pnpm-audit-hook 1.0.0

package/dist/static-db/data/packages/lsof.json

@@ -0,0 +1,26 @@
+{
+  "name": "lsof",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-whq6-mj2r-mjqc",
+      "title": "OS Command Injection in lsof",
+      "description": "All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-whq6-mj2r-mjqc",
+      "publishedAt": "2021-04-13T15:17:53Z",
+      "modifiedAt": "2023-02-01T05:05:14Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-whq6-mj2r-mjqc"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2019-10783"
+        }
+      ],
+      "affectedRange": "<= 0.0.4"
+    }
+  ]
+}

package/dist/static-db/data/packages/lunary.json

@@ -0,0 +1,152 @@
+{
+  "name": "lunary",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-v6x6-4v4x-2fx9",
+      "title": "Withdrawn Advisory: Lunary Cross-Site Request Forgery (CSRF) vulnerability",
+      "description": "## Withdrawn Advisory\nThis advisory has been withdrawn because the [lunary npm package](https://www.npmjs.com/package/lunary) is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory.\n\n**The underlying vulnerability report is still valid**, but it doesn't affect a product in a [GitHub Advisory Database supported ecosystem](https://docs.github.com/en/code-security/security-advisories/working-with-global-security-ad",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-v6x6-4v4x-2fx9",
+      "publishedAt": "2024-09-13T18:31:48Z",
+      "modifiedAt": "2025-06-20T20:02:29Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-v6x6-4v4x-2fx9"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-6862"
+        }
+      ],
+      "affectedRange": "< 1.4.10",
+      "fixedVersion": "1.4.10"
+    },
+    {
+      "id": "GHSA-rpx8-fg6w-rm6x",
+      "title": "Withdrawn Advisory: lunary-ai/lunary XSS in SAML metadata endpoint",
+      "description": "## Withdrawn Advisory\nThis advisory has been withdrawn because the [lunary npm package](https://www.npmjs.com/package/lunary) is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory.\n\n**The underlying vulnerability report is still valid**, but it doesn't affect a product in a [GitHub Advisory Database supported ecosystem](https://docs.github.com/en/code-security/security-advisories/working-with-global-security-ad",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-rpx8-fg6w-rm6x",
+      "publishedAt": "2024-06-06T21:30:37Z",
+      "modifiedAt": "2025-06-20T20:01:58Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-rpx8-fg6w-rm6x"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-5478"
+        }
+      ],
+      "affectedRange": "<= 1.2.7"
+    },
+    {
+      "id": "GHSA-9jmp-j63g-8x6m",
+      "title": "Withdrawn Advisory: Lunary information disclosure vulnerability",
+      "description": "## Withdrawn Advisory\nThis advisory has been withdrawn because the [lunary npm package](https://www.npmjs.com/package/lunary) is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory.\n\n**The underlying vulnerability report is still valid**, but it doesn't affect a product in a [GitHub Advisory Database supported ecosystem](https://docs.github.com/en/code-security/security-advisories/working-with-global-security-ad",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-9jmp-j63g-8x6m",
+      "publishedAt": "2024-09-13T18:31:48Z",
+      "modifiedAt": "2025-06-20T20:01:42Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-9jmp-j63g-8x6m"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-6867"
+        }
+      ],
+      "affectedRange": "< 1.4.10",
+      "fixedVersion": "1.4.10"
+    },
+    {
+      "id": "GHSA-6p2q-8qfq-wq7x",
+      "title": "Withdrawn Advisory: Lunary improper access control vulnerability",
+      "description": "## Withdrawn Advisory\nThis advisory has been withdrawn because the [lunary npm package](https://www.npmjs.com/package/lunary) is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory.\n\n**The underlying vulnerability report is still valid**, but it doesn't affect a product in a [GitHub Advisory Database supported ecosystem](https://docs.github.com/en/code-security/security-advisories/working-with-global-security-ad",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-6p2q-8qfq-wq7x",
+      "publishedAt": "2024-09-13T18:31:48Z",
+      "modifiedAt": "2025-06-20T20:01:25Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-6p2q-8qfq-wq7x"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-6087"
+        }
+      ],
+      "affectedRange": "< 1.4.9",
+      "fixedVersion": "1.4.9"
+    },
+    {
+      "id": "GHSA-w73r-8mm4-cfvf",
+      "title": "Withdrawn Advisory: Lunary Improper Authentication vulnerability",
+      "description": "# Withdrawn Advisory\n\nThis advisory was incorrectly linked the the npm package `lunary`. The advisory is valid, but not for that package.\n\n# Original Advisory\n\nA broken access control vulnerability exists prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-w73r-8mm4-cfvf",
+      "publishedAt": "2024-09-13T18:31:48Z",
+      "modifiedAt": "2024-11-25T16:00:57Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-w73r-8mm4-cfvf"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-6582"
+        }
+      ],
+      "affectedRange": "< 1.4.9",
+      "fixedVersion": "1.4.9"
+    },
+    {
+      "id": "GHSA-3mwc-2cj7-gx8c",
+      "title": "lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management",
+      "description": "Withdrawn: This advisory was incorrectly linked the the npm package `lunary`. The advisory is valid, but not for that package.\n\nIn lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset prompts and their variations against the organization or project of the re",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-3mwc-2cj7-gx8c",
+      "publishedAt": "2024-06-10T00:30:39Z",
+      "modifiedAt": "2024-11-25T15:40:29Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-3mwc-2cj7-gx8c"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-5389"
+        }
+      ],
+      "affectedRange": "< 1.4.9",
+      "fixedVersion": "1.4.9"
+    },
+    {
+      "id": "GHSA-w5xm-mx47-v7c8",
+      "title": "lunary-ai/lunary allows users unauthorized access to projects",
+      "description": "Withdrawn: This advisory was incorrectly linked the the npm package `lunary`. The advisory is valid, but not for that packlage.\n\nIn lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the ",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-w5xm-mx47-v7c8",
+      "publishedAt": "2024-06-08T21:30:38Z",
+      "modifiedAt": "2024-11-18T19:40:41Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-w5xm-mx47-v7c8"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-4146"
+        }
+      ],
+      "affectedRange": "< 1.2.26",
+      "fixedVersion": "1.2.26"
+    }
+  ]
+}

package/dist/static-db/data/packages/lutils.json

@@ -0,0 +1,26 @@
+{
+  "name": "lutils",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-3r8w-mphv-2f3f",
+      "title": "Prototype Pollution in lutils",
+      "description": "All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-3r8w-mphv-2f3f",
+      "publishedAt": "2021-06-21T17:12:25Z",
+      "modifiedAt": "2023-08-17T05:02:30Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-3r8w-mphv-2f3f"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2021-23396"
+        }
+      ],
+      "affectedRange": "<= 2.4.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/luxon.json

@@ -0,0 +1,27 @@
+{
+  "name": "luxon",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-3xq5-wjfh-ppjc",
+      "title": "Luxon Inefficient Regular Expression Complexity vulnerability",
+      "description": "# Impact\nLuxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.\n\nThis is the same bug as Moment's https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g\n\n# Workarounds\nLimit the length of the input.\n\n# References\nThere is an excellent writeup of the same issue in Moment: https:",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-3xq5-wjfh-ppjc",
+      "publishedAt": "2023-01-09T14:10:49Z",
+      "modifiedAt": "2024-02-12T06:30:33Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-3xq5-wjfh-ppjc"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2023-22467"
+        }
+      ],
+      "affectedRange": ">= 1.0.0, < 1.28.1",
+      "fixedVersion": "1.28.1"
+    }
+  ]
+}

package/dist/static-db/data/packages/m.static.json

@@ -0,0 +1,26 @@
+{
+  "name": "m.static",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-vcxh-qvgr-9fw9",
+      "title": "m.static Directory Traversal vulnerability",
+      "description": "All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the `requestFile` function.",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-vcxh-qvgr-9fw9",
+      "publishedAt": "2023-05-10T06:30:27Z",
+      "modifiedAt": "2025-09-26T21:42:22Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-vcxh-qvgr-9fw9"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2023-26126"
+        }
+      ],
+      "affectedRange": "<= 2.2.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/macfromip.json

@@ -0,0 +1,26 @@
+{
+  "name": "macfromip",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-vh8f-xw5v-8993",
+      "title": "Command Injection in macfromip",
+      "description": "All versions of npm package macfromip are affected by a command injection vulnerability. The injection point is located in line 66 in macfromip.js.",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-vh8f-xw5v-8993",
+      "publishedAt": "2021-04-12T19:01:20Z",
+      "modifiedAt": "2023-02-01T05:05:13Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-vh8f-xw5v-8993"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2020-7786"
+        }
+      ],
+      "affectedRange": "<= 1.1.1"
+    }
+  ]
+}

package/dist/static-db/data/packages/madge.json

@@ -0,0 +1,27 @@
+{
+  "name": "madge",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-753c-phhg-cj29",
+      "title": "Madge vulnerable to command injection",
+      "description": "This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which, when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.\n\n### PoC\n```js\nconst madge = require('madge'); \nmadge('..', {graphVizPath: \"touch HELLO;\"}) .then((res) => res.svg()) .then((writtenImagePath) => { console.log('Image written to ' + writtenImagePath); });\n```",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-753c-phhg-cj29",
+      "publishedAt": "2021-03-12T23:01:49Z",
+      "modifiedAt": "2023-09-06T23:33:12Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-753c-phhg-cj29"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2021-23352"
+        }
+      ],
+      "affectedRange": "< 4.0.1",
+      "fixedVersion": "4.0.1"
+    }
+  ]
+}

package/dist/static-db/data/packages/madlib-object-utils.json

@@ -0,0 +1,48 @@
+{
+  "name": "madlib-object-utils",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-jvf5-q4h5-2jmj",
+      "title": "Prototype Pollution in madlib-object-utils",
+      "description": "madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-jvf5-q4h5-2jmj",
+      "publishedAt": "2021-05-06T17:28:57Z",
+      "modifiedAt": "2023-01-27T05:08:30Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-jvf5-q4h5-2jmj"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2020-7701"
+        }
+      ],
+      "affectedRange": "< 0.1.7",
+      "fixedVersion": "0.1.7"
+    },
+    {
+      "id": "GHSA-pfv6-prqm-85q8",
+      "title": "Prototype Pollution in madlib-object-utils",
+      "description": "The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the `setValue` method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-pfv6-prqm-85q8",
+      "publishedAt": "2022-04-16T00:00:26Z",
+      "modifiedAt": "2023-01-27T05:01:35Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-pfv6-prqm-85q8"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2022-24279"
+        }
+      ],
+      "affectedRange": "< 0.1.8",
+      "fixedVersion": "0.1.8"
+    }
+  ]
+}

package/dist/static-db/data/packages/magix-combine-ex.json

@@ -0,0 +1,26 @@
+{
+  "name": "magix-combine-ex",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-cr7h-93fh-whwm",
+      "title": "magix-combine-ex vulnerable to prototype pollution",
+      "description": "A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions through 2.2.2 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.",
+      "severity": "low",
+      "url": "https://github.com/advisories/GHSA-cr7h-93fh-whwm",
+      "publishedAt": "2025-09-24T21:30:37Z",
+      "modifiedAt": "2025-09-25T17:52:43Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-cr7h-93fh-whwm"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-57321"
+        }
+      ],
+      "affectedRange": "<= 2.2.2"
+    }
+  ]
+}

package/dist/static-db/data/packages/maildev.json

@@ -0,0 +1,26 @@
+{
+  "name": "maildev",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-vc6q-ccj9-9r89",
+      "title": "MailDev Remote Code Execution",
+      "description": "MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to `lib/mailserver.js` writing arbitrary code into the `routes.js` file.",
+      "severity": "critical",
+      "url": "https://github.com/advisories/GHSA-vc6q-ccj9-9r89",
+      "publishedAt": "2024-04-05T06:30:46Z",
+      "modifiedAt": "2025-03-14T19:53:03Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-vc6q-ccj9-9r89"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-27448"
+        }
+      ],
+      "affectedRange": ">= 2.0.0-beta1, <= 2.1.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/mailgen.json

@@ -0,0 +1,69 @@
+{
+  "name": "mailgen",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-q4w9-x3rv-4c8j",
+      "title": "Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails",
+      "description": "### Summary\n\nAn HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Projecta are affected if the `Mailgen.generatePlaintext(email)` method is used and passed in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt).\n\n### Details\n\nThe following function (inside index.js) is intended to strip all HTML content to produce a plaintext string.\n\n```javascript\n// Plaintext text e-mail generator\nMailgen.prototype.generat",
+      "severity": "low",
+      "url": "https://github.com/advisories/GHSA-q4w9-x3rv-4c8j",
+      "publishedAt": "2025-10-15T19:29:36Z",
+      "modifiedAt": "2025-10-15T19:29:38Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-q4w9-x3rv-4c8j"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-62380"
+        }
+      ],
+      "affectedRange": "<= 2.0.31",
+      "fixedVersion": "2.0.32"
+    },
+    {
+      "id": "GHSA-xw6r-chmh-vpmj",
+      "title": "Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails",
+      "description": "### Summary\n\nAn HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Your project is affected if you use the `Mailgen.generatePlaintext(email)` method and pass in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt).\n\n### Details\n\nThe following function (inside index.js) is intended to strip all HTML content to produce a plaintext string.\n\n```javascript\n// Plaintext text e-mail generator\nMailgen.prototype.genera",
+      "severity": "low",
+      "url": "https://github.com/advisories/GHSA-xw6r-chmh-vpmj",
+      "publishedAt": "2025-10-14T19:49:56Z",
+      "modifiedAt": "2025-10-14T19:49:57Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-xw6r-chmh-vpmj"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-62366"
+        }
+      ],
+      "affectedRange": "<= 2.0.30",
+      "fixedVersion": "2.0.31"
+    },
+    {
+      "id": "GHSA-j2xj-h7w5-r7vp",
+      "title": "Mailgen: HTML injection vulnerability in plaintext e-mails",
+      "description": "# HTML Injection and XSS Filter Bypass in Plaintext Emails\n\n### Summary\nAn HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Your project is affected if you use the `Mailgen.generatePlaintext(email);` method and pass in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt).\n\n### Vulnerability Analysis\nThe following function (inside `index.js`) is intended to strip all HTML content to produce a plaintext string",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-j2xj-h7w5-r7vp",
+      "publishedAt": "2025-09-22T18:03:47Z",
+      "modifiedAt": "2025-09-23T20:50:37Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-j2xj-h7w5-r7vp"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-59526"
+        }
+      ],
+      "affectedRange": "< 2.0.30",
+      "fixedVersion": "2.0.30"
+    }
+  ]
+}

