usr/share/lintian/overrides/base-files","digest":{"algorithm":"md5","value":"9dbaaf7a8333c30200f3d11e831acb82"},"isConfigFile":false}]}},{"id":"7b4063d10599bfae","name":"base64-arraybuffer","version":"0.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64-arraybuffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-arraybuffer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64-arraybuffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-arraybuffer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:base64-arraybuffer:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-arraybuffer:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_arraybuffer:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_arraybuffer:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:niklasvh:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:niklasvh:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64-arraybuffer@0.1.4","metadataType":"javascript-npm-package","metadata":{"name":"base64-arraybuffer","version":"0.1.4","author":"Niklas von Hertzen (http://hertzen.com)","homepage":"https://github.com/niklasvh/base64-arraybuffer","description":"Encode/decode base64 data into ArrayBuffers","url":"https://github.com/niklasvh/base64-arraybuffer","private":false}},{"id":"6f1f1a7796cb63d0","name":"base64-js","version":"0.0.8","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:beatgammit:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beatgammit:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64-js@0.0.8","metadataType":"javascript-npm-package","metadata":{"name":"base64-js","version":"0.0.8","author":"T. Jameson Little ","homepage":"","description":"Base64 encoding/decoding in pure JS","url":"git://github.com/beatgammit/base64-js.git","private":false}},{"id":"c493a9a41b36da0b","name":"base64-js","version":"1.5.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:beatgammit:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beatgammit:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64-js@1.5.1","metadataType":"javascript-npm-package","metadata":{"name":"base64-js","version":"1.5.1","author":"T. Jameson Little ","homepage":"https://github.com/beatgammit/base64-js","description":"Base64 encoding/decoding in pure JS","url":"git://github.com/beatgammit/base64-js.git","private":false}},{"id":"d1750eb90689f1a4","name":"base64id","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64id/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64id/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64id/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64id/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:base64id:base64id:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:faeldt:base64id:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64id@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"base64id","version":"2.0.0","author":"Kristian Faeldt ","homepage":"","description":"Generates a base64 id","url":"https://github.com/faeldt/base64id.git","private":false}},{"id":"2f8a9d6c7656ba10","name":"base64url","version":"0.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64url/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64url/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64url/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64url/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brianloveswords:base64url:0.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64url:base64url:0.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64url@0.0.6","metadataType":"javascript-npm-package","metadata":{"name":"base64url","version":"0.0.6","author":"Brian J Brennan","homepage":"","description":"For encoding to/from base64urls","url":"git://github.com/brianloveswords/base64url.git","private":false}},{"id":"580ca5f2beaae938","name":"basic-auth","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:basic-auth:basic-auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic-auth:basic_auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic_auth:basic-auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic_auth:basic_auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic:basic-auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic:basic_auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/basic-auth@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"basic-auth","version":"2.0.1","author":"","homepage":"","description":"node.js basic auth parser","url":"jshttp/basic-auth","private":false}},{"id":"344c43aaf43bb8dc","name":"batch","version":"0.6.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/batch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/batch/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/batch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/batch/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:visionmedia:batch:0.6.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:batch:batch:0.6.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/batch@0.6.1","metadataType":"javascript-npm-package","metadata":{"name":"batch","version":"0.6.1","author":"TJ Holowaychuk ","homepage":"","description":"Simple async batch with concurrency control and progress reporting.","url":"https://github.com/visionmedia/batch.git","private":false}},{"id":"99a08ef6ddd74ba7","name":"baz","version":"UNKNOWN","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/baz/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/baz/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:baz:baz:*:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/baz","metadataType":"javascript-npm-package","metadata":{"name":"baz","version":"","author":"","homepage":"","description":"","url":"","private":false}},{"id":"ac8f35c9bc6d4edc","name":"beep-boop","version":"1.2.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/github-from-package/example/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/github-from-package/example/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:beep-boop:beep-boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep-boop:beep_boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep_boop:beep-boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep_boop:beep_boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep:beep-boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep:beep_boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/beep-boop@1.2.3","metadataType":"javascript-npm-package","metadata":{"name":"beep-boop","version":"1.2.3","author":"","homepage":"","description":"","url":"git@github.com:substack/beep-boop.git","private":false}},{"id":"6efaee3d2e9117ff","name":"big-integer","version":"1.6.52","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/big-integer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/big-integer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"Unlicense","spdxExpression":"Unlicense","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/big-integer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/big-integer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:big-integer:big-integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big-integer:big_integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big_integer:big-integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big_integer:big_integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big:big-integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big:big_integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/big-integer@1.6.52","metadataType":"javascript-npm-package","metadata":{"name":"big-integer","version":"1.6.52","author":"Peter Olson ","homepage":"","description":"An arbitrary length integer library for Javascript","url":"git@github.com:peterolson/BigInteger.js.git","private":false}},{"id":"aac28aacec14e6f2","name":"binary","version":"0.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/binary/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/binary/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:substack:binary:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary:binary:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/binary@0.3.0","metadataType":"javascript-npm-package","metadata":{"name":"binary","version":"0.3.0","author":"James Halliday (http://substack.net)","homepage":"","description":"Unpack multibyte binary values from buffers","url":"http://github.com/substack/node-binary.git","private":false}},{"id":"cdea7c486a93d741","name":"binary-extensions","version":"2.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/binary-extensions/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary-extensions/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/binary-extensions/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary-extensions/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:binary-extensions:binary-extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary-extensions:binary_extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary_extensions:binary-extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary_extensions:binary_extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary:binary-extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary:binary_extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/binary-extensions@2.3.0","metadataType":"javascript-npm-package","metadata":{"name":"binary-extensions","version":"2.3.0","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"List of binary file extensions","url":"sindresorhus/binary-extensions","private":false}},{"id":"848e919a5348c76e","name":"bindings","version":"1.5.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bindings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bindings/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bindings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bindings/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:bindings:1.5.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bindings:bindings:1.5.