Security advisories

Some search results and pulls carry a security_advisories field. It lists published CVE and GHSA identifiers that name the component's repository.

copy"security_advisories": {
  "ids": ["CVE-2025-XXXXX", "GHSA-xxxx-xxxx-xxxx"],
  "scope": "repository",
  "note": "Published advisories naming this repository; check whether they affect this file and version. Not used in ranking."
}

What it means

• An advisory exists that names the repository. It may affect a different file, an older version, or a feature you don't use.
• Check the advisory against the file and version you are pulling before you ship it. Searching the identifier on the GitHub Advisory Database or NVD shows the affected versions.

What it does not mean

• It is not part of the score or the ranking. A repository with advisories is not demoted; we show the warning instead, so you can decide.
• No warning is not a clean bill of health. The field is filled only for repositories we have reputation data for, which today is a small set of widely used projects. Most results have no security_advisories field because we have no data for them, not because they are known to be safe.
• It is not a vulnerability scan of the file itself.

For dependency-level checks after you pull code, keep using your usual tools (npm audit, pip-audit, Dependabot or similar).