Vulnerable Nodejs — a real shop (NodeBazaar) intentionally full of security bugs. 14 labs, OWASP Top 10:2025, SAST benchmark. Node.js port of DVWA.
cr0hn/vulnerable-node holds a momentum score of 36.1/100 across the tracked cohort. Forks are climbing too, at +0.3/day.
Low breakout odds over the next 14 days, no signal is above the cohort median. Confidence is moderate given the available history.
Reconstructed from 12 snapshots — the time-series GitHub’s API doesn’t expose.
Live score, refreshed every 6 hours. Links back to this page.
[](https://repoclimb.com/repo/cr0hn/vulnerable-node)Transparent heuristic · logged for model training
Percentile rank within the tracked cohort. The score self-calibrates — it answers “accelerating vs. everything else,” not raw size.