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bindings@1.5.0","metadataType":"javascript-npm-package","metadata":{"name":"bindings","version":"1.5.0","author":"Nathan Rajlich (http://tootallnate.net)","homepage":"https://github.com/TooTallNate/node-bindings","description":"Helper module for loading your native module's .node file","url":"git://github.com/TooTallNate/node-bindings.git","private":false}},{"id":"db53f4ebaee4e2cf","name":"bintrees","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bintrees/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bintrees/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bintrees/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bintrees/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:bintrees:bintrees:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:vadimg:bintrees:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bintrees@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"bintrees","version":"1.0.2","author":"Vadim Graboys ","homepage":"","description":"Binary Search Trees","url":"git://github.com/vadimg/js_bintrees.git","private":false}},{"id":"1d71c68896a44c86","name":"bl","version":"1.2.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bl/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bl/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:rvagg:bl:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bl:bl:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bl@1.2.3","metadataType":"javascript-npm-package","metadata":{"name":"bl","version":"1.2.3","author":"Rod Vagg (https://github.com/rvagg), Matteo Collina (https://github.com/mcollina), Jarett Cruger (https://github.com/jcrugzz)","homepage":"https://github.com/rvagg/bl","description":"Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!","url":"https://github.com/rvagg/bl.git","private":false}},{"id":"846a0edd607229fd","name":"bl","version":"4.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:rvagg:bl:4.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bl:bl:4.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bl@4.1.0","metadataType":"javascript-npm-package","metadata":{"name":"bl","version":"4.1.0","author":"Rod Vagg (https://github.com/rvagg), Matteo Collina (https://github.com/mcollina), Jarett Cruger (https://github.com/jcrugzz)","homepage":"https://github.com/rvagg/bl","description":"Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!","url":"https://github.com/rvagg/bl.git","private":false}},{"id":"441b568aa058ddd4","name":"bluebird","version":"3.4.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:petkaantonov:bluebird:3.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bluebird:bluebird:3.4.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bluebird@3.4.7","metadataType":"javascript-npm-package","metadata":{"name":"bluebird","version":"3.4.7","author":"Petka Antonov (http://github.com/petkaantonov/)","homepage":"https://github.com/petkaantonov/bluebird","description":"Full featured Promises/A+ implementation with exceptionally good performance","url":"git://github.com/petkaantonov/bluebird.git","private":false}},{"id":"45ec017cc93f373c","name":"bluebird","version":"3.7.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:petkaantonov:bluebird:3.7.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bluebird:bluebird:3.7.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bluebird@3.7.2","metadataType":"javascript-npm-package","metadata":{"name":"bluebird","version":"3.7.2","author":"Petka Antonov (http://github.com/petkaantonov/)","homepage":"https://github.com/petkaantonov/bluebird","description":"Full featured Promises/A+ implementation with exceptionally good performance","url":"git://github.com/petkaantonov/bluebird.git","private":false}},{"id":"d8348f0566c46229","name":"body-parser","version":"1.20.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/body-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/body-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:openjsf:body-parser:1.20.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/body-parser@1.20.3","metadataType":"javascript-npm-package","metadata":{"name":"body-parser","version":"1.20.3","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com)","homepage":"","description":"Node.js body parsing middleware","url":"expressjs/body-parser","private":false}},{"id":"2c560d35b75226b0","name":"bower-config","version":"1.4.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bower-config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bower-config/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bower-config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bower-config/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:bower-config:bower-config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower-config:bower_config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower_config:bower-config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower_config:bower_config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower:bower-config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower:bower_config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bower-config@1.4.3","metadataType":"javascript-npm-package","metadata":{"name":"bower-config","version":"1.4.3","author":"Twitter","homepage":"http://bower.io","description":"The Bower config reader and writer.","url":"https://github.com/bower/bower/tree/master/packages/bower-config","private":false}},{"id":"79ca6b57cb6da8f4","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"edfc435f78ffbb1c","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"38ff028c7c458475","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"c861e69821b6b8fe","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"70266c742ac992ba","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"e9b43263265b984a","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"28fb5bb71047516a","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"098d823421bc1197","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"17d5b1f1f2c265c0","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"ec01b45e50a80fc7","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"204df6e1c0323307","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"1fcda56aa7b9b39c","name":"brace-expansion","version":"2.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@2.0.2","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"2.0.2","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"e18c817c2057c675","name":"braces","version":"2.3.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:2.3.2:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@2.3.2","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"2.3.2","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"1fea4d70444c02f0","name":"braces","version":"3.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@3.0.3","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"3.0.3","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"05e4a42f1d20184c","name":"braces","version":"3.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@3.0.3","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"3.0.3","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"7300fec6ea68a472","name":"braces","version":"3.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@3.0.3","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"3.0.3","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"470bc485996d4bbe","name":"brotli","version":"1.3.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/brotli/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brotli/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/brotli/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brotli/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:devongovett:brotli:1.3.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brotli:brotli:1.3.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brotli@1.3.3","metadataType":"javascript-npm-package","metadata":{"name":"brotli","version":"1.3.3","author":"Devon Govett ","homepage":"https://github.com/devongovett/brotli.js","description":"A port of the Brotli compression algorithm as used in WOFF2","url":"https://github.com/devongovett/brotli.js.git","private":false}},{"id":"0ec800aec91252a5","name":"browser_field","version":"UNKNOWN","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/browser_field/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/browser_field/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:browser-field:browser-field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser-field:browser_field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser_field:browser-field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser_field:browser_field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser:browser-field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser:browser_field:*:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/browser_field","metadataType":"javascript-npm-package","metadata":{"name":"browser_field","version":"","author":"","homepage":"","description":"","url":"","private":false}},{"id":"8160d61272f16fc2","name":"buffer","version":"5.7.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer:buffer:5.7.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:feross:buffer:5.7.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer@5.7.1","metadataType":"javascript-npm-package","metadata":{"name":"buffer","version":"5.7.1","author":"Feross Aboukhadijeh (https://feross.org), Romain Beauxis , James Halliday ","homepage":"https://github.com/feross/buffer","description":"Node.js Buffer API, for the browser","url":"git://github.com/feross/buffer.git","private":false}},{"id":"b34920cb2184e6ad","name":"buffer","version":"6.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer:buffer:6.0.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:feross:buffer:6.0.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer@6.0.3","metadataType":"javascript-npm-package","metadata":{"name":"buffer","version":"6.0.3","author":"Feross Aboukhadijeh (https://feross.org), Romain Beauxis , James Halliday ","homepage":"https://github.com/feross/buffer","description":"Node.js Buffer API, for the browser","url":"git://github.com/feross/buffer.git","private":false}},{"id":"0215db4a4aa6cd05","name":"buffer-alloc","version":"1.