How AI Agents Found Vulnerabilities in Popular npm Packages
A three-week methodology validation. Claude Opus, applied systematically to popular npm packages, surfaced 73 findings and disclosed vulnerabilities across packages with 55M+ weekly downloads. Here is how the workflow operates.
In early March 2026 we ran a methodology validation. Point an AI agent, Claude Opus, at popular npm packages and audit them for security vulnerabilities. Not a linter pass. The agent reads source code front to back, traces how data flows, finds trust-boundary violations, and writes working proof-of-concept exploits.
Three weeks. 73 security findings across dozens of packages, and disclosed vulnerabilities in npm packages with a combined download count over 55 million per week.
The Workflow
The process is methodical, which is where AI agents excel. The pipeline for each target:
Step 1: Target selection
Pick a package by download count, attack surface (does it parse untrusted input, handle crypto, process URLs?), and history of prior vulnerabilities. High downloads plus complex parsing logic is the sweet spot.
Step 2: Source code review
The agent reads the source front to back. Not skimming, reading. It maps entry points, traces how user input flows through the system, finds trust boundaries, and flags patterns that historically lead to vulnerabilities: unvalidated input, missing bounds checks, string concatenation in security-sensitive contexts.
Step 3: Verification
Every finding gets a working proof of concept. If the agent cannot write a PoC that demonstrates the vulnerability, the finding is discarded. Working exploits or nothing.
Step 4: Disclosure
Responsible disclosure through GitHub Security Advisories or direct maintainer contact. Full writeup, PoC code, suggested fix, 90-day timeline. Then wait.
That is the entire system. No proprietary scanning engine. No signature database. An AI agent that reads code the way a security researcher reads code, except it does not get tired, does not skip the boring parts, and processes an entire codebase in minutes.
What It Found
Highlights below. Each has a full writeup on doruk.ch with technical details, PoCs, and disclosure timelines.
node-forge: certificate forgery (CVE-2026-33896)
32 million weekly downloads. The core certificate chain verification logic had a conditional that only validated basicConstraints when the extension was present. When absent, which is normal for end-entity certificates, any certificate could act as a CA. One conditional. A billion yearly downloads. Certificate forgery for any domain.
mysql2: connection override and three more (4 findings)
5 million weekly downloads. URL query parameters could override the host, disable TLS, and enable multi-statement queries. Plus prototype pollution, geometry parsing DoS, and an out-of-bounds read in packet framing. Four vulnerabilities that chain together: redirect the connection, then crash the client. The maintainer shipped all four fixes in 24 hours.
Uptime Kuma / LiquidJS: SSTI bypass (CVE-2026-33130)
A previously “patched” SSTI vulnerability was still exploitable. The entire security boundary, three separate mitigations, fell to removing two quote characters from the payload. The root cause was in LiquidJS’s require.resolve() fallback, which had no path containment checks. Four independent researchers found the same bug through different vectors.
jsPDF: PDF injection and XSS (CVE-2026-31898 / CVE-2026-31938)
Arbitrary PDF object injection via unsanitized annotation color parameters. Plus HTML injection through document.write() in output methods, CVSS 9.6 Critical. Another researcher reported first; an independent rediscovery contributed defense-in-depth hardening to the fixes.
Why AI Agents Are Effective at This
The common thread across these findings: they are not sophisticated. A missing conditional check. An unfiltered URL parameter. A fallback code path with no validation. A string concatenation where there should be DOM construction. These are the kind of bugs that exist because nobody sat down and read the code carefully enough, not zero-days requiring months of reverse engineering.
That is what AI agents are good at. The tedious, methodical work of reading every function, tracing every input, checking every assumption. A human researcher fatigues after a few hours of source review. An AI agent gives the last file the same attention as the first.
The key insight: thoroughness matters more than creativity. Creativity helps for novel attack classes, but most real-world vulnerabilities are variants of known patterns: missing validation, improper access control, trust boundary violations. An agent that systematically checks for those patterns across an entire codebase surfaces things humans miss through fatigue or oversight.
73 Findings: the numbers
After three weeks of running this workflow across popular npm packages, the totals:
- 73 total findings across dozens of packages
- Disclosed vulnerabilities in node-forge, mysql2, Uptime Kuma, LiquidJS, jsPDF, and paperclip. Published as CVEs (node-forge, LiquidJS, Uptime Kuma; jsPDF co-reported with another researcher), as a GHSA without a CVE (paperclip), and as a fix without a public id (mysql2)
- 55M+ weekly npm downloads affected (node-forge, jsPDF, mysql2, LiquidJS); Uptime Kuma adds 152M Docker pulls and paperclip 60k+ GitHub stars on top
- Every finding verified with a working proof of concept
Not every finding became a CVE. Some were lower severity, some were in packages with smaller install bases, some were reported but not yet disclosed. Every single one was verified with a working exploit before it was reported. Working code or it did not count.
From Manual Workflow to a Repeatable Engine
The workflow worked. It was also manual. Each audit required setup, agent configuration, output management, finding tracking, report writing. Repeatable, but operator-bound.
The next step was to automate it.
That is what 0sec’s engine is. The same agentic pipeline: discover, attack, verify, report. Point it at an npm package, an LLM API, an MCP server, or a source code repository. It runs autonomous AI agents in sequence, each specialized for a phase of the assessment. The verification agent independently re-exploits every finding. If it cannot reproduce, the finding is killed.
The disclosed vulnerabilities are the evidence that the approach works. 0sec’s research pipeline is what makes it accessible.
Most teams ship software that depends on open-source packages. These vulnerabilities are already in the dependency tree. The only question is whether the team finds them before someone else does.