ua-parser-js@0.7.30 · scan

HIGHverdict·ua-parser-js@0.7.30just now

4 services exposed · 3 lockfiles resolved the bad version · 5 typosquats nearby.
fix:  pnpm update ua-parser-js@^0.7.30   ▸  breach window 4h 12m

fix command

$ pnpm update ua-parser-js@^0.7.30

https://meridian.sithunyein.com/scan/ua-parser-js%400.7.30

▸ open replay

The six tiles

0ms · hydradb:https://cheap-dawn-noble-located.trycloudflare.com (fixture tiles)

HIGH

4 services exposed

4 rows · 56ms

MATCH (npm:ua-parser-js@0.7.30)<-[:DEPENDS_ON*1..6]-(svc:Service)

service	team	env	hops
checkout-svc	platform	prod	1
web-cdn-edge	checkout	stage	2
geo-redirector	growth	prod	3
billing-svc	billing	prod	4

HIGH

first bad version: 3.10.8

3 rows · 35ms

MATCH (advisory)-[:AFFECTS]->(version) — published timeline

version	published	repo	live_during_compromise
3.10.7	2026-07-12	github.com/TanStack/virtual	false
3.10.8	2026-08-14	github.com/TanStack/virtual	true
3.10.9	2026-08-15	github.com/TanStack/virtual	false

WARN

3 lockfiles resolved this version

3 rows · 45ms

MATCH (Version)<-[:RESOLVES]-(Lockfile)<-[:USES_LOCKFILE]-(Service)

lockfile	service	team	captured	window
apps/web/package-lock.json	checkout-svc	platform	2026-08-11T00:00Z	4h 12m
services/checkout/package-lock.json	web-cdn-edge	checkout	2026-08-12T01:00Z	4h 12m
packages/ui-tw/package-lock.json	geo-redirector	growth	2026-08-13T02:00Z	4h 12m

INFO

3 packages share a maintainer

3 rows · 56ms

MATCH (Maintainer)-[:MAINTAINS]->(sibling) — same-CI clusters collapse

package	ecosystem	monthly_downloads	same_ci
ua-parser	npm	240000	true
node-ua-parser	pypi	223000	false
useragent	npm	206000	false

HIGH

5 typosquat candidates within edit-distance 2

5 rows · 39ms

MATCH (Package)<-[:TYPOSQUAT_OF { distance: 1..2 }]-(candidate)

candidate	edit_distance	first_seen	installs
ua-parser	1	2026-08-10T00:00Z	1280
ua-parserjs	2	2026-08-11T01:00Z	1170
uaparser-js	1	2026-08-12T02:00Z	1060
ua_parser	2	2026-08-13T03:00Z	950
user-agent-parser	1	2026-08-14T04:00Z	840

blast radius: 4 services · 3 lockfiles · 5 typosquats

1 rows · 53ms

AGG services ⊕ lockfiles ⊕ typosquats — 3 optional MATCH arms in one query

services_count	lockfiles_count	typosquats_count
4	3	5

00:00PUBLISHua-parser-js

ua-parser-js@0.7.30 published clean

60:00INSTALL

+dependency.added chalk-extra 0.0.1

120:00PUBLISHua-parser-js

ua-parser-js@0.7.30 rebuilt with payload

180:00ALERT

typosquat install spike 240× chalk-extras

240:00INSTALL

co-maintainer vit-dev-bot 12 ops/min

300:00LOCKFILE

3 lockfiles × 4 services resolved the bad version

360:00GUARD

breach window 4h 12m push guard ⚑

ua-parser-js exposure.