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-alloc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-alloc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-alloc:buffer-alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc:buffer_alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer-alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer_alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-alloc@1.2.0","metadataType":"javascript-npm-package","metadata":{"name":"buffer-alloc","version":"1.2.0","author":"","homepage":"","description":"","url":"LinusU/buffer-alloc","private":false}},{"id":"72525885a05217f9","name":"buffer-alloc-unsafe","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-alloc-unsafe:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc-unsafe:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc_unsafe:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc_unsafe:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-alloc-unsafe@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"buffer-alloc-unsafe","version":"1.1.0","author":"","homepage":"","description":"","url":"LinusU/buffer-alloc-unsafe","private":false}},{"id":"018e707480d9a394","name":"buffer-crc32","version":"0.2.13","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-crc32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-crc32/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-crc32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-crc32/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brianloveswords:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brianloveswords:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-crc32:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-crc32:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_crc32:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_crc32:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-crc32@0.2.13","metadataType":"javascript-npm-package","metadata":{"name":"buffer-crc32","version":"0.2.13","author":"Brian J. Brennan , Vladimir Kuznetsov","homepage":"https://github.com/brianloveswords/buffer-crc32","description":"A pure javascript CRC32 algorithm that plays nice with binary data","url":"git://github.com/brianloveswords/buffer-crc32.git","private":false}},{"id":"b5b4b05d23ef0590","name":"buffer-fill","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-fill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-fill/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-fill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-fill/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-fill:buffer-fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-fill:buffer_fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_fill:buffer-fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_fill:buffer_fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-fill@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"buffer-fill","version":"1.0.0","author":"","homepage":"","description":"","url":"LinusU/buffer-fill","private":false}},{"id":"d2869a97005ddd30","name":"buffer-from","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-from/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-from/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-from/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-from/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-from:buffer-from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-from:buffer_from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_from:buffer-from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_from:buffer_from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-from@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"buffer-from","version":"1.1.2","author":"","homepage":"","description":"","url":"LinusU/buffer-from","private":false}},{"id":"08bc6bd9a895200f","name":"buffer-indexof-polyfill","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-indexof-polyfill:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-indexof-polyfill:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof_polyfill:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof_polyfill:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-indexof:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-indexof:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sarosia:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sarosia:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-indexof-polyfill@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"buffer-indexof-polyfill","version":"1.0.2","author":"https://github.com/sarosia","homepage":"https://github.com/sarosia/buffer-indexof-polyfill#readme","description":"This is a polyfill for Buffer#indexOf introduced in NodeJS 4.0.","url":"git+https://github.com/sarosia/buffer-indexof-polyfill.git","private":false}},{"id":"fd60bbd17e6803d8","name":"buffers","version":"0.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffers/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:substack:buffers:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffers:buffers:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffers@0.1.1","metadataType":"javascript-npm-package","metadata":{"name":"buffers","version":"0.1.1","author":"James Halliday (http://substack.net)","homepage":"","description":"Treat a collection of Buffers as a single contiguous partially mutable Buffer.","url":"http://github.com/substack/node-buffers.git","private":false}},{"id":"72b84630ff8aade7","name":"busboy","version":"1.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/busboy/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/busboy/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/busboy/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/busboy/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:busboy:busboy:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mscdex:busboy:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/busboy@1.6.0","metadataType":"javascript-npm-package","metadata":{"name":"busboy","version":"1.6.0","author":"Brian White ","homepage":"","description":"A streaming parser for HTML form data for node.js","url":"http://github.com/mscdex/busboy.git","private":false}},{"id":"1db66371bc7880de","name":"byline","version":"4.2.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/byline/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/byline/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/byline/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/byline/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jahewson:byline:4.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:byline:byline:4.2.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/byline@4.2.2","metadataType":"javascript-npm-package","metadata":{"name":"byline","version":"4.2.2","author":"John Hewson","homepage":"https://github.com/jahewson/node-byline","description":"simple line-by-line stream reader","url":"https://github.com/jahewson/node-byline","private":false}},{"id":"1d0cce2090c4dc09","name":"bytes","version":"3.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bytes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bytes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bytes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bytes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:bytes:bytes:3.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bytes@3.1.2","metadataType":"javascript-npm-package","metadata":{"name":"bytes","version":"3.1.2","author":"TJ Holowaychuk (http://tjholowaychuk.com), Jed Watson , Théo FIDRY ","homepage":"","description":"Utility to parse a string bytes to bytes and vice-versa","url":"visionmedia/bytes.js","private":false}},{"id":"f5c0681a2e946e2d","name":"cacache","version":"15.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cacache:cacache:15.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:cacache:15.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cacache@15.3.0","metadataType":"javascript-npm-package","metadata":{"name":"cacache","version":"15.3.0","author":"","homepage":"","description":"Fast, fault-tolerant, cross-platform, disk-based, data-agnostic, content-addressable cache.","url":"https://github.com/npm/cacache","private":false}},{"id":"ace0af3ce948f36b","name":"cacache","version":"19.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cacache:cacache:19.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cacache@19.0.1","metadataType":"javascript-npm-package","metadata":{"name":"cacache","version":"19.0.1","author":"GitHub Inc.","homepage":"","description":"Fast, fault-tolerant, cross-platform, disk-based, data-agnostic, content-addressable cache.","url":"git+https://github.com/npm/cacache.git","private":false}},{"id":"baaa5d54fe4a3c13","name":"cache-base","version":"1.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cache-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cache-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cache-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cache-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cache-base_project:cache-base:1.0.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/cache-base@1.0.1","metadataType":"javascript-npm-package","metadata":{"name":"cache-base","version":"1.0.1","author":"Jon Schlinkert (https://github.com/jonschlinkert), Jon Schlinkert (http://twitter.com/jonschlinkert), ","homepage":"https://github.com/jonschlinkert/cache-base","description":"Basic object cache with `get`, `set`, `del`, and `has` methods for node.js/javascript projects.","url":"jonschlinkert/cache-base","private":false}},{"id":"346e1627c1f72870","name":"cacheable-request","version":"2.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cacheable-request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacheable-request/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cacheable-request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacheable-request/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cacheable-request:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable-request:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable_request:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable_request:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cacheable-request@2.1.4","metadataType":"javascript-npm-package","metadata":{"name":"cacheable-request","version":"2.1.4","author":"Luke Childs (http://lukechilds.co.uk)","homepage":"https://github.com/lukechilds/cacheable-request","description":"Wrap native HTTP requests with RFC compliant cache support","url":"git+https://github.com/lukechilds/cacheable-request.git","private":false}},{"id":"b538562043029461","name":"call-bind","version":"1.0.8","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/call-bind/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/call-bind/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:call-bind:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/call-bind@1.0.8","metadataType":"javascript-npm-package","metadata":{"name":"call-bind","version":"1.0.8","author":"Jordan Harband ","homepage":"https://github.com/ljharb/call-bind#readme","description":"Robustly `.call.bind()` a function","url":"git+https://github.com/ljharb/call-bind.git","private":false}},{"id":"0d18b02f5378691f","name":"call-bind-apply-helpers","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:call-bind-apply-helpers:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind-apply-helpers:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply_helpers:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply_helpers:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind-apply:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind-apply:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/call-bind-apply-helpers@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"call-bind-apply-helpers","version":"1.0.2","author":"Jordan Harband ","homepage":"https://github.com/ljharb/call-bind-apply-helpers#readme","description":"Helper functions around Function call/apply/bind, for use in `call-bind`","url":"git+https://github.com/ljharb/call-bind-apply-helpers.git","private":false}},{"id":"44af6e189fe32d87","name":"call-bound","version":"1.0.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/call-bound/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bound/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/call-bound/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bound/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:call-bound:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bound:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bound:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bound:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/call-bound@1.0.4","metadataType":"javascript-npm-package","metadata":{"name":"call-bound","version":"1.0.4","author":"Jordan Harband ","homepage":"https://github.com/ljharb/call-bound#readme","description":"Robust call-bound JavaScript intrinsics, using `call-bind` and `get-intrinsic`.","url":"git+https://github.com/ljharb/call-bound.git","private":false}},{"id":"92e4f8e8e365d6ef","name":"camelcase","version":"5.3.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/camelcase/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/camelcase/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/camelcase/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/camelcase/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:camelcase:camelcase:5.3.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/camelcase@5.3.1","metadataType":"javascript-npm-package","metadata":{"name":"camelcase","version":"5.3.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Convert a dash/dot/underscore/space separated string to camelCase or PascalCase: `foo-bar` → `fooBar`","url":"sindresorhus/camelcase","private":false}},{"id":"6e4c3d3622249d54","name":"chainsaw","version":"0.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chainsaw/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chainsaw/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT/X11","spdxExpression":"","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chainsaw/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chainsaw/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chainsaw:chainsaw:0.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:substack:chainsaw:0.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chainsaw@0.1.0","metadataType":"javascript-npm-package","metadata":{"name":"chainsaw","version":"0.1.0","author":"James Halliday (http://substack.net)","homepage":"","description":"Build chainable fluent interfaces the easy way... with a freakin' chainsaw!","url":"http://github.com/substack/node-chainsaw.git","private":false}},{"id":"af9826c69b6847f8","name":"chalk","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chalk:chalk:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chalk@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"chalk","version":"1.1.3","author":"Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Terminal string styling done right. Much color.","url":"chalk/chalk","private":false}},{"id":"015bdd0e54562d25","name":"chalk","version":"2.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chalk:chalk:2.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chalk@2.4.2","metadataType":"javascript-npm-package","metadata":{"name":"chalk","version":"2.4.2","author":"","homepage":"","description":"Terminal string styling done right","url":"chalk/chalk","private":false}},{"id":"7fe24d7225fc8b9a","name":"chalk","version":"4.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chalk:chalk:4.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chalk@4.1.2","metadataType":"javascript-npm-package","metadata":{"name":"chalk","version":"4.1.2","author":"","homepage":"","description":"Terminal string styling done right","url":"chalk/chalk","private":false}},{"id":"34bd9ccc72e70b6f","name":"character-parser","version":"2.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/character-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/character-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/character-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/character-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:character-parser:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character-parser:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character_parser:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character_parser:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ForbesLindesay:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ForbesLindesay:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/character-parser@2.2.0","metadataType":"javascript-npm-package","metadata":{"name":"character-parser","version":"2.2.0","author":"ForbesLindesay","homepage":"","description":"Parse JavaScript one character at a time to look for snippets in Templates. This is not a validator, it's just designed to allow you to have sections of JavaScript delimited by brackets robustly.","url":"https://github.com/ForbesLindesay/character-parser.git","private":false}},{"id":"0eb2e961c16ff8ae","name":"check-dependencies","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/check-dependencies/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-dependencies/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/check-dependencies/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-dependencies/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:check-dependencies:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-dependencies:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_dependencies:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_dependencies:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mgol:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mgol:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/check-dependencies@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"check-dependencies","version":"1.1.1","author":"Michał Gołębiowski-Owczarek ","homepage":"https://github.com/mgol/check-dependencies","description":"Checks if currently installed npm/bower dependencies are installed in the exact same versions that are specified in package.json/bower.json","url":"https://github.com/mgol/check-dependencies.git","private":false}},{"id":"c843870ea5cc0a9b","name":"check-internet-connected","version":"2.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/check-internet-connected/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-internet-connected/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/check-internet-connected/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-internet-connected/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:check-internet-connected:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-internet-connected:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet_connected:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet_connected:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-internet:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-internet:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aankur:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aankur:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/check-internet-connected@2.0.6","metadataType":"javascript-npm-package","metadata":{"name":"check-internet-connected","version":"2.0.6","author":"Ankur Deep Jaiswal ","homepage":"https://github.com/aankur/check-internet-connected","description":"Utility to check if internet is connected or not","url":"aankur/check-internet-connected","private":false}},{"id":"85b9eff83ffcd831","name":"check-types","version":"6.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/check-types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-types/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/check-types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-types/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:check-types:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-types:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_types:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_types:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:philbooth:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:philbooth:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/check-types@6.0.0","metadataType":"javascript-npm-package","metadata":{"name":"check-types","version":"6.0.0","author":"Phil Booth (https://github.com/philbooth)","homepage":"https://github.com/philbooth/check-types.js","description":"A little library for asserting types and values.","url":"https://github.com/philbooth/check-types.js.git","private":false}},{"id":"4d185a05cefa7d0a","name":"chokidar","version":"3.5.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chokidar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chokidar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:paulmillr:chokidar:3.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:chokidar:chokidar:3.5.