supply-chain-guard 6.3.0 → 6.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. package/README.md +7 -7
  2. package/action.yml +1 -1
  3. package/dist/catalog-digest.d.ts +4 -4
  4. package/dist/catalog-digest.js +4 -4
  5. package/dist/cli.js +1 -1
  6. package/dist/dependency-confusion.js +1 -1
  7. package/dist/npm-scanner.js +1 -1
  8. package/dist/pypi-scanner.js +1 -1
  9. package/dist/reporter.js +12 -12
  10. package/dist/sbom-generator.js +1 -1
  11. package/dist/scanner.js +1 -1
  12. package/dist/threat-intel.d.ts +1 -1
  13. package/dist/threat-intel.d.ts.map +1 -1
  14. package/dist/threat-intel.js +8 -59
  15. package/dist/threat-intel.js.map +1 -1
  16. package/dist/vscode-scanner.js +1 -1
  17. package/dist/workflow-modeler.d.ts.map +1 -1
  18. package/dist/workflow-modeler.js +395 -7
  19. package/dist/workflow-modeler.js.map +1 -1
  20. package/package.json +1 -1
  21. package/self-scan-manifest.json +5 -5
package/README.md CHANGED
@@ -36,7 +36,7 @@ Gate every pull request:
36
36
 
37
37
  ```yaml
38
38
  - uses: actions/checkout@v4
39
- - uses: homeofe/supply-chain-guard@v6.3.0
39
+ - uses: homeofe/supply-chain-guard@v6.3.1
40
40
  ```
41
41
 
42
42
  Let your AI coding agent check a package before it installs it (MCP):
@@ -209,7 +209,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
209
209
  ```yaml
210
210
  repos:
211
211
  - repo: https://github.com/homeofe/supply-chain-guard
212
- rev: v6.3.0
212
+ rev: v6.3.1
213
213
  hooks:
214
214
  - id: supply-chain-guard
215
215
  ```
@@ -241,7 +241,7 @@ The hook scans the repository root on every commit and fails on high or critical
241
241
  Run the scanner without a Node toolchain via the official multi-arch image (linux/amd64, linux/arm64), published to GHCR on every release tag:
242
242
 
243
243
  ```bash
244
- docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.3.0 scan /scan
244
+ docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.3.1 scan /scan
245
245
  ```
246
246
 
247
247
  `${PWD}` works in bash, zsh, and PowerShell; in cmd.exe use `%cd%` instead.
@@ -998,7 +998,7 @@ jobs:
998
998
  runs-on: ubuntu-latest
999
999
  steps:
1000
1000
  - uses: actions/checkout@v4
1001
- - uses: homeofe/supply-chain-guard@v6.3.0
1001
+ - uses: homeofe/supply-chain-guard@v6.3.1
1002
1002
  with:
1003
1003
  fail-on: critical
1004
1004
  comment-on-pr: true
@@ -1086,7 +1086,7 @@ two are never confused. If a deliberately frozen rule set is the intent, exclude
1086
1086
  the rule by name:
1087
1087
 
1088
1088
  ```yaml
1089
- - uses: homeofe/supply-chain-guard@v6.3.0
1089
+ - uses: homeofe/supply-chain-guard@v6.3.1
1090
1090
  with:
1091
1091
  exclude-rules: THREAT_FEED_STALE
1092
1092
  ```
@@ -1157,7 +1157,7 @@ preceding `feed refresh` in the workflow does not count. `catalog: required`
1157
1157
  on the Action therefore needs:
1158
1158
 
1159
1159
  ```yaml
1160
- - uses: homeofe/supply-chain-guard@v6.3.0
1160
+ - uses: homeofe/supply-chain-guard@v6.3.1
1161
1161
  with:
1162
1162
  refresh-catalog: true
1163
1163
  ```
@@ -1168,7 +1168,7 @@ setting rather than firing on every scan. If scanning against the bundled set
1168
1168
  alone is the intent, exclude the rule by name:
1169
1169
 
1170
1170
  ```yaml
1171
- - uses: homeofe/supply-chain-guard@v6.3.0
1171
+ - uses: homeofe/supply-chain-guard@v6.3.1
1172
1172
  with:
1173
1173
  exclude-rules: THREAT_FEED_CATALOG_MISSING
1174
1174
  ```
package/action.yml CHANGED
@@ -84,7 +84,7 @@ runs:
84
84
 
85
85
  - name: Install supply-chain-guard
86
86
  shell: bash
87
- run: npm install -g supply-chain-guard@6.3.0 --ignore-scripts --no-audit --no-fund
87
+ run: npm install -g supply-chain-guard@6.3.1 --ignore-scripts --no-audit --no-fund
88
88
 
89
89
  - name: Run scan
90
90
  id: scan
package/dist/catalog-digest.d.ts CHANGED
@@ -1,8 +1,8 @@
1
1
  export declare const CATALOG_DIGEST: {
2
- readonly version: "6.3.0";
3
- readonly sha256: "c2deb3b1c0ad6bb22dc7045850a246f8f5baaa59ef7f40d3a3bc24eb814eb0aa";
4
- readonly entriesSha256: "6a2ca03c25cf7259672f2d82bd49bad9205e6400ed32e7ce995d0bc15e91ea16";
5
- readonly entryCount: 86829;
2
+ readonly version: "6.3.1";
3
+ readonly sha256: "3730cf807dc8e2fd931cf79bad7da572316cead032bda220cec53a8b6ff5da2b";
4
+ readonly entriesSha256: "acb1b84c0ff2a6d1a05e488d543641a9eba2d726eb79f31112b18818422779f4";
5
+ readonly entryCount: 86885;
6
6
  readonly shardCount: 2;
7
7
  };
8
8
  //# sourceMappingURL=catalog-digest.d.ts.map
package/dist/catalog-digest.js CHANGED
@@ -14,10 +14,10 @@ exports.CATALOG_DIGEST = void 0;
14
14
  // read off loadThreatIntel()'s hot path, is typechecked, and supplies the
15
15
  // version refreshFeed() needs to build the catalog URL.
16
16
  exports.CATALOG_DIGEST = {
17
- version: "6.3.0",
18
- sha256: "c2deb3b1c0ad6bb22dc7045850a246f8f5baaa59ef7f40d3a3bc24eb814eb0aa",
19
- entriesSha256: "6a2ca03c25cf7259672f2d82bd49bad9205e6400ed32e7ce995d0bc15e91ea16",
20
- entryCount: 86829,
17
+ version: "6.3.1",
18
+ sha256: "3730cf807dc8e2fd931cf79bad7da572316cead032bda220cec53a8b6ff5da2b",
19
+ entriesSha256: "acb1b84c0ff2a6d1a05e488d543641a9eba2d726eb79f31112b18818422779f4",
20
+ entryCount: 86885,
21
21
  shardCount: 2,
22
22
  };
23
23
  //# sourceMappingURL=catalog-digest.js.map
package/dist/cli.js CHANGED
@@ -198,7 +198,7 @@ function assertDistinctOutputPaths(options) {
198
198
  program
199
199
  .name("supply-chain-guard")
200
200
  .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
201
- .version("6.3.0");
201
+ .version("6.3.1");
202
202
  // ── scan command ────────────────────────────────────────────────────
203
203
  program
204
204
  .command("scan")
package/dist/dependency-confusion.js CHANGED
@@ -53,7 +53,7 @@ const types_js_1 = require("./types.js");
53
53
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
54
54
  const json_utils_js_1 = require("./json-utils.js");
55
55
  const publishing_anomaly_detector_js_1 = require("./publishing-anomaly-detector.js");
56
- const TOOL_VERSION = "6.3.0";
56
+ const TOOL_VERSION = "6.3.1";
57
57
  const NPM_REGISTRY = "https://registry.npmjs.org";
58
58
  const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
59
59
  const PYPI_REGISTRY = "https://pypi.org/pypi";
package/dist/npm-scanner.js CHANGED
@@ -65,7 +65,7 @@ const threat_intel_js_1 = require("./threat-intel.js");
65
65
  const install_guard_js_1 = require("./install-guard.js");
66
66
  const json_utils_js_1 = require("./json-utils.js");
67
67
  const remote_download_js_1 = require("./remote-download.js");
68
- const TOOL_VERSION = "6.3.0";
68
+ const TOOL_VERSION = "6.3.1";
69
69
  const NPM_REGISTRY = "https://registry.npmjs.org";
70
70
  const NPM_REGISTRY_HOST = "registry.npmjs.org";
71
71
  const RAW_GITHUB_HOST = "raw.githubusercontent.com";
package/dist/pypi-scanner.js CHANGED
@@ -56,7 +56,7 @@ const patterns_js_1 = require("./patterns.js");
56
56
  const pattern_scanner_js_1 = require("./pattern-scanner.js");
57
57
  const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
58
58
  const remote_download_js_1 = require("./remote-download.js");
59
- const TOOL_VERSION = "6.3.0";
59
+ const TOOL_VERSION = "6.3.1";
60
60
  const PYPI_API = "https://pypi.org/pypi";
61
61
  const PYPI_METADATA_HOST = "pypi.org";
62
62
  const PYPI_ARTIFACT_HOST = "files.pythonhosted.org";
package/dist/reporter.js CHANGED
@@ -294,7 +294,7 @@ function formatJson(report) {
294
294
  function formatText(report, options = {}) {
295
295
  const lines = [];
296
296
  // ── layout constants ───────────────────────────────────────────────────────
297
- const VERSION = "6.3.0";
297
+ const VERSION = "6.3.1";
298
298
  const W = 76; // visible chars between "│ " and " │" (total line = 80)
299
299
  // ── ANSI helpers ───────────────────────────────────────────────────────────
300
300
  const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -739,7 +739,7 @@ function formatMarkdown(report) {
739
739
  lines.push("");
740
740
  lines.push(`| Property | Value |`);
741
741
  lines.push(`|----------|-------|`);
742
- lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.3.0")}\` |`);
742
+ lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.3.1")}\` |`);
743
743
  lines.push(`| Target | \`${mdCell(report.target)}\` |`);
744
744
  lines.push(`| Type | ${mdText(report.scanType)} |`);
745
745
  lines.push(`| Time | ${mdText(report.timestamp)} |`);
@@ -993,7 +993,7 @@ function formatSarif(report) {
993
993
  tool: {
994
994
  driver: {
995
995
  name: "supply-chain-guard",
996
- version: "6.3.0",
996
+ version: "6.3.1",
997
997
  informationUri: "https://github.com/homeofe/supply-chain-guard",
998
998
  rules,
999
999
  },
@@ -1217,7 +1217,7 @@ function formatSbom(report) {
1217
1217
  ...(properties.length > 0 ? { properties } : {}),
1218
1218
  }];
1219
1219
  });
1220
- const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.3.0");
1220
+ const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.3.1");
1221
1221
  const withVulns = {
1222
1222
  ...document,
1223
1223
  metadata: {
@@ -1266,7 +1266,7 @@ function formatSbom(report) {
1266
1266
  ...(properties.length > 0 ? { properties } : {}),
1267
1267
  };
1268
1268
  });
1269
- const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.3.0");
1269
+ const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.3.1");
1270
1270
  const sbom = {
1271
1271
  bomFormat: "CycloneDX",
1272
1272
  specVersion: "1.6",
@@ -1276,7 +1276,7 @@ function formatSbom(report) {
1276
1276
  timestamp: report.timestamp,
1277
1277
  tools: {
1278
1278
  components: [
1279
- { type: "application", name: "supply-chain-guard", version: "6.3.0" },
1279
+ { type: "application", name: "supply-chain-guard", version: "6.3.1" },
1280
1280
  ],
1281
1281
  },
1282
1282
  component: {
@@ -1352,8 +1352,8 @@ function formatBadge(report) {
1352
1352
  label: "supply-chain-guard",
1353
1353
  message,
1354
1354
  color,
1355
- tool: report.tool || "supply-chain-guard v6.3.0",
1356
- version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.3.0",
1355
+ tool: report.tool || "supply-chain-guard v6.3.1",
1356
+ version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.3.1",
1357
1357
  timestamp: report.timestamp,
1358
1358
  commit: report.commit ?? "none",
1359
1359
  detectionSet: report.detectionSet,
@@ -1409,7 +1409,7 @@ function formatGitlab(report) {
1409
1409
  name: "supply-chain-guard",
1410
1410
  url: "https://github.com/homeofe/supply-chain-guard",
1411
1411
  vendor: { name: "supply-chain-guard" },
1412
- version: "6.3.0",
1412
+ version: "6.3.1",
1413
1413
  };
1414
1414
  const vulnerabilities = report.findings
1415
1415
  .filter((f) => !f.suppressed)
@@ -1534,7 +1534,7 @@ function formatJunit(report) {
1534
1534
  // (unreleased, issue 205): the coverage properties are ALWAYS emitted, so a JUnit
1535
1535
  // artefact states its own denominator instead of only what was found.
1536
1536
  lines.push(" <properties>");
1537
- lines.push(` <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.3.0")}"/>`);
1537
+ lines.push(` <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.3.1")}"/>`);
1538
1538
  lines.push(` <property name="supply-chain-guard:timestamp" value="${xmlEscape(report.timestamp)}"/>`);
1539
1539
  lines.push(` <property name="supply-chain-guard:commit" value="${xmlEscape(report.commit ?? "none (not a git repository)")}"/>`);
1540
1540
  if (report.detectionSet) {
@@ -1664,7 +1664,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
1664
1664
  <body>
1665
1665
  <div class="container">
1666
1666
  <header>
1667
- <h1>${escapeHtml(report.tool || "supply-chain-guard v6.3.0")} Scan Report</h1>
1667
+ <h1>${escapeHtml(report.tool || "supply-chain-guard v6.3.1")} Scan Report</h1>
1668
1668
  <div class="meta">
1669
1669
  <span>Target: ${escapeHtml(report.target)}</span>
1670
1670
  <span>Type: ${report.scanType}</span>
@@ -1726,7 +1726,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
1726
1726
  ` : ""}
1727
1727
 
1728
1728
  <footer>
1729
- Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.3.0")}</a>
1729
+ Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.3.1")}</a>
1730
1730
  </footer>
1731
1731
  </div>
1732
1732
  <script>
package/dist/sbom-generator.js CHANGED
@@ -87,7 +87,7 @@ const fs = __importStar(require("node:fs"));
87
87
  const path = __importStar(require("node:path"));
88
88
  const node_crypto_1 = require("node:crypto");
89
89
  const json_utils_js_1 = require("./json-utils.js");
90
- const TOOL_VERSION = "6.3.0";
90
+ const TOOL_VERSION = "6.3.1";
91
91
  /** bom-ref of the component the document is about. */
92
92
  const SUBJECT_BOM_REF = "target";
93
93
  /** Property namespace, matching the `supply-chain-guard:scan-status` property reporter.ts adds. */
package/dist/scanner.js CHANGED
@@ -111,7 +111,7 @@ const mcp_scanner_js_1 = require("./mcp-scanner.js");
111
111
  const skills_scanner_js_1 = require("./skills-scanner.js");
112
112
  const disguised_asset_js_1 = require("./disguised-asset.js");
113
113
  const self_scan_trust_js_1 = require("./self-scan-trust.js");
114
- const TOOL_VERSION = "6.3.0";
114
+ const TOOL_VERSION = "6.3.1";
115
115
  /**
116
116
  * Pattern literals in this matcher module deliberately spell out signatures
117
117
  * that the public scanner detects. Suppress only those exact rule definitions
package/dist/threat-intel.d.ts CHANGED
@@ -24,7 +24,7 @@ export type FeedIOCInput = Omit<FeedIOC, "confidence"> & {
24
24
  * Generation timestamp for the bundled IOC feed (v5.29, issue #208).
25
25
  * Pure function of feed updates; preserved across builds.
26
26
  */
27
- export declare const FEED_GENERATED_AT = "2026-09-25T00:00:00.000Z";
27
+ export declare const FEED_GENERATED_AT = "2026-09-26T00:00:00.000Z";
28
28
  export declare const CACHE_DIR = ".scg-cache";
29
29
  export declare const FEED_CACHE_FILE = "threat-feed.json";
30
30
  /** Where the downloaded catalog is cached, beside the feed cache. */
package/dist/threat-intel.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AA40T5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAChC,QAAQ,GACR,YAAY,GACZ,kBAAkB,GAClB,iBAAiB,GACjB,SAAS,CAAC;AAEd,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,oDAAoD;IACpD,SAAS,EAAE,OAAO,CAAC;IACnB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAeD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;CAChB;AAmBD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CAiKX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAiCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA6BhF;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA+BnF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAuBhB;AAuDD;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAE,WAAW,CAAC,MAAM,CASlE,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAM/C;AAwDD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,YAAY,GAC1B,sBAAsB,CA+CxB"}
1
+ {"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AA0xT5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAChC,QAAQ,GACR,YAAY,GACZ,kBAAkB,GAClB,iBAAiB,GACjB,SAAS,CAAC;AAEd,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,oDAAoD;IACpD,SAAS,EAAE,OAAO,CAAC;IACnB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAeD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;CAChB;AAmBD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CAiKX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAiCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA6BhF;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA+BnF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAuBhB;AAuDD;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAE,WAAW,CAAC,MAAM,CASlE,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAM/C;AAwDD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,YAAY,GAC1B,sBAAsB,CA+CxB"}
package/dist/threat-intel.js CHANGED
@@ -63,7 +63,7 @@ const catalog_digest_js_1 = require("./catalog-digest.js");
63
63
  * Generation timestamp for the bundled IOC feed (v5.29, issue #208).
64
64
  * Pure function of feed updates; preserved across builds.
65
65
  */
66
- exports.FEED_GENERATED_AT = "2026-09-25T00:00:00.000Z";
66
+ exports.FEED_GENERATED_AT = "2026-09-26T00:00:00.000Z";
67
67
  // ---------------------------------------------------------------------------
68
68
  // Default bundled feed (curated by supply-chain-guard)
69
69
  // ---------------------------------------------------------------------------
@@ -1566,49 +1566,10 @@ const FEED_CHUNK_13 = [
1566
1566
  { type: "package", value: "streak-metricazbd", severity: "critical", confidence: 0.9, family: "RedShell", campaign: "RedC2", source: "TrendAI, The Hacker News", firstSeen: "2026-08-20" },
1567
1567
  { type: "ip", value: "217.60.77.63", severity: "critical", confidence: 0.85, family: "RedShell", campaign: "RedC2", source: "TrendAI", firstSeen: "2026-08-20" },
1568
1568
  { type: "hash", value: "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466", severity: "critical", confidence: 0.85, family: "RedShell", campaign: "RedC2", source: "TrendAI", firstSeen: "2026-08-20" },
1569
- // Imported from GitHub Advisory Database (2026-08-15) - see docs/threat-feed-sources.md
1570
- { type: "package", value: "pypi:rce-test@0.1", severity: "critical", confidence: 1.0, source: "GHSA-5j7w-88pp-6hpr, MAL-2026-14523", firstSeen: "2026-08-26" },
1571
- { type: "package", value: "pypi:syntaxerror-package-12345@0.1", severity: "critical", confidence: 1.0, source: "GHSA-pg4p-fr45-wfxc, MAL-2026-14522", firstSeen: "2026-08-26" },
1572
- { type: "package", value: "express-security-policy", severity: "critical", confidence: 1.0, source: "GHSA-3hxc-wppf-m25r, MAL-2026-2828", firstSeen: "2026-08-26" },
1573
- { type: "package", value: "array-shuffler-utils-99", severity: "critical", confidence: 1.0, source: "GHSA-22jp-536p-wwgr, MAL-2026-14519", firstSeen: "2026-08-26" },
1574
- { type: "package", value: "renovate-config-doctolib", severity: "critical", confidence: 1.0, source: "GHSA-8327-2h3c-rm8g, MAL-2026-2830", firstSeen: "2026-08-26" },
1575
- { type: "package", value: "fivem-tool-helper-v2", severity: "critical", confidence: 1.0, source: "GHSA-qgxc-chq8-gvrg, MAL-2026-14521", firstSeen: "2026-08-26" },
1576
- { type: "package", value: "fivem-tool-helper", severity: "critical", confidence: 1.0, source: "GHSA-7jgv-5jq7-38g6, MAL-2026-14520", firstSeen: "2026-08-26" },
1577
1569
  // Imported from GitHub Advisory Database (2026-08-13) - see docs/threat-feed-sources.md
1578
1570
  { type: "package", value: "node-pino", severity: "critical", confidence: 1.0, source: "GHSA-w294-7cjj-7mvg, MAL-2026-6762", firstSeen: "2026-08-27" },
1579
1571
  { type: "package", value: "parallely", severity: "critical", confidence: 1.0, source: "GHSA-rmhx-v9xh-x4jv, MAL-2026-11143", firstSeen: "2026-08-27" },
1580
1572
  { type: "package", value: "bnotify-web-sdk", severity: "critical", confidence: 1.0, source: "GHSA-h2p9-v9rw-px6c, MAL-2026-14551", firstSeen: "2026-08-27" },
1581
- { type: "package", value: "dumb-binding-gyp-package", severity: "critical", confidence: 1.0, source: "GHSA-p8h8-j624-2qhc, MAL-2026-14546", firstSeen: "2026-08-26" },
1582