package/dist/static-db/data/packages/makerjs.json

@@ -0,0 +1,27 @@
+{
+  "name": "makerjs",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-2cp6-34r9-54xx",
+      "title": "Maker.js has Unsafe Property Copying in makerjs.extendObject",
+      "description": "### Summary\nThe `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects.\n\n### Details\nThe `extendObject` function iterates over source object properties using a `for...in` loop without:\n1. Checking `hasOwnProperty()` to exclude",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-2cp6-34r9-54xx",
+      "publishedAt": "2026-01-29T15:18:33Z",
+      "modifiedAt": "2026-01-29T15:18:34Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-2cp6-34r9-54xx"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2026-24888"
+        }
+      ],
+      "affectedRange": "<= 0.19.1",
+      "fixedVersion": "0.19.2"
+    }
+  ]
+}

package/dist/static-db/data/packages/mammoth.json

@@ -0,0 +1,27 @@
+{
+  "name": "mammoth",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-rmjr-87wv-gf87",
+      "title": "Mammoth is vulnerable to Directory Traversal",
+      "description": "Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after rea",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-rmjr-87wv-gf87",
+      "publishedAt": "2025-10-17T06:31:11Z",
+      "modifiedAt": "2025-10-17T17:50:01Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-rmjr-87wv-gf87"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-11849"
+        }
+      ],
+      "affectedRange": ">= 0.3.25, < 1.11.0",
+      "fixedVersion": "1.11.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/manifest.json

@@ -0,0 +1,27 @@
+{
+  "name": "manifest",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-h8h6-7752-g28c",
+      "title": "Manifest Uses a One-Way Hash without a Salt",
+      "description": "### Summary\nManifest employs a weak password hashing implementation that uses SHA3 without a salt. This exposes user passwords to a higher risk of being cracked if an attacker gains access to the database. Without the use of a salt, identical passwords across multiple users will result in the same hash, making it easier for attackers to identify and exploit patterns, thereby accelerating the cracking process.\n\n### Details\nAnalysis of the application source code reveals that user passwords are ha",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-h8h6-7752-g28c",
+      "publishedAt": "2025-03-03T19:55:33Z",
+      "modifiedAt": "2025-03-04T22:23:27Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-h8h6-7752-g28c"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-27408"
+        }
+      ],
+      "affectedRange": "< 4.9.2",
+      "fixedVersion": "4.9.2"
+    }
+  ]
+}

package/dist/static-db/data/packages/mapshaper.json

@@ -0,0 +1,27 @@
+{
+  "name": "mapshaper",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-8m36-62rw-9mxw",
+      "title": "mapshaper Path Traversal vulnerability",
+      "description": "Path Traversal in GitHub repository mbloch/mapshaper prior to 0.6.44.",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-8m36-62rw-9mxw",
+      "publishedAt": "2024-02-13T15:31:12Z",
+      "modifiedAt": "2024-11-04T15:29:00Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-8m36-62rw-9mxw"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-1163"
+        }
+      ],
+      "affectedRange": "< 0.6.44",
+      "fixedVersion": "0.6.44"
+    }
+  ]
+}

package/dist/static-db/data/packages/markdown-it-decorate.json

@@ -0,0 +1,26 @@
+{
+  "name": "markdown-it-decorate",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-rhf5-2378-3w3w",
+      "title": "markdown-it-decorate vulnerable to cross-site scripting (XSS)",
+      "description": "markdown-it-decorate adds attributes, IDs and classes to Markdown, and the most recent version 1.2.2 was published in 2017. All versions are currently vulnerable to cross-site scripting (XSS) and there is no fixed version at this time",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-rhf5-2378-3w3w",
+      "publishedAt": "2022-07-19T14:16:06Z",
+      "modifiedAt": "2023-01-30T05:01:00Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-rhf5-2378-3w3w"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2020-28459"
+        }
+      ],
+      "affectedRange": "<= 1.2.2"
+    }
+  ]
+}