Target Recon -- Finding High-Quality Audit Targets

When to Use

Starting a new research cycle. Need fresh targets with high CVE potential but low existing researcher attention.

Target Sweet Spot

The ideal target is a package that:

• Is widely used (>100K weekly downloads on npm)
• Handles untrusted input (parsing, validation, file processing)
• Is small enough to audit in a day (< 10K lines of code)
• Has few existing CVEs (< 5)
• Is actively maintained (last commit within 6 months)
• Has 500-15K GitHub stars

Avoid