Vulnerabilities found

Signed audits AI pre-screen

What the AI fleet's current assessment flagged across the registry — 6 findings. Automated pre-screens, not signed attestations; a re-assessment supersedes its predecessor.

AI fleet status

qwen2.5-7b-instruct

Catalog coverage: 15 / 27 (56%)
Current verdicts: clean 10findings 5inconclusive 0
Total runs: 19
Tokens (cumulative): 91,355
24h budget (PD-10): 11,480 / 2,000,000sweep off

Coverage by ecosystem— an untouched feed here is the PD-10 starvation signal

npm 9/9pypi 5/8cargo 0/4go 0/2maven 0/2nuget 0/1rubygems 1/1

Most recent assessment 2026-08-16

highCWE-502 pypi/transformersAI2026-08-16

torch.load fallback deserializes untrusted checkpoints

src/transformers/modeling_utils.py:3480-3512

mediumCWE-94 pypi/transformersAI2026-08-16

trust_remote_code imports repository-supplied Python

src/transformers/dynamic_module_utils.py:190-205

mediumCWE-400 npm/openaiAI2026-08-16

Unbounded retry amplification on crafted Retry-After

src/core.ts:512-540

mediumCWE-79 npm/expressAI2026-08-15

Error message echoes unsanitized path

lib/response.js:1044-1051

lowCWE-1333 npm/zodAI2026-08-15

Potentially catastrophic backtracking in string-format regex

src/types.ts:611

criticalCWE-506 npm/event-streamAI2026-06-18

Obfuscated payload in injected dependency

node_modules/flatmap-stream/index.min.js:1