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chokidar@3.5.1","metadataType":"javascript-npm-package","metadata":{"name":"chokidar","version":"3.5.1","author":"Paul Miller (https://paulmillr.com), Paul Miller (https://paulmillr.com), Elan Shanker","homepage":"https://github.com/paulmillr/chokidar","description":"Minimal and efficient cross-platform file watching library","url":"git+https://github.com/paulmillr/chokidar.git","private":false}},{"id":"7ebcfb2902378122","name":"chownr","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"1.1.4","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"671f64716b19d5fb","name":"chownr","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"1.1.4","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"3189617deb2bc884","name":"chownr","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"2.0.0","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"fffff6468e7930c0","name":"chownr","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"BlueOak-1.0.0","spdxExpression":"BlueOak-1.0.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"3.0.0","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"6cef1d3c36e6024e","name":"clarinet","version":"0.12.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clarinet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clarinet/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"BSD-2-Clause","spdxExpression":"BSD-2-Clause","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clarinet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clarinet/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clarinet:clarinet:0.12.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:dscape:clarinet:0.12.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clarinet@0.12.6","metadataType":"javascript-npm-package","metadata":{"name":"clarinet","version":"0.12.6","author":"Nuno Job (http://nunojob.com/), Jann Horn (https://github.com/thejh), Justin Makeig (http://www.audiblepop.com), Roly Fentanes (http://about.me/roly), John Lancaster (http://jlank.com)","homepage":"https://github.com/dscape/clarinet","description":"SAX based evented streaming JSON parser in JavaScript (browser and node)","url":"http://github.com/dscape/clarinet.git","private":false}},{"id":"a7e36e39ff61aea5","name":"class-utils","version":"0.3.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/class-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/class-utils/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/class-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/class-utils/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class-utils:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class-utils:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class_utils:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class_utils:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/class-utils@0.3.6","metadataType":"javascript-npm-package","metadata":{"name":"class-utils","version":"0.3.6","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Jon Schlinkert (http://twitter.com/jonschlinkert), ","homepage":"https://github.com/jonschlinkert/class-utils","description":"Utils for working with JavaScript classes and prototype methods.","url":"jonschlinkert/class-utils","private":false}},{"id":"08eaf1d1a1378cc5","name":"clean-stack","version":"2.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clean-stack/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clean-stack/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clean-stack/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clean-stack/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clean-stack:clean-stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean-stack:clean_stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean_stack:clean-stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean_stack:clean_stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean:clean-stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean:clean_stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clean-stack@2.2.0","metadataType":"javascript-npm-package","metadata":{"name":"clean-stack","version":"2.2.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Clean up error stack traces","url":"sindresorhus/clean-stack","private":false}},{"id":"6fb115e3b5d5d3f2","name":"cliui","version":"6.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cliui:cliui:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yargs:cliui:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cliui@6.0.0","metadataType":"javascript-npm-package","metadata":{"name":"cliui","version":"6.0.0","author":"Ben Coe ","homepage":"","description":"easily create complex multi-column command-line-interfaces","url":"http://github.com/yargs/cliui.git","private":false}},{"id":"080e255664d33bc7","name":"clone","version":"2.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clone/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clone/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clone:clone:2.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pvorb:clone:2.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clone@2.1.2","metadataType":"javascript-npm-package","metadata":{"name":"clone","version":"2.1.2","author":"Paul Vorbach (http://paul.vorba.ch/), Blake Miner (http://www.blakeminer.com/), Tian You (http://blog.axqd.net/), George Stagas (http://stagas.com/), Tobiasz Cudnik (https://github.com/TobiaszCudnik), Pavel Lang (https://github.com/langpavel), Dan MacTough (http://yabfog.com/), w1nk (https://github.com/w1nk), Hugh Kennedy (http://twitter.com/hughskennedy), Dustin Diaz (http://dustindiaz.com), Ilya Shaisultanov (https://github.com/diversario), Nathan MacInnes (http://macinn.es/), Benjamin E. Coe (https://twitter.com/benjamincoe), Nathan Zadoks (https://github.com/nathan7), Róbert Oroszi (https://github.com/oroce), Aurélio A. Heckert (http://softwarelivre.org/aurium), Guy Ellis (http://www.guyellisrocks.com/), fscherwi (https://fscherwi.github.io), rictic (https://github.com/rictic), Martin Jurča (https://github.com/jurca), Misery Lee (https://github.com/miserylee), Clemens Wolff (https://github.com/c-w)","homepage":"","description":"deep cloning of objects and arrays","url":"git://github.com/pvorb/node-clone.git","private":false}},{"id":"1ca687973f79cd5a","name":"clone-response","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clone-response/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone-response/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clone-response/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone-response/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clone-response:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone-response:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone_response:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone_response:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clone-response@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"clone-response","version":"1.0.2","author":"Luke Childs (http://lukechilds.co.uk)","homepage":"https://github.com/lukechilds/clone-response","description":"Clone a Node.js HTTP response stream","url":"git+https://github.com/lukechilds/clone-response.git","private":false}},{"id":"15db8f5283662b54","name":"code-point-at","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/code-point-at/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/code-point-at/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/code-point-at/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/code-point-at/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:code-point-at:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code-point-at:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point_at:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point_at:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code-point:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code-point:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/code-point-at@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"code-point-at","version":"1.1.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ES2015 `String#codePointAt()` ponyfill","url":"sindresorhus/code-point-at","private":false}},{"id":"d87950bd24d66a30","name":"collection-visit","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/collection-visit/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/collection-visit/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/collection-visit/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/collection-visit/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:collection-visit:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection-visit:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection_visit:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection_visit:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/collection-visit@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"collection-visit","version":"1.0.0","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/collection-visit","description":"Visit a method over the items in an object, or map visit over the objects in an array.","url":"jonschlinkert/collection-visit","private":false}},{"id":"2774fa6f21932145","name":"color","version":"3.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color:color:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color@3.2.1","metadataType":"javascript-npm-package","metadata":{"name":"color","version":"3.2.1","author":"Josh Junon , Heather Arthur , Maxime Thirouin","homepage":"","description":"Color conversion and manipulation with CSS string support","url":"Qix-/color","private":false}},{"id":"832fbb197a382df6","name":"color-convert","version":"1.9.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@1.9.3","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"1.9.3","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"ad73ceb607fdd321","name":"color-convert","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"2.0.1","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"c216a258a2dd7fdf","name":"color-convert","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"2.0.1","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"d7906a8074d4b4f9","name":"color-convert","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"2.0.1","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"92662d8a3adbe0c9","name":"color-name","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:dfcreative:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:dfcreative:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.3","author":"DY ","homepage":"https://github.com/dfcreative/color-name","description":"A list of color names and its values","url":"git@github.com:dfcreative/color-name.git","private":false}},{"id":"a184510682ce4734","name":"color-name","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.4","author":"DY ","homepage":"https://github.com/colorjs/color-name","description":"A list of color names and its values","url":"git@github.com:colorjs/color-name.git","private":false}},{"id":"a80b99ad61e48555","name":"color-name","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.4","author":"DY ","homepage":"https://github.com/colorjs/color-name","description":"A list of color names and its values","url":"git@github.com:colorjs/color-name.git","private":false}},{"id":"01c750f52978cfc6","name":"color-name","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.4","author":"DY ","homepage":"https://github.com/colorjs/color-name","description":"A list of color names and its values","url":"git@github.com:colorjs/color-name.git","private":false}},{"id":"7e888fa51e3748f2","name":"color-string","version":"1.9.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-string/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-string/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-string/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-string/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-string_project:color-string:1.9.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/color-string@1.9.1","metadataType":"javascript-npm-package","metadata":{"name":"color-string","version":"1.9.1","author":"Heather Arthur , Maxime Thirouin, Dyma Ywanov , Josh Junon","homepage":"","description":"Parser and generator for CSS color strings","url":"Qix-/color-string","private":false}},{"id":"a1e232528ce637f4","name":"color-support","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-support/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-support/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-support/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-support/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-support:color-support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-support:color_support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_support:color-support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_support:color_support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-support@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"color-support","version":"1.1.3","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"A module which will endeavor to guess your terminal's level of color support.","url":"git+https://github.com/isaacs/color-support.git","private":false}},{"id":"774e316934f12a96","name":"colors","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:colors:colors:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:Marak:colors:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/colors@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"colors","version":"1.1.2","author":"Marak Squires","homepage":"https://github.com/Marak/colors.js","description":"get colors in your node.js console","url":"http://github.com/Marak/colors.js.git","private":false}},{"id":"ba9f99e8572f2682","name":"colors","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:colors:colors:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:Marak:colors:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/colors@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"colors","version":"1.4.0","author":"Marak Squires, DABH (https://github.com/DABH)","homepage":"https://github.com/Marak/colors.js","description":"get colors in your node.js console","url":"http://github.com/Marak/colors.js.git","private":false}},{"id":"84bcfa432cfdd0d0","name":"colorspace","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/colorspace/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colorspace/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/colorspace/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colorspace/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:colorspace:colorspace:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:3rd-Eden:colorspace:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/colorspace@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"colorspace","version":"1.1.4","author":"Arnout Kazemier","homepage":"https://github.com/3rd-Eden/colorspace","description":"Generate HEX colors for a given namespace.","url":"https://github.com/3rd-Eden/colorspace","private":false}},{"id":"23da7748c749bc68","name":"commander","version":"2.20.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:commander:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:tj:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/commander@2.20.3","metadataType":"javascript-npm-package","metadata":{"name":"commander","version":"2.20.3","author":"TJ Holowaychuk ","homepage":"","description":"the complete solution for node.js command-line programs","url":"https://github.com/tj/commander.js.git","private":false}},{"id":"3facda85b5f59f2a","name":"commander","version":"2.20.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:commander:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:tj:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/commander@2.20.3","metadataType":"javascript-npm-package","metadata":{"name":"commander","version":"2.20.3","author":"TJ Holowaychuk ","homepage":"","description":"the complete solution for node.js command-line programs","url":"https://github.com/tj/commander.js.git","private":false}},{"id":"ebc8491ac18b63ae","name":"component-emitter","version":"1.3.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-emitter/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-emitter/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:component-emitter:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component-emitter:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_emitter:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_emitter:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sindresorhus:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sindresorhus:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/component-emitter@1.3.1","metadataType":"javascript-npm-package","metadata":{"name":"component-emitter","version":"1.3.1","author":"","homepage":"","description":"Event emitter","url":"https://github.com/sindresorhus/component-emitter.git","private":false}},{"id":"e91a1227114ad372","name":"component-type","version":"1.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/component-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-type/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/component-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-type/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:component-type:component-type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component-type:component_type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_type:component-type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_type:component_type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component-type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component_type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/component-type@1.2.1","metadataType":"javascript-npm-package","metadata":{"name":"component-type","version":"1.2.1","author":"","homepage":"","description":"Cross-browser type assertions (less broken typeof)","url":"https://github.com/component/type.git","private":false}},{"id":"798bc97add5e6f68","name":"compress-commons","version":"1.2.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compress-commons/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compress-commons/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compress-commons/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compress-commons/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:compress-commons:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress-commons:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress_commons:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress_commons:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/compress-commons@1.2.2","metadataType":"javascript-npm-package","metadata":{"name":"compress-commons","version":"1.2.2","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/node-compress-commons","description":"a library that defines a common interface for working with archive formats within node","url":"https://github.com/archiverjs/node-compress-commons.git","private":false}},{"id":"d33659b98b525c44","name":"compressible","version":"2.0.18","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compressible/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compressible/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compressible/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compressible/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:compressible:compressible:2.0.18:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/compressible@2.0.18","metadataType":"javascript-npm-package","metadata":{"name":"compressible","version":"2.0.18","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com), Jeremiah Senkpiel (https://searchbeam.jit.su)","homepage":"","description":"Compressible Content-Type / mime checking","url":"jshttp/compressible","private":false}},{"id":"828f0284d303f177","name":"compression","version":"1.8.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compression/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compression/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:compression:compression:1.8.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/compression@1.8.1","metadataType":"javascript-npm-package","metadata":{"name":"compression","version":"1.8.1","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com)","homepage":"","description":"Node.js compression middleware","url":"expressjs/compression","private":false}},{"id":"e899cd35e0ecfcf6","name":"concat-map","version":"0.