Skip to content
Log inStart free trial

synckit (npm)

Perform async work synchronously in Node.js/Bun using `worker_threads` with first-class TypeScript and Yarn P'n'P support.

Advisories
3
Latest version
0.12.3
Released Oct 11, 2026
License
MIT
OpenSSF Scorecard
—

How to fix

Upgrading to 0.11.10 or later clears every advisory below that has a fix.

Upgrade commands
npm
npm install synckit@0.12.3
yarn
yarn add synckit@0.12.3
pnpm
pnpm add synckit@0.12.3

Known vulnerabilities

AdvisorySeverityAffectedFixed in
MAL-2025-6026
Malicious code in synckit (npm)
 Not rated yet No fix yet
GHSA-f29h-pxvx-f335
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
Known exploited		 High
EPSS 5.12%
>= 0.11.9, < 0.11.10
0.11.10
GHSA-f29h-pxvx-f335
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
Known exploited		 High
EPSS 5.12%
 No fix yet

Source: https://github.com/un-ts/synckit.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor