supply-chain-guard 6.0.0 → 6.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +4 -4
  2. package/action.yml +1 -1
  3. package/dist/cli.js +1 -1
  4. package/dist/dependency-confusion.js +1 -1
  5. package/dist/npm-scanner.js +1 -1
  6. package/dist/pypi-scanner.js +1 -1
  7. package/dist/reporter.js +12 -12
  8. package/dist/sbom-generator.js +1 -1
  9. package/dist/scanner.js +1 -1
  10. package/dist/threat-intel.d.ts.map +1 -1
  11. package/dist/threat-intel.js +42 -1
  12. package/dist/threat-intel.js.map +1 -1
  13. package/dist/vscode-scanner.js +1 -1
  14. package/package.json +1 -1
package/README.md CHANGED
@@ -142,7 +142,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
142
142
  ```yaml
143
143
  repos:
144
144
  - repo: https://github.com/homeofe/supply-chain-guard
145
- rev: v6.0.0
145
+ rev: v6.0.1
146
146
  hooks:
147
147
  - id: supply-chain-guard
148
148
  ```
@@ -174,7 +174,7 @@ The hook scans the repository root on every commit and fails on high or critical
174
174
  Run the scanner without a Node toolchain via the official multi-arch image (linux/amd64, linux/arm64), published to GHCR on every release tag:
175
175
 
176
176
  ```bash
177
- docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.0.0 scan /scan
177
+ docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.0.1 scan /scan
178
178
  ```
179
179
 
180
180
  `${PWD}` works in bash, zsh, and PowerShell; in cmd.exe use `%cd%` instead.
@@ -855,7 +855,7 @@ jobs:
855
855
  runs-on: ubuntu-latest
856
856
  steps:
857
857
  - uses: actions/checkout@v4
858
- - uses: homeofe/supply-chain-guard@v6.0.0
858
+ - uses: homeofe/supply-chain-guard@v6.0.1
859
859
  with:
860
860
  fail-on: critical
861
861
  comment-on-pr: true
@@ -943,7 +943,7 @@ two are never confused. If a deliberately frozen rule set is the intent, exclude
943
943
  the rule by name:
944
944
 
945
945
  ```yaml
946
- - uses: homeofe/supply-chain-guard@v6.0.0
946
+ - uses: homeofe/supply-chain-guard@v6.0.1
947
947
  with:
948
948
  exclude-rules: THREAT_FEED_STALE
949
949
  ```
package/action.yml CHANGED
@@ -80,7 +80,7 @@ runs:
80
80
 
81
81
  - name: Install supply-chain-guard
82
82
  shell: bash
83
- run: npm install -g supply-chain-guard@6.0.0 --ignore-scripts --no-audit --no-fund
83
+ run: npm install -g supply-chain-guard@6.0.1 --ignore-scripts --no-audit --no-fund
84
84
 
85
85
  - name: Run scan
86
86
  id: scan
package/dist/cli.js CHANGED
@@ -187,7 +187,7 @@ function assertDistinctOutputPaths(options) {
187
187
  program
188
188
  .name("supply-chain-guard")
189
189
  .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
190
- .version("6.0.0");
190
+ .version("6.0.1");
191
191
  // ── scan command ────────────────────────────────────────────────────
192
192
  program
193
193
  .command("scan")
package/dist/dependency-confusion.js CHANGED
@@ -49,7 +49,7 @@ const path = __importStar(require("node:path"));
49
49
  const https = __importStar(require("node:https"));
50
50
  const types_js_1 = require("./types.js");
51
51
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
52
- const TOOL_VERSION = "6.0.0";
52
+ const TOOL_VERSION = "6.0.1";
53
53
  const NPM_REGISTRY = "https://registry.npmjs.org";
54
54
  const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
55
55
  const PYPI_REGISTRY = "https://pypi.org/pypi";
package/dist/npm-scanner.js CHANGED
@@ -64,7 +64,7 @@ const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
64
64
  const threat_intel_js_1 = require("./threat-intel.js");
65
65
  const install_guard_js_1 = require("./install-guard.js");
66
66
  const remote_download_js_1 = require("./remote-download.js");
67
- const TOOL_VERSION = "6.0.0";
67
+ const TOOL_VERSION = "6.0.1";
68
68
  const NPM_REGISTRY = "https://registry.npmjs.org";
69
69
  const NPM_REGISTRY_HOST = "registry.npmjs.org";
70
70
  const RAW_GITHUB_HOST = "raw.githubusercontent.com";
package/dist/pypi-scanner.js CHANGED
@@ -56,7 +56,7 @@ const patterns_js_1 = require("./patterns.js");
56
56
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
57
57
  const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
58
58
  const remote_download_js_1 = require("./remote-download.js");
59
- const TOOL_VERSION = "6.0.0";
59
+ const TOOL_VERSION = "6.0.1";
60
60
  const PYPI_API = "https://pypi.org/pypi";
61
61
  const PYPI_METADATA_HOST = "pypi.org";
62
62
  const PYPI_ARTIFACT_HOST = "files.pythonhosted.org";
package/dist/reporter.js CHANGED
@@ -201,7 +201,7 @@ function formatJson(report) {
201
201
  function formatText(report) {
202
202
  const lines = [];
203
203
  // ── layout constants ───────────────────────────────────────────────────────
204
- const VERSION = "6.0.0";
204
+ const VERSION = "6.0.1";
205
205
  const W = 76; // visible chars between "│ " and " │" (total line = 80)
206
206
  // ── ANSI helpers ───────────────────────────────────────────────────────────
207
207
  const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -576,7 +576,7 @@ function formatMarkdown(report) {
576
576
  lines.push("");
577
577
  lines.push(`| Property | Value |`);
578
578
  lines.push(`|----------|-------|`);
579
- lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.0.0")}\` |`);
579
+ lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.0.1")}\` |`);
580
580
  lines.push(`| Target | \`${mdCell(report.target)}\` |`);
581
581
  lines.push(`| Type | ${mdText(report.scanType)} |`);
582
582
  lines.push(`| Time | ${mdText(report.timestamp)} |`);
@@ -824,7 +824,7 @@ function formatSarif(report) {
824
824
  tool: {
825
825
  driver: {
826
826
  name: "supply-chain-guard",
827
- version: "6.0.0",
827
+ version: "6.0.1",
828
828
  informationUri: "https://github.com/homeofe/supply-chain-guard",
829
829
  rules,
830
830
  },
@@ -1033,7 +1033,7 @@ function formatSbom(report) {
1033
1033
  ...(properties.length > 0 ? { properties } : {}),
1034
1034
  };
1035
1035
  });
1036
- const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.0.0");
1036
+ const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.0.1");
1037
1037
  const withVulns = {
1038
1038
  ...document,
1039
1039
  metadata: {
@@ -1082,7 +1082,7 @@ function formatSbom(report) {
1082
1082
  ...(properties.length > 0 ? { properties } : {}),
1083
1083
  };
1084
1084
  });
1085
- const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.0.0");
1085
+ const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.0.1");
1086
1086
  const sbom = {
1087
1087
  bomFormat: "CycloneDX",
1088
1088
  specVersion: "1.6",
@@ -1092,7 +1092,7 @@ function formatSbom(report) {
1092
1092
  timestamp: report.timestamp,
1093
1093
  tools: {
1094
1094
  components: [
1095
- { type: "application", name: "supply-chain-guard", version: "6.0.0" },
1095
+ { type: "application", name: "supply-chain-guard", version: "6.0.1" },
1096
1096
  ],
1097
1097
  },
1098
1098
  component: {
@@ -1168,8 +1168,8 @@ function formatBadge(report) {
1168
1168
  label: "supply-chain-guard",
1169
1169
  message,
1170
1170
  color,
1171
- tool: report.tool || "supply-chain-guard v6.0.0",
1172
- version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.0.0",
1171
+ tool: report.tool || "supply-chain-guard v6.0.1",
1172
+ version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.0.1",
1173
1173
  timestamp: report.timestamp,
1174
1174
  commit: report.commit ?? "none",
1175
1175
  detectionSet: report.detectionSet,
@@ -1225,7 +1225,7 @@ function formatGitlab(report) {
1225
1225
  name: "supply-chain-guard",
1226
1226
  url: "https://github.com/homeofe/supply-chain-guard",
1227
1227
  vendor: { name: "supply-chain-guard" },
1228
- version: "6.0.0",
1228
+ version: "6.0.1",
1229
1229
  };
1230
1230
  const vulnerabilities = report.findings
1231
1231
  .filter((f) => !f.suppressed)
@@ -1347,7 +1347,7 @@ function formatJunit(report) {
1347
1347
  // (unreleased, issue 205): the coverage properties are ALWAYS emitted, so a JUnit
1348
1348
  // artefact states its own denominator instead of only what was found.
1349
1349
  lines.push(" <properties>");
1350
- lines.push(` <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.0.0")}"/>`);
1350
+ lines.push(` <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.0.1")}"/>`);
1351
1351
  lines.push(` <property name="supply-chain-guard:timestamp" value="${xmlEscape(report.timestamp)}"/>`);
1352
1352
  lines.push(` <property name="supply-chain-guard:commit" value="${xmlEscape(report.commit ?? "none (not a git repository)")}"/>`);
1353
1353
  if (report.detectionSet) {
@@ -1473,7 +1473,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
1473
1473
  <body>
1474
1474
  <div class="container">
1475
1475
  <header>
1476
- <h1>${escapeHtml(report.tool || "supply-chain-guard v6.0.0")} Scan Report</h1>
1476
+ <h1>${escapeHtml(report.tool || "supply-chain-guard v6.0.1")} Scan Report</h1>
1477
1477
  <div class="meta">
1478
1478
  <span>Target: ${escapeHtml(report.target)}</span>
1479
1479
  <span>Type: ${report.scanType}</span>
@@ -1534,7 +1534,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
1534
1534
  ` : ""}
1535
1535
 
1536
1536
  <footer>
1537
- Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.0.0")}</a>
1537
+ Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.0.1")}</a>
1538
1538
  </footer>
1539
1539
  </div>
1540
1540
  <script>
package/dist/sbom-generator.js CHANGED
@@ -86,7 +86,7 @@ exports.generateSbomDocument = generateSbomDocument;
86
86
  const fs = __importStar(require("node:fs"));
87
87
  const path = __importStar(require("node:path"));
88
88
  const node_crypto_1 = require("node:crypto");
89
- const TOOL_VERSION = "6.0.0";
89
+ const TOOL_VERSION = "6.0.1";
90
90
  /** bom-ref of the component the document is about. */
91
91
  const SUBJECT_BOM_REF = "target";
92
92
  /** Property namespace, matching the `supply-chain-guard:scan-status` property reporter.ts adds. */
package/dist/scanner.js CHANGED
@@ -97,7 +97,7 @@ const slsa_verifier_js_1 = require("./slsa-verifier.js");
97
97
  const dependency_confusion_js_1 = require("./dependency-confusion.js");
98
98
  const mcp_scanner_js_1 = require("./mcp-scanner.js");
99
99
  const skills_scanner_js_1 = require("./skills-scanner.js");
100
- const TOOL_VERSION = "6.0.0";
100
+ const TOOL_VERSION = "6.0.1";
101
101
  /**
102
102
  * Exact files that contain this package's own inert detector definitions or
103
103
  * regression fixtures.
package/dist/threat-intel.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AA+9a5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAGlD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA+CX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAwBhB;AAgHD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAiCnF"}
1
+ {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AAygb5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAGlD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CA+CX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBhF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAwBhB;AAgHD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAiCnF"}
package/dist/threat-intel.js CHANGED
@@ -13674,6 +13674,47 @@ const FEED_CHUNK_13 = [
13674
13674
  { type: "package", value: "stillm4ddpocs-demo-gadget@999.9.12", severity: "critical", confidence: 1.0, source: "GHSA-452p-xh57-7mqp, MAL-2026-14361", firstSeen: "2026-08-22" },
13675
13675
  { type: "package", value: "internallib_v902", severity: "critical", confidence: 1.0, source: "GHSA-3p65-4jqj-5j69, MAL-2026-14359", firstSeen: "2026-08-22" },
13676
13676
  { type: "package", value: "pypi:scrambleeeer@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-xw2j-24j3-3282, MAL-2026-14358", firstSeen: "2026-08-22" },
13677
+ // Imported from GitHub Advisory Database (2026-08-15) - see docs/threat-feed-sources.md
13678
+ { type: "package", value: "sm-oauth@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-7x7x-6w24-fch9, MAL-2026-14398", firstSeen: "2026-08-24" },
13679
+ { type: "package", value: "message-compiler@9.2.0", severity: "critical", confidence: 1.0, source: "GHSA-pw4h-7785-7vpj, MAL-2026-14392", firstSeen: "2026-08-24" },
13680
+ { type: "package", value: "fund-calculator@999.9.12", severity: "critical", confidence: 1.0, source: "GHSA-2qjv-462j-82h3, MAL-2026-14391", firstSeen: "2026-08-24" },
13681
+ { type: "package", value: "amundi-compare@999.9.12", severity: "critical", confidence: 1.0, source: "GHSA-8jcq-36hr-gv49, MAL-2026-14390", firstSeen: "2026-08-24" },
13682
+ { type: "package", value: "sm-session@99.0.1", severity: "critical", confidence: 1.0, source: "GHSA-wm74-4gpw-8fm5, MAL-2026-14400", firstSeen: "2026-08-24" },
13683
+ { type: "package", value: "sm-session@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-wm74-4gpw-8fm5, MAL-2026-14400", firstSeen: "2026-08-24" },
13684
+ { type: "package", value: "sm-payment@99.0.1", severity: "critical", confidence: 1.0, source: "GHSA-mxq2-g955-f593, MAL-2026-14399", firstSeen: "2026-08-24" },
13685
+ { type: "package", value: "sm-payment@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-mxq2-g955-f593, MAL-2026-14399", firstSeen: "2026-08-24" },
13686
+ { type: "package", value: "sm-cart@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-hm6h-363f-fpgf, MAL-2026-14396", firstSeen: "2026-08-24" },
13687
+ { type: "package", value: "sm-cart@99.0.1", severity: "critical", confidence: 1.0, source: "GHSA-hm6h-363f-fpgf, MAL-2026-14396", firstSeen: "2026-08-24" },
13688
+ { type: "package", value: "sm-checkout@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-pxgj-j29f-m7fq, MAL-2026-14397", firstSeen: "2026-08-24" },
13689
+ { type: "package", value: "sm-checkout@99.0.1", severity: "critical", confidence: 1.0, source: "GHSA-pxgj-j29f-m7fq, MAL-2026-14397", firstSeen: "2026-08-24" },
13690
+ { type: "package", value: "sm-billing-form@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-q99c-rfrp-g979, MAL-2026-14395", firstSeen: "2026-08-24" },
13691
+ { type: "package", value: "sm-billing-form@99.0.1", severity: "critical", confidence: 1.0, source: "GHSA-q99c-rfrp-g979, MAL-2026-14395", firstSeen: "2026-08-24" },
13692
+ { type: "package", value: "sm-apikey-model@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-26rf-c87j-mwr4, MAL-2026-14394", firstSeen: "2026-08-24" },
13693
+ { type: "package", value: "sm-apikey-model@99.0.1", severity: "critical", confidence: 1.0, source: "GHSA-26rf-c87j-mwr4, MAL-2026-14394", firstSeen: "2026-08-24" },
13694
+ { type: "package", value: "sm-admin@99.0.0", severity: "critical", confidence: 1.0, source: "GHSA-g8wg-mh5v-wf2r, MAL-2026-14393", firstSeen: "2026-08-24" },
13695
+ { type: "package", value: "sm-admin@99.0.1", severity: "critical", confidence: 1.0, source: "GHSA-g8wg-mh5v-wf2r, MAL-2026-14393", firstSeen: "2026-08-24" },
13696
+ { type: "package", value: "identitysecuretokenserv", severity: "critical", confidence: 1.0, source: "GHSA-2g7g-rqj2-26hv, MAL-2026-4164", firstSeen: "2026-08-24" },
13697
+ { type: "package", value: "conversa-sdk@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-8m82-6fp4-38m4, MAL-2026-6185", firstSeen: "2026-08-24" },
13698
+ { type: "package", value: "conversa-sdk@1.0.4", severity: "critical", confidence: 1.0, source: "GHSA-8m82-6fp4-38m4, MAL-2026-6185", firstSeen: "2026-08-24" },
13699
+ { type: "package", value: "conversa-sdk@1.0.5", severity: "critical", confidence: 1.0, source: "GHSA-8m82-6fp4-38m4, MAL-2026-6185", firstSeen: "2026-08-24" },
13700
+ { type: "package", value: "conversa-sdk@1.0.6", severity: "critical", confidence: 1.0, source: "GHSA-8m82-6fp4-38m4, MAL-2026-6185", firstSeen: "2026-08-24" },
13701
+ { type: "package", value: "conversa-sdk@1.0.8", severity: "critical", confidence: 1.0, source: "GHSA-8m82-6fp4-38m4, MAL-2026-6185", firstSeen: "2026-08-24" },
13702
+ { type: "package", value: "conversa-sdk@2.0.0", severity: "critical", confidence: 1.0, source: "GHSA-8m82-6fp4-38m4, MAL-2026-6185", firstSeen: "2026-08-24" },
13703
+ { type: "package", value: "conversa-sdk@2.0.3", severity: "critical", confidence: 1.0, source: "GHSA-8m82-6fp4-38m4, MAL-2026-6185", firstSeen: "2026-08-24" },
13704
+ { type: "package", value: "conversa-sdk@2.0.4", severity: "critical", confidence: 1.0, source: "GHSA-8m82-6fp4-38m4, MAL-2026-6185", firstSeen: "2026-08-24" },
13705
+ { type: "package", value: "pypi:envprovision@1.2.0", severity: "critical", confidence: 1.0, source: "GHSA-xr9j-7gjp-x8fg, MAL-2026-14389", firstSeen: "2026-08-24" },
13706
+ { type: "package", value: "pypi:envprovision@1.3.0", severity: "critical", confidence: 1.0, source: "GHSA-xr9j-7gjp-x8fg, MAL-2026-14389", firstSeen: "2026-08-24" },
13707
+ { type: "package", value: "pypi:envprovision@1.4.0", severity: "critical", confidence: 1.0, source: "GHSA-xr9j-7gjp-x8fg, MAL-2026-14389", firstSeen: "2026-08-24" },
13708
+ { type: "package", value: "@opap/player-kyc-widget@3.999.999", severity: "critical", confidence: 1.0, source: "GHSA-w2m6-3q96-chrf, MAL-2026-14387", firstSeen: "2026-08-23" },
13709
+ { type: "package", value: "pypi:cryptgraphy@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-2v43-g59q-gxp6, MAL-2026-14388", firstSeen: "2026-08-23" },
13710
+ { type: "package", value: "pypi:mlflow-otel-instrumentor@1.1.0", severity: "critical", confidence: 1.0, source: "GHSA-w427-8xgw-fvcw, MAL-2026-14384", firstSeen: "2026-08-23" },
13711
+ { type: "package", value: "svelte-dim-kit", severity: "critical", confidence: 1.0, source: "GHSA-64x3-8jmm-fhp8, MAL-2026-14386", firstSeen: "2026-08-23" },
13712
+ { type: "package", value: "hydration-dim-kit", severity: "critical", confidence: 1.0, source: "GHSA-p33f-w7x3-mxrr, MAL-2026-14385", firstSeen: "2026-08-23" },
13713
+ { type: "package", value: "@sdgdfgdfhhhfd/multiviewr", severity: "critical", confidence: 1.0, source: "GHSA-wwgv-4qvc-7339, MAL-2026-14383", firstSeen: "2026-08-23" },
13714
+ { type: "package", value: "@sdgdfgdfhhhfd/chainvista", severity: "critical", confidence: 1.0, source: "GHSA-849m-c6hc-74xx, MAL-2026-14382", firstSeen: "2026-08-23" },
13715
+ { type: "package", value: "totp-utils", severity: "critical", confidence: 1.0, source: "GHSA-m72r-95xc-q6g8, MAL-2026-14379", firstSeen: "2026-08-23" },
13716
+ { type: "package", value: "fund-list-filter@999.9.12", severity: "critical", confidence: 1.0, source: "GHSA-ww7v-m7hw-7m2q, MAL-2026-14380", firstSeen: "2026-08-23" },
13717
+ { type: "package", value: "fund-portfolio@999.9.12", severity: "critical", confidence: 1.0, source: "GHSA-8qph-p7jr-c2xf, MAL-2026-14381", firstSeen: "2026-08-23" },
13677
13718
  ];
13678
13719
  // Composed from the chunks above. A single array literal of this size trips
13679
13720
  // TS2590 ("union type that is too complex to represent") in tsc; splitting it
@@ -14413,7 +14454,7 @@ function getDetectionSetProvenance(cacheDir) {
14413
14454
  // No cache or invalid cache
14414
14455
  }
14415
14456
  return {
14416
- bundledVersion: "6.0.0",
14457
+ bundledVersion: "6.0.1",
14417
14458
  bundledEntryCount: BUNDLED_FEED.length,
14418
14459
  generatedAt: exports.FEED_GENERATED_AT,
14419
14460
  cacheMerged,