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/concat-map/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-map/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/concat-map/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-map/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:concat-map:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat-map:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_map:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_map:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:substack:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:substack:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/concat-map@0.0.1","metadataType":"javascript-npm-package","metadata":{"name":"concat-map","version":"0.0.1","author":"James Halliday (http://substack.net)","homepage":"","description":"concatenative mapdashery","url":"git://github.com/substack/node-concat-map.git","private":false}},{"id":"3cf686e52af98b9c","name":"concat-stream","version":"1.6.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/concat-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-stream/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/concat-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-stream/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:concat-stream:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat-stream:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_stream:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_stream:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:maxogden:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:maxogden:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/concat-stream@1.6.2","metadataType":"javascript-npm-package","metadata":{"name":"concat-stream","version":"1.6.2","author":"Max Ogden ","homepage":"","description":"writable stream that concatenates strings or binary data and calls a callback with the result","url":"http://github.com/maxogden/concat-stream.git","private":false}},{"id":"f5d30e88e089520d","name":"config","version":"3.3.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/config/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/config/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:node-config:config:3.3.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:config:config:3.3.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/config@3.3.12","metadataType":"javascript-npm-package","metadata":{"name":"config","version":"3.3.12","author":"Loren West ","homepage":"http://github.com/node-config/node-config.git","description":"Configuration control for production node deployments","url":"http://github.com/node-config/node-config.git","private":false}},{"id":"62af6322c8da5d46","name":"console-control-strings","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/console-control-strings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/console-control-strings/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/console-control-strings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/console-control-strings/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:console-control-strings:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console-control-strings:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control_strings:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control_strings:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console-control:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console-control:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/console-control-strings@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"console-control-strings","version":"1.1.0","author":"Rebecca Turner (http://re-becca.org/)","homepage":"","description":"A library of cross-platform tested terminal/console command strings for doing things like color and cursor positioning. This is a subset of both ansi and vt100. All control codes included work on both Windows & Unix-like OSes, except where noted.","url":"https://github.com/iarna/console-control-strings","private":false}},{"id":"64ecabe801d13657","name":"constantinople","version":"4.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/constantinople/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/constantinople/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/constantinople/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/constantinople/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ForbesLindesay:constantinople:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:constantinople:constantinople:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/constantinople@4.0.1","metadataType":"javascript-npm-package","metadata":{"name":"constantinople","version":"4.0.1","author":"ForbesLindesay","homepage":"","description":"Determine whether a JavaScript expression evaluates to a constant","url":"https://github.com/ForbesLindesay/constantinople.git","private":false}},{"id":"6d99ffbaf9a3dbf2","name":"content-disposition","version":"0.5.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/content-disposition/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-disposition/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/content-disposition/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-disposition/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:content-disposition:content-disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content-disposition:content_disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_disposition:content-disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_disposition:content_disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content-disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content_disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/content-disposition@0.5.4","metadataType":"javascript-npm-package","metadata":{"name":"content-disposition","version":"0.5.4","author":"Douglas Christopher Wilson ","homepage":"","description":"Create and parse Content-Disposition header","url":"jshttp/content-disposition","private":false}},{"id":"1e680466175b93f0","name":"content-type","version":"1.0.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/content-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-type/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/content-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-type/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:content-type:content-type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content-type:content_type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_type:content-type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_type:content_type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content-type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content_type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/content-type@1.0.5","metadataType":"javascript-npm-package","metadata":{"name":"content-type","version":"1.0.5","author":"Douglas Christopher Wilson ","homepage":"","description":"Create and parse HTTP Content-Type header","url":"jshttp/content-type","private":false}},{"id":"299182936c2fe78a","name":"cookie","version":"0.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie:cookie:0.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie@0.4.2","metadataType":"javascript-npm-package","metadata":{"name":"cookie","version":"0.4.2","author":"Roman Shtylman , Douglas Christopher Wilson ","homepage":"","description":"HTTP server cookie parsing and serialization","url":"jshttp/cookie","private":false}},{"id":"5f1423a9340f2ecc","name":"cookie","version":"0.7.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/express/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/express/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie:cookie:0.7.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie@0.7.1","metadataType":"javascript-npm-package","metadata":{"name":"cookie","version":"0.7.1","author":"Roman Shtylman , Douglas Christopher Wilson ","homepage":"","description":"HTTP server cookie parsing and serialization","url":"jshttp/cookie","private":false}},{"id":"f30613fbb68ad643","name":"cookie","version":"0.7.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie:cookie:0.7.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie@0.7.2","metadataType":"javascript-npm-package","metadata":{"name":"cookie","version":"0.7.2","author":"Roman Shtylman , Douglas Christopher Wilson ","homepage":"","description":"HTTP server cookie parsing and serialization","url":"jshttp/cookie","private":false}},{"id":"52b0adc8ff09f017","name":"cookie-parser","version":"1.4.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cookie-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cookie-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie-parser:cookie-parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie-parser:cookie_parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie_parser:cookie-parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie_parser:cookie_parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie:cookie-parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie:cookie_parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie-parser@1.4.7","metadataType":"javascript-npm-package","metadata":{"name":"cookie-parser","version":"1.4.7","author":"TJ Holowaychuk (http://tjholowaychuk.com), Douglas Christopher Wilson ","homepage":"","description":"Parse HTTP request cookies","url":"expressjs/cookie-parser","private":false}},{"id":"f7961879936cc1c0","name":"cookie-signature","version":"1.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cookie-signature/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-signature/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cookie-signature/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-signature/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie-signature_project:cookie-signature:1.0.6:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/cookie-signature@1.0.6","metadataType":"javascript-npm-package","metadata":{"name":"cookie-signature","version":"1.0.6","author":"TJ Holowaychuk ","homepage":"","description":"Sign and unsign cookies","url":"https://github.com/visionmedia/node-cookie-signature.git","private":false}},{"id":"84bc1ef1a454e04d","name":"copy-descriptor","version":"0.