supply-chain-guard 5.25.11 → 5.25.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +1 -1
  2. package/action.yml +1 -1
  3. package/dist/cli.js +1 -1
  4. package/dist/dependency-confusion.js +1 -1
  5. package/dist/npm-scanner.js +1 -1
  6. package/dist/pypi-scanner.js +1 -1
  7. package/dist/reporter.js +5 -5
  8. package/dist/sbom-generator.js +1 -1
  9. package/dist/scanner.js +1 -1
  10. package/dist/threat-intel.d.ts.map +1 -1
  11. package/dist/threat-intel.js +94 -0
  12. package/dist/threat-intel.js.map +1 -1
  13. package/dist/vscode-scanner.js +1 -1
  14. package/package.json +1 -1
package/README.md CHANGED
@@ -131,7 +131,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
131
131
  ```yaml
132
132
  repos:
133
133
  - repo: https://github.com/homeofe/supply-chain-guard
134
- rev: v5.25.11
134
+ rev: v5.25.12
135
135
  hooks:
136
136
  - id: supply-chain-guard
137
137
  ```
package/action.yml CHANGED
@@ -66,7 +66,7 @@ runs:
66
66
 
67
67
  - name: Install supply-chain-guard
68
68
  shell: bash
69
- run: npm install -g supply-chain-guard@5.25.11 --ignore-scripts --no-audit --no-fund
69
+ run: npm install -g supply-chain-guard@5.25.12 --ignore-scripts --no-audit --no-fund
70
70
 
71
71
  - name: Run scan
72
72
  id: scan
package/dist/cli.js CHANGED
@@ -187,7 +187,7 @@ function assertDistinctOutputPaths(options) {
187
187
  program
188
188
  .name("supply-chain-guard")
189
189
  .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
190
- .version("5.25.11");
190
+ .version("5.25.12");
191
191
  // ── scan command ────────────────────────────────────────────────────
192
192
  program
193
193
  .command("scan")
package/dist/dependency-confusion.js CHANGED
@@ -49,7 +49,7 @@ const path = __importStar(require("node:path"));
49
49
  const https = __importStar(require("node:https"));
50
50
  const types_js_1 = require("./types.js");
51
51
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
52
- const TOOL_VERSION = "5.25.11";
52
+ const TOOL_VERSION = "5.25.12";
53
53
  const NPM_REGISTRY = "https://registry.npmjs.org";
54
54
  const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
55
55
  const PYPI_REGISTRY = "https://pypi.org/pypi";
package/dist/npm-scanner.js CHANGED
@@ -61,7 +61,7 @@ const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
61
61
  const threat_intel_js_1 = require("./threat-intel.js");
62
62
  const install_guard_js_1 = require("./install-guard.js");
63
63
  const remote_download_js_1 = require("./remote-download.js");
64
- const TOOL_VERSION = "5.25.11";
64
+ const TOOL_VERSION = "5.25.12";
65
65
  const NPM_REGISTRY = "https://registry.npmjs.org";
66
66
  const NPM_REGISTRY_HOST = "registry.npmjs.org";
67
67
  const RAW_GITHUB_HOST = "raw.githubusercontent.com";
package/dist/pypi-scanner.js CHANGED
@@ -56,7 +56,7 @@ const patterns_js_1 = require("./patterns.js");
56
56
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
57
57
  const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
58
58
  const remote_download_js_1 = require("./remote-download.js");
59
- const TOOL_VERSION = "5.25.11";
59
+ const TOOL_VERSION = "5.25.12";
60
60
  const PYPI_API = "https://pypi.org/pypi";
61
61
  const PYPI_METADATA_HOST = "pypi.org";
62
62
  const PYPI_ARTIFACT_HOST = "files.pythonhosted.org";
package/dist/reporter.js CHANGED
@@ -111,7 +111,7 @@ function formatJson(report) {
111
111
  function formatText(report) {
112
112
  const lines = [];
113
113
  // ── layout constants ───────────────────────────────────────────────────────
114
- const VERSION = "5.25.11";
114
+ const VERSION = "5.25.12";
115
115
  const W = 76; // visible chars between "│ " and " │" (total line = 80)
116
116
  // ── ANSI helpers ───────────────────────────────────────────────────────────
117
117
  const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -564,7 +564,7 @@ function formatSarif(report) {
564
564
  tool: {
565
565
  driver: {
566
566
  name: "supply-chain-guard",
567
- version: "5.25.11",
567
+ version: "5.25.12",
568
568
  informationUri: "https://github.com/homeofe/supply-chain-guard",
569
569
  rules,
570
570
  },
@@ -654,7 +654,7 @@ function formatSbom(report) {
654
654
  timestamp: report.timestamp,
655
655
  tools: {
656
656
  components: [
657
- { type: "application", name: "supply-chain-guard", version: "5.25.11" },
657
+ { type: "application", name: "supply-chain-guard", version: "5.25.12" },
658
658
  ],
659
659
  },
660
660
  component: {
@@ -777,7 +777,7 @@ function formatGitlab(report) {
777
777
  name: "supply-chain-guard",
778
778
  url: "https://github.com/homeofe/supply-chain-guard",
779
779
  vendor: { name: "supply-chain-guard" },
780
- version: "5.25.11",
780
+ version: "5.25.12",
781
781
  };
782
782
  const vulnerabilities = report.findings
783
783
  .filter((f) => !f.suppressed)
@@ -1019,7 +1019,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
1019
1019
  ` : ""}
1020
1020
 
1021
1021
  <footer>
1022
- Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.25.11
1022
+ Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.25.12
1023
1023
  </footer>
1024
1024
  </div>
1025
1025
  <script>
package/dist/sbom-generator.js CHANGED
@@ -45,7 +45,7 @@ exports.generateSbomDocument = generateSbomDocument;
45
45
  const fs = __importStar(require("node:fs"));
46
46
  const path = __importStar(require("node:path"));
47
47
  const node_crypto_1 = require("node:crypto");
48
- const TOOL_VERSION = "5.25.11";
48
+ const TOOL_VERSION = "5.25.12";
49
49
  /**
50
50
  * Build a Package URL (purl) for an npm package.
51
51
  */
package/dist/scanner.js CHANGED
@@ -95,7 +95,7 @@ const slsa_verifier_js_1 = require("./slsa-verifier.js");
95
95
  const dependency_confusion_js_1 = require("./dependency-confusion.js");
96
96
  const mcp_scanner_js_1 = require("./mcp-scanner.js");
97
97
  const skills_scanner_js_1 = require("./skills-scanner.js");
98
- const TOOL_VERSION = "5.25.11";
98
+ const TOOL_VERSION = "5.25.12";
99
99
  /**
100
100
  * Exact files that contain this package's own inert detector definitions or
101
101
  * regression fixtures.
package/dist/threat-intel.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,YAAY,CAAC;AAM7D,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAu6WF,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAGlD;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAaD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA+CX;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAwBhB"}
1
+ {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,YAAY,CAAC;AAM7D,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAsgXF,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAGlD;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAaD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA+CX;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAwBhB"}
package/dist/threat-intel.js CHANGED
@@ -11590,6 +11590,100 @@ const FEED_CHUNK_11 = [
11590
11590
  // Flooding Dropper TXT-record control channel, sibling label to the dl[.] download
11591
11591
  // hosts already tracked in this feed. Single-source (The Hacker News), hence 0.85.
11592
11592
  { type: "domain", value: "c.wel1.ru", severity: "critical", confidence: 0.85, family: "WEL1DROPPER", campaign: "Flooding Dropper", source: "The Hacker News", firstSeen: "2026-08-07" },
11593
+ // Imported from GitHub Advisory Database (2026-07-29) - see docs/threat-feed-sources.md
11594
+ { type: "package", value: "camelot-ammv2-core", severity: "critical", confidence: 1.0, source: "GHSA-j6vj-qx8g-mv2c, MAL-2026-13772", firstSeen: "2026-08-12" },
11595
+ { type: "package", value: "camelot-ammv2-periphery", severity: "critical", confidence: 1.0, source: "GHSA-m3cv-6763-2mrv, MAL-2026-13773", firstSeen: "2026-08-12" },
11596
+ { type: "package", value: "@telekom-ods/react-ui-kit@2.6.9", severity: "critical", confidence: 1.0, source: "GHSA-7hwp-8qhg-wfmp, MAL-2026-13770", firstSeen: "2026-08-12" },
11597
+ { type: "package", value: "boring-vault", severity: "critical", confidence: 1.0, source: "GHSA-2hm3-fxxw-fwgw, MAL-2026-13771", firstSeen: "2026-08-12" },
11598
+ { type: "package", value: "internallib_v164", severity: "critical", confidence: 1.0, source: "GHSA-3qvf-g7pq-m3m3, MAL-2026-13764", firstSeen: "2026-08-11" },
11599
+ { type: "package", value: "tsihealth-client", severity: "critical", confidence: 1.0, source: "GHSA-jcwv-5jc7-grp5, MAL-2026-13404", firstSeen: "2026-08-11" },
11600
+ { type: "package", value: "base65-33x@5.0.2", severity: "critical", confidence: 1.0, source: "GHSA-q6wg-mgq7-rq2h, MAL-2026-13749", firstSeen: "2026-08-11" },
11601
+ { type: "package", value: "base65-15x@5.0.2", severity: "critical", confidence: 1.0, source: "GHSA-m962-7hqx-p4h8, MAL-2026-13748", firstSeen: "2026-08-11" },
11602
+ { type: "package", value: "dependencyfsdsfdsfg@99.9.0", severity: "critical", confidence: 1.0, source: "GHSA-5928-vc2p-hrqj, MAL-2026-13754", firstSeen: "2026-08-11" },
11603
+ { type: "package", value: "ghazaly@99.9.0", severity: "critical", confidence: 1.0, source: "GHSA-2j9m-4gmh-3m8p, MAL-2026-13755", firstSeen: "2026-08-11" },
11604
+ { type: "package", value: "base65-13x@5.0.2", severity: "critical", confidence: 1.0, source: "GHSA-pm9q-qccp-rj4g, MAL-2026-13747", firstSeen: "2026-08-11" },
11605
+ { type: "package", value: "chapters-core@9.999.999", severity: "critical", confidence: 1.0, source: "GHSA-f5jm-mx92-p845, MAL-2026-13752", firstSeen: "2026-08-11" },
11606
+ { type: "package", value: "base65-11x@5.0.2", severity: "critical", confidence: 1.0, source: "GHSA-7ww3-26rx-3cpf, MAL-2026-13745", firstSeen: "2026-08-11" },
11607
+ { type: "package", value: "base65-77x@5.0.2", severity: "critical", confidence: 1.0, source: "GHSA-72rx-9qc9-2c73, MAL-2026-13750", firstSeen: "2026-08-11" },
11608
+ { type: "package", value: "dcfarguscert@999.0.1", severity: "critical", confidence: 1.0, source: "GHSA-mf24-fh58-62x2, MAL-2026-13753", firstSeen: "2026-08-11" },
11609
+ { type: "package", value: "bjm-low-code-components@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-r8w4-qgmq-q94q, MAL-2026-13751", firstSeen: "2026-08-11" },
11610
+ { type: "package", value: "base65-12x@5.0.2", severity: "critical", confidence: 1.0, source: "GHSA-q6r6-qrfx-v3wp, MAL-2026-13746", firstSeen: "2026-08-11" },
11611
+ { type: "package", value: "pypi:telebot-pro@2.3.7", severity: "critical", confidence: 1.0, source: "GHSA-x78w-5mq6-pmpg, MAL-2026-13757", firstSeen: "2026-08-11" },
11612
+ { type: "package", value: "pypi:telebot-pro@2.3.8", severity: "critical", confidence: 1.0, source: "GHSA-x78w-5mq6-pmpg, MAL-2026-13757", firstSeen: "2026-08-11" },
11613
+ { type: "package", value: "@dgn-src-click-to-pay-org/srcdcfreleasecert@999.0.1", severity: "critical", confidence: 1.0, source: "GHSA-hfmm-qxg4-g578, MAL-2026-13744", firstSeen: "2026-08-11" },
11614
+ { type: "package", value: "pypi:joule-sbx-poc@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-w944-rwh6-xhj2, MAL-2026-13756", firstSeen: "2026-08-11" },
11615
+ { type: "package", value: "zeal-rq-hooks@0.0.0", severity: "critical", confidence: 1.0, source: "GHSA-62m8-8rfw-gv5v, MAL-2026-13742", firstSeen: "2026-08-11" },
11616
+ { type: "package", value: "whs4_ued@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-v5xx-cpfg-4c3j, MAL-2026-13743", firstSeen: "2026-08-11" },
11617
+ { type: "package", value: "svelte-vim-kit", severity: "critical", confidence: 1.0, source: "GHSA-rvh4-87p7-h5pm, MAL-2026-13769", firstSeen: "2026-08-11" },
11618
+ { type: "package", value: "kit-vim-map", severity: "critical", confidence: 1.0, source: "GHSA-mj69-vr76-h2mq, MAL-2026-13740", firstSeen: "2026-08-11" },
11619
+ { type: "package", value: "sui-gql-client", severity: "critical", confidence: 1.0, source: "GHSA-2ggf-86xw-xjp5, MAL-2026-13768", firstSeen: "2026-08-11" },
11620
+ { type: "package", value: "sui-bcs-codec", severity: "critical", confidence: 1.0, source: "GHSA-2wqc-3243-4hxm, MAL-2026-13767", firstSeen: "2026-08-11" },
11621
+ { type: "package", value: "bs58-13", severity: "critical", confidence: 1.0, source: "GHSA-72pr-qcvq-fgpg, MAL-2026-13760", firstSeen: "2026-08-11" },
11622
+ { type: "package", value: "base65-13x", severity: "critical", confidence: 1.0, source: "GHSA-fp83-xcpx-v3qm, MAL-2026-13747", firstSeen: "2026-08-11" },
11623
+ { type: "package", value: "bs58-12", severity: "critical", confidence: 1.0, source: "GHSA-x9c8-g63x-mh7q, MAL-2026-13759", firstSeen: "2026-08-11" },
11624
+ { type: "package", value: "base65-12x", severity: "critical", confidence: 1.0, source: "GHSA-c4w7-m3hx-xx75, MAL-2026-13746", firstSeen: "2026-08-11" },
11625
+ { type: "package", value: "bs58-11", severity: "critical", confidence: 1.0, source: "GHSA-mw39-7442-3p8m, MAL-2026-13758", firstSeen: "2026-08-11" },
11626
+ { type: "package", value: "base65-11x", severity: "critical", confidence: 1.0, source: "GHSA-39c6-h85q-hpcw, MAL-2026-13745", firstSeen: "2026-08-11" },
11627
+ { type: "package", value: "dakumangalsingh_virus@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-ppp3-vpgx-2v73, MAL-2026-13761", firstSeen: "2026-08-11" },
11628
+ { type: "package", value: "dakumangalsingh_virus@1.2.0", severity: "critical", confidence: 1.0, source: "GHSA-ppp3-vpgx-2v73, MAL-2026-13761", firstSeen: "2026-08-11" },
11629
+ { type: "package", value: "dakumangalsingh_virus@1.3.0", severity: "critical", confidence: 1.0, source: "GHSA-ppp3-vpgx-2v73, MAL-2026-13761", firstSeen: "2026-08-11" },
11630
+ { type: "package", value: "ethereum-vault-connector@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-4c5m-f9mr-jxrp, MAL-2026-13739", firstSeen: "2026-08-11" },
11631
+ { type: "package", value: "ethereum-vault-connector@1.1.0", severity: "critical", confidence: 1.0, source: "GHSA-4c5m-f9mr-jxrp, MAL-2026-13739", firstSeen: "2026-08-11" },
11632
+ { type: "package", value: "ethereum-vault-connector@1.1.1", severity: "critical", confidence: 1.0, source: "GHSA-4c5m-f9mr-jxrp, MAL-2026-13739", firstSeen: "2026-08-11" },
11633
+ { type: "package", value: "ethereum-vault-connector", severity: "critical", confidence: 1.0, source: "GHSA-4c5m-f9mr-jxrp, MAL-2026-13739", firstSeen: "2026-08-11" },
11634
+ { type: "package", value: "@aerodrome-finance/contracts@1.1.0", severity: "critical", confidence: 1.0, source: "GHSA-wj9v-gmm3-32pv, MAL-2026-13734", firstSeen: "2026-08-11" },
11635
+ { type: "package", value: "@aerodrome-finance/contracts@1.1.1", severity: "critical", confidence: 1.0, source: "GHSA-wj9v-gmm3-32pv, MAL-2026-13734", firstSeen: "2026-08-11" },
11636
+ { type: "package", value: "@aerodrome-finance/contracts@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-wj9v-gmm3-32pv, MAL-2026-13734", firstSeen: "2026-08-11" },
11637
+ { type: "package", value: "@aerodrome-finance/contracts", severity: "critical", confidence: 1.0, source: "GHSA-wj9v-gmm3-32pv, MAL-2026-13734", firstSeen: "2026-08-11" },
11638
+ { type: "package", value: "safe-local-env-loader@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-4g37-2gh5-825v, MAL-2026-13741", firstSeen: "2026-08-11" },
11639
+ { type: "package", value: "@aerodrome-finance/slipstream@1.1.0", severity: "critical", confidence: 1.0, source: "GHSA-p457-j9cc-cpmp, MAL-2026-13735", firstSeen: "2026-08-11" },
11640
+ { type: "package", value: "@aerodrome-finance/slipstream@1.1.1", severity: "critical", confidence: 1.0, source: "GHSA-p457-j9cc-cpmp, MAL-2026-13735", firstSeen: "2026-08-11" },
11641
+ { type: "package", value: "@aerodrome-finance/slipstream@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-p457-j9cc-cpmp, MAL-2026-13735", firstSeen: "2026-08-11" },
11642
+ { type: "package", value: "@aerodrome-finance/slipstream", severity: "critical", confidence: 1.0, source: "GHSA-p457-j9cc-cpmp, MAL-2026-13735", firstSeen: "2026-08-11" },
11643
+ { type: "package", value: "@openzeppelin-5/contracts@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-3px4-879m-x8q7, MAL-2026-13738", firstSeen: "2026-08-11" },
11644
+ { type: "package", value: "@openzeppelin-5/contracts@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-3px4-879m-x8q7, MAL-2026-13738", firstSeen: "2026-08-11" },
11645
+ { type: "package", value: "@openzeppelin-4/contracts@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-g472-m8m8-w6h3, MAL-2026-13737", firstSeen: "2026-08-11" },
11646
+ { type: "package", value: "@openzeppelin-4/contracts@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-g472-m8m8-w6h3, MAL-2026-13737", firstSeen: "2026-08-11" },
11647
+ { type: "package", value: "@nzeros/codebreak@1.3.0", severity: "critical", confidence: 1.0, source: "GHSA-jwj4-j62g-2xg8, MAL-2026-13736", firstSeen: "2026-08-11" },
11648
+ { type: "package", value: "vite-svg-parse", severity: "critical", confidence: 1.0, source: "GHSA-v7x8-w6xp-6mv4, MAL-2026-13464", firstSeen: "2026-08-11" },
11649
+ { type: "package", value: "node-internal-svg-loader", severity: "critical", confidence: 1.0, source: "GHSA-9rgf-6m2p-q73f, MAL-2026-13766", firstSeen: "2026-08-11" },
11650
+ { type: "package", value: "tilaver-mfa", severity: "critical", confidence: 1.0, source: "GHSA-4j5x-wjw6-qvq5, MAL-2026-10925", firstSeen: "2026-08-11" },
11651
+ { type: "package", value: "developer-dashboard", severity: "critical", confidence: 1.0, source: "GHSA-vf74-54mr-mp44, MAL-2026-13762", firstSeen: "2026-08-11" },
11652
+ { type: "package", value: "pypi:euler-sdk@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-g6j4-8qxg-42mf, MAL-2026-13730", firstSeen: "2026-08-11" },
11653
+ { type: "package", value: "pypi:morpho-sdk@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-jm5p-3rm5-v5gv, MAL-2026-13731", firstSeen: "2026-08-11" },
11654
+ { type: "package", value: "newtun@1.0.20", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11655
+ { type: "package", value: "newtun@1.0.14", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11656
+ { type: "package", value: "newtun@1.0.18", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11657
+ { type: "package", value: "newtun@1.0.25", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11658
+ { type: "package", value: "newtun@1.0.12", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11659
+ { type: "package", value: "newtun@1.0.26", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11660
+ { type: "package", value: "newtun@1.0.21", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11661
+ { type: "package", value: "newtun@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11662
+ { type: "package", value: "newtun@1.0.13", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11663
+ { type: "package", value: "newtun@1.0.8", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11664
+ { type: "package", value: "newtun@1.0.27", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11665
+ { type: "package", value: "newtun@1.0.16", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11666
+ { type: "package", value: "newtun@1.0.24", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11667
+ { type: "package", value: "newtun@1.0.11", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11668
+ { type: "package", value: "newtun@1.0.17", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11669
+ { type: "package", value: "newtun@1.0.23", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11670
+ { type: "package", value: "newtun@1.0.19", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11671
+ { type: "package", value: "newtun@1.0.2", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11672
+ { type: "package", value: "newtun@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11673
+ { type: "package", value: "newtun@1.0.3", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11674
+ { type: "package", value: "newtun@1.0.15", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11675
+ { type: "package", value: "newtun@1.0.22", severity: "critical", confidence: 1.0, source: "GHSA-3xv7-433h-78x9, MAL-2026-13733", firstSeen: "2026-08-11" },
11676
+ { type: "package", value: "pypi:joule-btp-extension@0.1.6", severity: "critical", confidence: 1.0, source: "GHSA-x6f9-9m8h-q98m, MAL-2026-13732", firstSeen: "2026-08-11" },
11677
+ { type: "package", value: "pypi:joule-btp-extension@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-x6f9-9m8h-q98m, MAL-2026-13732", firstSeen: "2026-08-11" },
11678
+ { type: "package", value: "pypi:joule-btp-extension@0.1.1", severity: "critical", confidence: 1.0, source: "GHSA-x6f9-9m8h-q98m, MAL-2026-13732", firstSeen: "2026-08-11" },
11679
+ { type: "package", value: "pypi:joule-btp-extension@0.1.3", severity: "critical", confidence: 1.0, source: "GHSA-x6f9-9m8h-q98m, MAL-2026-13732", firstSeen: "2026-08-11" },
11680
+ { type: "package", value: "pypi:joule-btp-extension@0.1.4", severity: "critical", confidence: 1.0, source: "GHSA-x6f9-9m8h-q98m, MAL-2026-13732", firstSeen: "2026-08-11" },
11681
+ { type: "package", value: "ghazaly", severity: "critical", confidence: 1.0, source: "GHSA-g62q-mq3x-765x, MAL-2026-13755", firstSeen: "2026-08-11" },
11682
+ { type: "package", value: "dependencyfsdsfdsfg", severity: "critical", confidence: 1.0, source: "GHSA-6xhq-px35-hhv9, MAL-2026-13754", firstSeen: "2026-08-11" },
11683
+ { type: "package", value: "fetch-runtime", severity: "critical", confidence: 1.0, source: "GHSA-3hqj-592v-g33j, MAL-2026-13763", firstSeen: "2026-08-11" },
11684
+ { type: "package", value: "lines-columns", severity: "critical", confidence: 1.0, source: "GHSA-572q-x4v9-m474, MAL-2026-13765", firstSeen: "2026-08-11" },
11685
+ { type: "package", value: "pypi:dlmm-sdk@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-jp82-pmg9-xvj9, MAL-2026-13729", firstSeen: "2026-08-11" },
11686
+ { type: "package", value: "env-local@18.4.3", severity: "critical", confidence: 1.0, source: "GHSA-r3pr-mmg7-gr2j, MAL-2026-13694", firstSeen: "2026-08-10" },
11593
11687
  ];
11594
11688
  // Composed from the chunks above. A single array literal of this size trips
11595
11689
  // TS2590 ("union type that is too complex to represent") in tsc; splitting it