Target Recon -- Finding High-Quality Audit Targets

When to Use

Starting a new research cycle. Need fresh targets with high CVE potential but low existing researcher attention.

Target Sweet Spot

The ideal target is a package that:

• Is widely used (>100K weekly downloads on npm)
• Handles untrusted input (parsing, validation, file processing)
• Is small enough to audit in a day (< 10K lines of code)
• Has few existing CVEs (< 5)
• Is actively maintained (last commit within 6 months)
• Has 500-15K GitHub stars

Avoid

• Mega-packages (lodash, axios, moment, express, django, rails) -- too many researchers
• Full frameworks (Next.js, Nuxt, Laravel) -- too large, too audited
• >20K stars AND >10 prior CVEs -- over-audited territory
• Abandoned packages (no commits in 2+ years) -- CVE may not be assigned
• Alpha/beta packages -- maintainer may not issue CVE

Search Strategies

npm Search

# Search by category
npm search xml parser
npm search csv parse
npm search template engine
npm search file upload
npm search schema validator

# Check weekly downloads on npmjs.com
# Look for packages with 100K-10M weekly downloads

GitHub Search

# Search repos by language and star count
gh search repos "xml parser" --language javascript --stars 500..15000
gh search repos "yaml" --language python --stars 500..10000
gh search repos "template engine" --language javascript --stars 500..15000
gh search repos "archive extract" --language go --stars 500..10000

grep.app (Cross-Repo Code Search)

Search for vulnerable patterns across many repos:

https://grep.app/search?q=new%20Function&regexp=false&filter[lang][0]=JavaScript
https://grep.app/search?q=eval%28&regexp=false&filter[lang][0]=JavaScript

Libraries.io

Check dependency counts -- packages depended on by many other packages have higher impact.

Category-Based Targeting

Highest Yield Categories

Category	Vulnerability Classes	Example Packages
Parsing (XML/CSV/YAML)	Entity expansion, ReDoS, clobbering	fast-xml-parser, csv-parse, js-yaml
Validation/Schema	Code injection, ReDoS, proto pollution	ajv, joi, fastest-validator
Template Engines	SSTI, code injection	ejs, nunjucks, handlebars, pug
Archive/Compression	Zip Slip, decompression bomb, path traversal	adm-zip, decompress, fflate
File Handling	Path traversal, symlink attacks	express-fileupload, formidable
Deep Merge/Clone	Proto pollution, recursion DoS	deepmerge, rfdc, klona
Expression Evaluators	Sandbox escape, code injection	simpleeval, expr-eval, filtrex
HTTP Clients	SSRF, header injection, auth leak	got, superagent, needle
Serialization	Clobbering, code injection, recursion	flatted, superjson, msgpackr
URL/Path Utilities	SSRF bypass, path traversal	url-parse, normalize-url

Evaluation Process

For each candidate:

1. Check Registry: Is it already in REGISTRY.md?
2. Check NVD: Search for existing CVEs
3. Check GitHub Advisories: Look at security tab
4. Read README: Does it warn about untrusted input?
5. Check SECURITY.md: Does the project accept security reports?
6. Read recent CHANGELOG: Any "security fix" entries? (incomplete patches are goldmines)
7. Check HackerOne/bug bounty: Bonus, not required
8. Estimate attack surface: What untrusted input does it process?
9. Match to vuln classes: Which skills apply?

Brief Template

Write a brief for each approved target:

# Target Brief: [package-name]

- **GitHub**: [URL]
- **Stars**: [count]
- **Weekly Downloads**: [count]
- **Last Commit**: [date]
- **Language**: [JS/Python/Go/etc.]

## Attack Surface
- [What untrusted input does it process?]

## Existing CVEs
- [none / list with CVE IDs]

## Bug Bounty
- [yes/no + link]

## Top 3 Vectors
1. [Most likely vulnerability class + why]
2. [Second most likely]
3. [Third most likely]

## Why Promising
[1-2 sentences on why this target is worth investigating]

References

• Parallel Scanning -- Batch evaluation methodology
• Search Queries -- Pre-built search queries by category