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/copy-descriptor/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/copy-descriptor/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/copy-descriptor/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/copy-descriptor/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:copy-descriptor:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy-descriptor:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy_descriptor:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy_descriptor:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/copy-descriptor@0.1.1","metadataType":"javascript-npm-package","metadata":{"name":"copy-descriptor","version":"0.1.1","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/copy-descriptor","description":"Copy a descriptor from object A to object B","url":"jonschlinkert/copy-descriptor","private":false}},{"id":"36ced86f8d381680","name":"core-util-is","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/core-util-is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/core-util-is/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/core-util-is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/core-util-is/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:core-util-is:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core-util-is:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util_is:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util_is:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core-util:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core-util:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/core-util-is@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"core-util-is","version":"1.0.2","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"The `util.is*` functions introduced in Node v0.12.","url":"git://github.com/isaacs/core-util-is","private":false}},{"id":"9f4d3a70130c3163","name":"cors","version":"2.8.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cors:cors:2.8.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cors@2.8.5","metadataType":"javascript-npm-package","metadata":{"name":"cors","version":"2.8.5","author":"Troy Goode (https://github.com/troygoode/)","homepage":"","description":"Node.js CORS middleware","url":"expressjs/cors","private":false}},{"id":"5e060917a7b152aa","name":"crc","version":"3.8.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:alexgorbatchev:crc:3.8.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc:crc:3.8.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crc@3.8.0","metadataType":"javascript-npm-package","metadata":{"name":"crc","version":"3.8.0","author":"Alex Gorbatchev (https://github.com/alexgorbatchev)","homepage":"https://github.com/alexgorbatchev/node-crc","description":"Module for calculating Cyclic Redundancy Check (CRC) for Node.js and the Browser.","url":"git://github.com/alexgorbatchev/node-crc.git","private":false}},{"id":"65ce75ba55690187","name":"crc-32","version":"1.2.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crc-32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc-32/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"Apache-2.0","spdxExpression":"Apache-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crc-32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc-32/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:SheetJS:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:SheetJS:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc-32:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc-32:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc_32:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc_32:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crc-32@1.2.2","metadataType":"javascript-npm-package","metadata":{"name":"crc-32","version":"1.2.2","author":"sheetjs","homepage":"https://sheetjs.com/","description":"Pure-JS CRC-32","url":"git://github.com/SheetJS/js-crc32.git","private":false}},{"id":"828196a2c6a9e027","name":"crc32-stream","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crc32-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc32-stream/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crc32-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc32-stream/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:crc32-stream:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32-stream:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32_stream:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32_stream:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crc32-stream@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"crc32-stream","version":"2.0.0","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/node-crc32-stream","description":"a streaming CRC32 checksumer","url":"https://github.com/archiverjs/node-crc32-stream.git","private":false}},{"id":"fbc0fafe2877b078","name":"create-require","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/create-require/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/create-require/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/create-require/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/create-require/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:create-require:create-require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create-require:create_require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create_require:create-require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create_require:create_require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create:create-require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create:create_require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/create-require@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"create-require","version":"1.1.1","author":"Maël Nison , Paul Soporan , Pooya Parsa ","homepage":"","description":"Polyfill for Node.js module.createRequire (<= v12.2.0)","url":"nuxt-contrib/create-require","private":false}},{"id":"28238b546a501760","name":"cross-fetch","version":"4.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cross-fetch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cross-fetch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cross-fetch_project:cross-fetch:4.1.0:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/cross-fetch@4.1.0","metadataType":"javascript-npm-package","metadata":{"name":"cross-fetch","version":"4.1.0","author":"Leonardo Quixada ","homepage":"https://github.com/lquixada/cross-fetch","description":"Universal WHATWG Fetch API for Node, Browsers and React Native","url":"https://github.com/lquixada/cross-fetch.git","private":false}},{"id":"50b42809242de976","name":"cross-fetch-polyfill","version":"0.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cross-fetch-polyfill:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-fetch-polyfill:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch_polyfill:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch_polyfill:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-fetch:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-fetch:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cross-fetch-polyfill@0.0.0","metadataType":"javascript-npm-package","metadata":{"name":"cross-fetch-polyfill","version":"0.0.0","author":"","homepage":"","description":"","url":"","private":false}},{"id":"1b99c2dc3022043f","name":"cross-spawn","version":"7.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cross-spawn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-spawn/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cross-spawn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-spawn/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cross-spawn:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-spawn:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_spawn:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_spawn:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:moxystudio:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:moxystudio:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cross-spawn@7.0.6","metadataType":"javascript-npm-package","metadata":{"name":"cross-spawn","version":"7.0.6","author":"André Cruz ","homepage":"https://github.com/moxystudio/node-cross-spawn","description":"Cross platform child_process#spawn and child_process#spawnSync","url":"git@github.com:moxystudio/node-cross-spawn.git","private":false}},{"id":"c00a8b8b043aae72","name":"crypto-js","version":"3.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crypto-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crypto-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crypto-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crypto-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:crypto-js:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto-js:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto_js:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto_js:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brix:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brix:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crypto-js@3.3.0","metadataType":"javascript-npm-package","metadata":{"name":"crypto-js","version":"3.3.0","author":"Evan Vosberg (http://github.com/evanvosberg)","homepage":"http://github.com/brix/crypto-js","description":"JavaScript library of crypto standards.","url":"http://github.com/brix/crypto-js.git","private":false}},{"id":"a64626d34d414995","name":"dateformat","version":"4.6.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/dateformat/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/dateformat/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/dateformat/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/dateformat/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:dateformat:dateformat:4.6.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:felixge:dateformat:4.6.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/dateformat@4.6.3","metadataType":"javascript-npm-package","metadata":{"name":"dateformat","version":"4.6.3","author":"Steven Levithan, Steven Levithan, Felix Geisendörfer , Christoph Tavan , Jon Schlinkert (https://github.com/jonschlinkert), Felix Geisendörfer ","homepage":"https://github.com/felixge/node-dateformat","description":"A node.js package for Steven Levithan's excellent dateFormat() function.","url":"https://github.com/felixge/node-dateformat.git","private":false}},{"id":"13ce5d31ef865754","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich