supply-chain-guard 5.24.0 → 5.25.0

package/README.md

@@ -131,7 +131,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v5.24.0
+    rev: v5.25.0
     hooks:
       - id: supply-chain-guard
 ```

package/action.yml

@@ -66,7 +66,7 @@ runs:
 
     - name: Install supply-chain-guard
       shell: bash
-      run: npm install -g supply-chain-guard@5.24.0 --ignore-scripts --no-audit --no-fund
+      run: npm install -g supply-chain-guard@5.25.0 --ignore-scripts --no-audit --no-fund
 
     - name: Run scan
       id: scan

package/dist/cli.js

@@ -187,7 +187,7 @@ function assertDistinctOutputPaths(options) {
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.24.0");
+    .version("5.25.0");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/dependency-confusion.js

@@ -49,7 +49,7 @@ const path = __importStar(require("node:path"));
 const https = __importStar(require("node:https"));
 const types_js_1 = require("./types.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
-const TOOL_VERSION = "5.24.0";
+const TOOL_VERSION = "5.25.0";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
 const PYPI_REGISTRY = "https://pypi.org/pypi";

package/dist/npm-scanner.js

@@ -57,7 +57,7 @@ const pattern_scanner_js_1 = require("./pattern-scanner.js");
 const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
 const threat_intel_js_1 = require("./threat-intel.js");
 const install_guard_js_1 = require("./install-guard.js");
-const TOOL_VERSION = "5.24.0";
+const TOOL_VERSION = "5.25.0";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 /** Testable package-coverage contract shared by the network scan path. */
 function recordNpmNoArtifact(findings) {

package/dist/pypi-scanner.js

@@ -56,7 +56,7 @@ const archive_extractor_js_1 = require("./archive-extractor.js");
 const patterns_js_1 = require("./patterns.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
 const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
-const TOOL_VERSION = "5.24.0";
+const TOOL_VERSION = "5.25.0";
 const PYPI_API = "https://pypi.org/pypi";
 class PyPIArtifactAcquisitionError extends Error {
     artifactFilename;

package/dist/reporter.js

@@ -111,7 +111,7 @@ function formatJson(report) {
 function formatText(report) {
     const lines = [];
     // ── layout constants ───────────────────────────────────────────────────────
-    const VERSION = "5.24.0";
+    const VERSION = "5.25.0";
     const W = 76; // visible chars between "│ " and " │" (total line = 80)
     // ── ANSI helpers ───────────────────────────────────────────────────────────
     const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -564,7 +564,7 @@ function formatSarif(report) {
                 tool: {
                     driver: {
                         name: "supply-chain-guard",
-                        version: "5.24.0",
+                        version: "5.25.0",
                         informationUri: "https://github.com/homeofe/supply-chain-guard",
                         rules,
                     },
@@ -654,7 +654,7 @@ function formatSbom(report) {
             timestamp: report.timestamp,
             tools: {
                 components: [
-                    { type: "application", name: "supply-chain-guard", version: "5.24.0" },
+                    { type: "application", name: "supply-chain-guard", version: "5.25.0" },
                 ],
             },
             component: {
@@ -777,7 +777,7 @@ function formatGitlab(report) {
         name: "supply-chain-guard",
         url: "https://github.com/homeofe/supply-chain-guard",
         vendor: { name: "supply-chain-guard" },
-        version: "5.24.0",
+        version: "5.25.0",
     };
     const vulnerabilities = report.findings
         .filter((f) => !f.suppressed)
@@ -1019,7 +1019,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
   ` : ""}
 
   <footer>
-    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.24.0
+    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.25.0
   </footer>
 </div>
 <script>

package/dist/sbom-generator.js

@@ -45,7 +45,7 @@ exports.generateSbomDocument = generateSbomDocument;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
-const TOOL_VERSION = "5.24.0";
+const TOOL_VERSION = "5.25.0";
 /**
  * Build a Package URL (purl) for an npm package.
  */

package/dist/scanner.js

@@ -95,7 +95,7 @@ const slsa_verifier_js_1 = require("./slsa-verifier.js");
 const dependency_confusion_js_1 = require("./dependency-confusion.js");
 const mcp_scanner_js_1 = require("./mcp-scanner.js");
 const skills_scanner_js_1 = require("./skills-scanner.js");
-const TOOL_VERSION = "5.24.0";
+const TOOL_VERSION = "5.25.0";
 /**
  * Exact files that contain this package's own inert detector definitions or
  * regression fixtures.

package/dist/threat-intel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,YAAY,CAAC;AAM7D,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAghND,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAGlD;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAaD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA4CX;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAyFD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAmB/D;AAQD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAwDX;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAwBhB"}
+{"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,YAAY,CAAC;AAM7D,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAypND,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAGlD;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAaD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA4CX;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAyFD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAmB/D;AAQD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAwDX;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAwBhB"}

package/dist/threat-intel.js

@@ -6613,6 +6613,141 @@ const FEED_CHUNK_6 = [
     { type: "package", value: "007007-simple-calculator", severity: "critical", confidence: 1.0, source: "GHSA-x482-c4jh-h74j, MAL-2025-6975", firstSeen: "2026-07-26" },
     { type: "package", value: "01-0redi7qgbz0uv@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-9gg9-73gj-hfrj, MAL-2026-3666", firstSeen: "2026-07-26" },
     { type: "package", value: "0-snap-score318", severity: "critical", confidence: 1.0, source: "GHSA-wh3v-f65r-53cm, MAL-2025-6974", firstSeen: "2026-07-26" },
+    // Imported from GitHub Advisory Database (2026-07-20) - see docs/threat-feed-sources.md
+    { type: "package", value: "veskra", severity: "critical", confidence: 1.0, source: "GHSA-pr2p-6xpw-q8vw, MAL-2026-10984", firstSeen: "2026-07-21" },
+    { type: "package", value: "nolby", severity: "critical", confidence: 1.0, source: "GHSA-x724-q7wp-wx6q, MAL-2026-10980", firstSeen: "2026-07-21" },
+    { type: "package", value: "chai-leaf", severity: "critical", confidence: 1.0, source: "GHSA-m3c7-2j38-rjh7, MAL-2026-10940", firstSeen: "2026-07-21" },
+    { type: "package", value: "chai-as-reddit", severity: "critical", confidence: 1.0, source: "GHSA-vc32-h28h-pmhm, MAL-2026-10939", firstSeen: "2026-07-21" },
+    { type: "package", value: "upjsma", severity: "critical", confidence: 1.0, source: "GHSA-9g67-fm87-8p6v, MAL-2026-10928", firstSeen: "2026-07-20" },
+    { type: "package", value: "iot-kfh-s3", severity: "critical", confidence: 1.0, source: "GHSA-qg52-c79f-3q5c, MAL-2026-10921", firstSeen: "2026-07-20" },
+    { type: "package", value: "lambda-cloudwatch-cdk", severity: "critical", confidence: 1.0, source: "GHSA-m74r-g438-3r92, MAL-2026-10922", firstSeen: "2026-07-20" },
+    { type: "package", value: "s3-lambda-dynamodb-cdk", severity: "critical", confidence: 1.0, source: "GHSA-6xqw-c34f-9275, MAL-2026-10924", firstSeen: "2026-07-20" },
+    { type: "package", value: "alb-lambda-cdk", severity: "critical", confidence: 1.0, source: "GHSA-crmc-3m53-3crf, MAL-2026-10920", firstSeen: "2026-07-20" },
+    { type: "package", value: "lwc-slds-lbc", severity: "critical", confidence: 1.0, source: "GHSA-xm8f-w286-57x5, MAL-2026-10923", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-wxwindows", severity: "critical", confidence: 1.0, source: "GHSA-7qjp-cprm-mcp6, MAL-2026-10862", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-malware-credential-harvesting", severity: "critical", confidence: 1.0, source: "GHSA-89jh-h47r-j47w, MAL-2026-10834", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-typosquat-lodash", severity: "critical", confidence: 1.0, source: "GHSA-2wfp-mw9m-3c6x, MAL-2026-10856", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-malware-cryptomining-indicators", severity: "critical", confidence: 1.0, source: "GHSA-6rh6-pc5p-4j88, MAL-2026-10835", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-typosquat-express", severity: "critical", confidence: 1.0, source: "GHSA-rhf7-542w-5vqq, MAL-2026-10855", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-malware-code-obfuscation", severity: "critical", confidence: 1.0, source: "GHSA-4ch4-g9wf-fg55, MAL-2026-10833", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-ncgl-uk-2-0", severity: "critical", confidence: 1.0, source: "GHSA-cx55-w99m-rcx9, MAL-2026-10841", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-osl-3-0", severity: "critical", confidence: 1.0, source: "GHSA-p5pm-xhx8-3gq6, MAL-2026-10843", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-malware-network-indicators", severity: "critical", confidence: 1.0, source: "GHSA-fcqp-56vj-9g8m, MAL-2026-10837", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-openpbs-2-3", severity: "critical", confidence: 1.0, source: "GHSA-rhgp-gf2p-j7r3, MAL-2026-10842", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-malware-c2-beacon", severity: "critical", confidence: 1.0, source: "GHSA-vmcc-vqgj-wh6c, MAL-2026-10832", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-tapr-ohl-1-0", severity: "critical", confidence: 1.0, source: "GHSA-qrhx-w63c-43gx, MAL-2026-10850", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-copyleft-next-0-3-1", severity: "critical", confidence: 1.0, source: "GHSA-2gc4-3jrf-539r, MAL-2026-10815", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-unlicense", severity: "critical", confidence: 1.0, source: "GHSA-ghmj-68m9-xmgq, MAL-2026-10861", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-ecos-2-0", severity: "critical", confidence: 1.0, source: "GHSA-jhf4-7xww-5wr4, MAL-2026-10817", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-simpl-2-0", severity: "critical", confidence: 1.0, source: "GHSA-r8xp-4267-6m36, MAL-2026-10848", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-copyleft-next-0-3-0", severity: "critical", confidence: 1.0, source: "GHSA-h79m-rf9m-2rw3, MAL-2026-10814", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-typosquat-moment", severity: "critical", confidence: 1.0, source: "GHSA-9mx2-4mpm-2r3j, MAL-2026-10857", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-ucl-1-0", severity: "critical", confidence: 1.0, source: "GHSA-fh2p-2rm7-q273, MAL-2026-10860", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-qpl-1-0-inria-2004", severity: "critical", confidence: 1.0, source: "GHSA-mvwx-9jqh-5qhf, MAL-2026-10846", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-typosquat-axios", severity: "critical", confidence: 1.0, source: "GHSA-7j2p-8vwj-g565, MAL-2026-10852", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-typosquat-commander", severity: "critical", confidence: 1.0, source: "GHSA-qpvx-cv58-6gq8, MAL-2026-10854", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-linux-man-pages-copyleft", severity: "critical", confidence: 1.0, source: "GHSA-xjx5-pj89-q82h, MAL-2026-10831", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-typosquat-webpack", severity: "critical", confidence: 1.0, source: "GHSA-4wcr-8537-v2ww, MAL-2026-10859", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-tpl-1-0", severity: "critical", confidence: 1.0, source: "GHSA-c342-xf26-r5wc, MAL-2026-10851", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-typosquat-chalk", severity: "critical", confidence: 1.0, source: "GHSA-576v-8wcx-4p4q, MAL-2026-10853", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-typosquat-react", severity: "critical", confidence: 1.0, source: "GHSA-rf94-jqj5-mxj3, MAL-2026-10858", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-mpl-2-0", severity: "critical", confidence: 1.0, source: "GHSA-pgj9-qg38-66qm, MAL-2026-10839", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-sspl-1-0", severity: "critical", confidence: 1.0, source: "GHSA-7fmj-6v2f-m56v, MAL-2026-10849", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-sendmail-8-23", severity: "critical", confidence: 1.0, source: "GHSA-9x3r-xqjc-rf4m, MAL-2026-10847", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-polyform-small-business-1-0-0", severity: "critical", confidence: 1.0, source: "GHSA-pj22-8328-xx6m, MAL-2026-10845", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-malware-install-execution", severity: "critical", confidence: 1.0, source: "GHSA-3m93-ccj9-w63p, MAL-2026-10836", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-polyform-noncommercial-1-0-0", severity: "critical", confidence: 1.0, source: "GHSA-q9m9-5h2w-6fqv, MAL-2026-10844", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-mpl-1-1", severity: "critical", confidence: 1.0, source: "GHSA-jq98-3cqm-6m69, MAL-2026-10838", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-ms-lpl", severity: "critical", confidence: 1.0, source: "GHSA-pwfp-vhxq-7g8f, MAL-2026-10840", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-lgpl-3-0", severity: "critical", confidence: 1.0, source: "GHSA-8cfc-7pm7-2wfg, MAL-2026-10830", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-gpl-3-0", severity: "critical", confidence: 1.0, source: "GHSA-rgg7-35hm-9r87, MAL-2026-10825", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-fdk-aac", severity: "critical", confidence: 1.0, source: "GHSA-f352-j467-hh2v, MAL-2026-10823", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cern-ohl-w-2-0", severity: "critical", confidence: 1.0, source: "GHSA-v3g4-vqc2-ww4m, MAL-2026-10813", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-eupl-3-0", severity: "critical", confidence: 1.0, source: "GHSA-8wvp-4p3h-8rcv, MAL-2026-10822", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-gpl-2-0", severity: "critical", confidence: 1.0, source: "GHSA-6f4v-mj95-7hx7, MAL-2026-10824", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-lgpl-2-1", severity: "critical", confidence: 1.0, source: "GHSA-vjr7-6xvw-fjwv, MAL-2026-10829", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-jpl-image", severity: "critical", confidence: 1.0, source: "GHSA-8xvv-j38f-37q4, MAL-2026-10827", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-lgpl-2-0", severity: "critical", confidence: 1.0, source: "GHSA-mphc-8p8q-3qch, MAL-2026-10828", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-hippocratic-2-1", severity: "critical", confidence: 1.0, source: "GHSA-6jrh-cw7q-cchf, MAL-2026-10826", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-eupl-1-2", severity: "critical", confidence: 1.0, source: "GHSA-7mf4-xph8-p3x5, MAL-2026-10821", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-epl-2-0", severity: "critical", confidence: 1.0, source: "GHSA-pcgm-v58j-9h83, MAL-2026-10819", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-eupl-1-1", severity: "critical", confidence: 1.0, source: "GHSA-c537-6552-hchq, MAL-2026-10820", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cdla-sharing-1-0", severity: "critical", confidence: 1.0, source: "GHSA-9xxm-2vjv-vcf8, MAL-2026-10811", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-epl-1-0", severity: "critical", confidence: 1.0, source: "GHSA-rgmq-p9gv-7m9r, MAL-2026-10818", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cern-ohl-s-2-0", severity: "critical", confidence: 1.0, source: "GHSA-cf67-mcc6-xv6g, MAL-2026-10812", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cpol-1-02", severity: "critical", confidence: 1.0, source: "GHSA-j2jx-hj5v-jx3v, MAL-2026-10816", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cddl-1-0", severity: "critical", confidence: 1.0, source: "GHSA-ghq5-9c42-xm6m, MAL-2026-10810", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-nc-nd-3-0-igo", severity: "critical", confidence: 1.0, source: "GHSA-pfff-33jv-92x4, MAL-2026-10798", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-sa-4-0", severity: "critical", confidence: 1.0, source: "GHSA-mwvx-43ff-rfhg, MAL-2026-10809", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-sa-3-0-de", severity: "critical", confidence: 1.0, source: "GHSA-g2mp-g3q3-7rx3, MAL-2026-10808", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-sa-3-0-at", severity: "critical", confidence: 1.0, source: "GHSA-wx6w-h3xq-gw73, MAL-2026-10807", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-sa-2-0-uk", severity: "critical", confidence: 1.0, source: "GHSA-9wg7-9rv7-xv2h, MAL-2026-10805", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-sa-2-1-jp", severity: "critical", confidence: 1.0, source: "GHSA-x637-pr99-2972, MAL-2026-10806", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-nd-3-0-de", severity: "critical", confidence: 1.0, source: "GHSA-66vh-6mm9-hgp5, MAL-2026-10804", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-nc-sa-3-0-igo", severity: "critical", confidence: 1.0, source: "GHSA-jg78-wmg7-h279, MAL-2026-10803", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-fr", severity: "critical", confidence: 1.0, source: "GHSA-gjq7-gh7x-8m2r, MAL-2026-10800", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-uk", severity: "critical", confidence: 1.0, source: "GHSA-7r89-775j-qrf2, MAL-2026-10801", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-nc-sa-3-0-de", severity: "critical", confidence: 1.0, source: "GHSA-9658-ffq5-hx94, MAL-2026-10802", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-de", severity: "critical", confidence: 1.0, source: "GHSA-7rxf-3w7r-p25p, MAL-2026-10799", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-nc-nd-3-0-de", severity: "critical", confidence: 1.0, source: "GHSA-433g-ghwg-9crw, MAL-2026-10797", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-arphic-1999", severity: "critical", confidence: 1.0, source: "GHSA-295j-j4gp-423v, MAL-2026-10790", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cc-by-nc-3-0-de", severity: "critical", confidence: 1.0, source: "GHSA-cjcw-4jj7-mwqr, MAL-2026-10796", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-cal-1-0-combined-work-exception", severity: "critical", confidence: 1.0, source: "GHSA-vjjx-v6cg-9v97, MAL-2026-10795", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-artistic-1-0", severity: "critical", confidence: 1.0, source: "GHSA-gvj6-3qrj-427g, MAL-2026-10791", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-c-uda-1-0", severity: "critical", confidence: 1.0, source: "GHSA-gwc5-9794-fgr2, MAL-2026-10794", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-busl-1-1", severity: "critical", confidence: 1.0, source: "GHSA-x724-cv8r-x29f, MAL-2026-10793", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-base", severity: "critical", confidence: 1.0, source: "GHSA-9qqm-p44x-pmh6, MAL-2026-10792", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-agpl-3-0-or-later", severity: "critical", confidence: 1.0, source: "GHSA-cf53-hv78-9ffv, MAL-2026-10788", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-apsl", severity: "critical", confidence: 1.0, source: "GHSA-67m7-p4w7-8744, MAL-2026-10789", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-agpl-3-0-only", severity: "critical", confidence: 1.0, source: "GHSA-hrqc-mppq-7pr5, MAL-2026-10787", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-agpl-3-0", severity: "critical", confidence: 1.0, source: "GHSA-6ff8-mg9c-x59x, MAL-2026-10786", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-agpl-1-0-or-later", severity: "critical", confidence: 1.0, source: "GHSA-q6xg-rf9w-r3q7, MAL-2026-10785", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-agpl-1-0-only", severity: "critical", confidence: 1.0, source: "GHSA-8rqf-7352-m3m9, MAL-2026-10784", firstSeen: "2026-07-20" },
+    { type: "package", value: "@gocortexio/npmgremlinbox-agpl-1-0", severity: "critical", confidence: 1.0, source: "GHSA-r5w6-4v34-wvg7, MAL-2026-10783", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.1.0", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.1.1", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.1.2", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.1.3", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.2.1", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.3.0", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.4.0", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.4.1", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.4.3", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.4.4", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.4.5", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.4.6", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.4.7", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "uac-package@1.4.8", severity: "critical", confidence: 1.0, source: "GHSA-7cmm-649r-p3q2, MAL-2026-10138", firstSeen: "2026-07-20" },
+    { type: "package", value: "@car_loans/dealerships-approval", severity: "critical", confidence: 1.0, source: "GHSA-p8xg-5qpp-p289, MAL-2026-10397", firstSeen: "2026-07-20" },
+    { type: "package", value: "@tqm-mfe/main", severity: "critical", confidence: 1.0, source: "GHSA-cg4c-94r8-hqjq, MAL-2026-10517", firstSeen: "2026-07-20" },
+    { type: "package", value: "@vite-js/ui", severity: "critical", confidence: 1.0, source: "GHSA-x4cp-w826-x466, MAL-2026-7021", firstSeen: "2026-07-20" },
+    { type: "package", value: "@vite-js/vui", severity: "critical", confidence: 1.0, source: "GHSA-6x4h-wrvq-m68h, MAL-2026-10619", firstSeen: "2026-07-20" },
+    { type: "package", value: "express-ini", severity: "critical", confidence: 1.0, source: "GHSA-w3p6-c3cm-r253, MAL-2026-10505", firstSeen: "2026-07-20" },
+    { type: "package", value: "svgson-lite", severity: "critical", confidence: 1.0, source: "GHSA-g7rx-jhhj-8whr, MAL-2026-6707", firstSeen: "2026-07-20" },
+    { type: "package", value: "next-locomotive-init@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-v4q3-jmq9-q449, MAL-2026-7013", firstSeen: "2026-07-20" },
+    { type: "package", value: "next-locomotive-init@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-v4q3-jmq9-q449, MAL-2026-7013", firstSeen: "2026-07-20" },
+    { type: "package", value: "next-locomotive-init@1.0.2", severity: "critical", confidence: 1.0, source: "GHSA-v4q3-jmq9-q449, MAL-2026-7013", firstSeen: "2026-07-20" },
+    { type: "package", value: "next-locomotive-init@1.0.3", severity: "critical", confidence: 1.0, source: "GHSA-v4q3-jmq9-q449, MAL-2026-7013", firstSeen: "2026-07-20" },
+    { type: "package", value: "next-locomotive-init@1.0.4", severity: "critical", confidence: 1.0, source: "GHSA-v4q3-jmq9-q449, MAL-2026-7013", firstSeen: "2026-07-20" },
+    { type: "package", value: "vybscan-testbed-inert-postinstall", severity: "critical", confidence: 1.0, source: "GHSA-cwcf-rmgg-qg9w, MAL-2026-10078", firstSeen: "2026-07-20" },
+    { type: "package", value: "vybscan-testbed-obfuscated-postinstall", severity: "critical", confidence: 1.0, source: "GHSA-43r2-4jr2-rhjf, MAL-2026-10079", firstSeen: "2026-07-20" },
+    // Imported from GitHub Advisory Database (2026-07-22) - see docs/threat-feed-sources.md
+    { type: "package", value: "@types-beta/sdk@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-j9jc-8h3g-qqrx, MAL-2026-11499", firstSeen: "2026-08-03" },
+    { type: "package", value: "@types-beta/sdk@0.1.1", severity: "critical", confidence: 1.0, source: "GHSA-j9jc-8h3g-qqrx, MAL-2026-11499", firstSeen: "2026-08-03" },
+    { type: "package", value: "@types-beta/sdk@0.1.2", severity: "critical", confidence: 1.0, source: "GHSA-j9jc-8h3g-qqrx, MAL-2026-11499", firstSeen: "2026-08-03" },
+    { type: "package", value: "@types-beta/sdk@0.1.3", severity: "critical", confidence: 1.0, source: "GHSA-j9jc-8h3g-qqrx, MAL-2026-11499", firstSeen: "2026-08-03" },
+    { type: "package", value: "tailwind-anim", severity: "critical", confidence: 0.9, source: "GHSA-7xhc-fvmj-h5xj", firstSeen: "2026-08-03" },
+    { type: "package", value: "@custombots/custombot@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-77jv-xw6r-q246, MAL-2026-11498", firstSeen: "2026-08-03" },
+    { type: "package", value: "list-issue-predecessor-dependencies-block@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-fjgr-3cq9-qxm6, MAL-2026-11430", firstSeen: "2026-08-02" },
+    { type: "package", value: "tailwindcss-anim", severity: "critical", confidence: 1.0, source: "GHSA-m326-xg22-g2fx, MAL-2026-11487", firstSeen: "2026-08-02" },
+    { type: "package", value: "simple-date-formatter-util-2", severity: "critical", confidence: 1.0, source: "GHSA-q43f-5xj6-8v63, MAL-2026-11485", firstSeen: "2026-08-02" },
+    { type: "package", value: "simple-date-formatter-util", severity: "critical", confidence: 1.0, source: "GHSA-q32h-xc3m-rc77, MAL-2026-11483", firstSeen: "2026-08-02" },
+    { type: "package", value: "simple-date-formatter-util-1", severity: "critical", confidence: 1.0, source: "GHSA-mmc7-8pmj-h3xj, MAL-2026-11484", firstSeen: "2026-08-02" },
+    { type: "package", value: "houzidawang808", severity: "critical", confidence: 1.0, source: "GHSA-4qvg-392x-j32q, MAL-2026-5732", firstSeen: "2026-08-02" },
+    { type: "package", value: "houzidawang807", severity: "critical", confidence: 1.0, source: "GHSA-f2g2-48mf-957v, MAL-2026-5731", firstSeen: "2026-08-02" },
+    { type: "package", value: "houzidawang806", severity: "critical", confidence: 1.0, source: "GHSA-7gf8-h22p-4qr4, MAL-2026-5729", firstSeen: "2026-08-02" },
+    { type: "package", value: "pypi:trongriden@0.0.1", severity: "critical", confidence: 1.0, source: "GHSA-fgg6-xq4r-cp2h, MAL-2026-11429", firstSeen: "2026-08-02" },
+    { type: "package", value: "pypi:wacve-utils@1.0.7", severity: "critical", confidence: 1.0, source: "GHSA-6wp2-7xxw-m8c6, MAL-2026-11428", firstSeen: "2026-08-02" },
 ];
 // Composed from the chunks above. A single array literal of this size trips
 // TS2590 ("union type that is too complex to represent") in tsc; splitting it