- { type: "package", value: "the_tax_free_cashier_is_at_9f", severity: "critical", confidence: 1.0, source: "GHSA-4hc4-fpvc-7chp, MAL-2026-14549", firstSeen: "2026-08-26" },
1583
- { type: "package", value: "shai_hulululud", severity: "critical", confidence: 1.0, source: "GHSA-c83w-r5p2-qhmj, MAL-2026-14548", firstSeen: "2026-08-26" },
1584
- { type: "package", value: "grandfather_of_the_desert", severity: "critical", confidence: 1.0, source: "GHSA-fjvc-xq44-gq59, MAL-2026-14547", firstSeen: "2026-08-26" },
1585
- { type: "package", value: "tset_racie", severity: "critical", confidence: 1.0, source: "GHSA-7978-5fh2-74q2, MAL-2026-14550", firstSeen: "2026-08-26" },
1586
- { type: "package", value: "pypi:pybitjs@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-wv93-5fvj-96j3, MAL-2026-14545", firstSeen: "2026-08-26" },
1587
- { type: "package", value: "pypi:trongridet@0.0.1", severity: "critical", confidence: 1.0, source: "GHSA-6q35-8j6x-jx75, MAL-2026-14542", firstSeen: "2026-08-26" },
1588
- { type: "package", value: "self-certificates", severity: "critical", confidence: 1.0, source: "GHSA-rwg4-cx82-h5hq, MAL-2026-14543", firstSeen: "2026-08-26" },
1589
- { type: "package", value: "self-sign", severity: "critical", confidence: 1.0, source: "GHSA-9jvg-g3cg-g557, MAL-2026-14544", firstSeen: "2026-08-26" },
1590
- { type: "package", value: "chai-plus", severity: "critical", confidence: 1.0, source: "GHSA-2r27-f59g-4hcx, MAL-2026-14533", firstSeen: "2026-08-26" },
1591
- { type: "package", value: "svelte-vli-ui", severity: "critical", confidence: 1.0, source: "GHSA-hxqf-cq68-wh37, MAL-2026-14541", firstSeen: "2026-08-26" },
1592
- { type: "package", value: "hydration-vli-ui", severity: "critical", confidence: 1.0, source: "GHSA-v229-xfmv-q98w, MAL-2026-14535", firstSeen: "2026-08-26" },
1593
- { type: "package", value: "zenntechinc-cli@1.6.6", severity: "critical", confidence: 1.0, source: "GHSA-6wh9-pcqw-jp9j, MAL-2026-14539", firstSeen: "2026-08-26" },
1594
- { type: "package", value: "zenntechinc-cli@1.6.4", severity: "critical", confidence: 1.0, source: "GHSA-6wh9-pcqw-jp9j, MAL-2026-14539", firstSeen: "2026-08-26" },
1595
- { type: "package", value: "model-poc-suhail", severity: "critical", confidence: 1.0, source: "GHSA-cpqg-wgv2-g29r, MAL-2026-3030", firstSeen: "2026-08-26" },
1596
- { type: "package", value: "octopus-action@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-xp3r-4585-7gx2, MAL-2026-14537", firstSeen: "2026-08-26" },
1597
- { type: "package", value: "spotify-url-resolvers@3.4.2", severity: "critical", confidence: 1.0, source: "GHSA-mg73-v34h-w9f9, MAL-2026-14538", firstSeen: "2026-08-26" },
1598
- { type: "package", value: "mt-ts-serverless-starter@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-23v8-vcgc-99v9, MAL-2026-14536", firstSeen: "2026-08-26" },
1599
- { type: "package", value: "commonjs-code-token@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-wq3w-3cqf-rjjj, MAL-2026-14534", firstSeen: "2026-08-26" },
1600
- { type: "package", value: "commonjs-code-token@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-wq3w-3cqf-rjjj, MAL-2026-14534", firstSeen: "2026-08-26" },
1601
- { type: "package", value: "chai-as-org@1.0.5", severity: "critical", confidence: 1.0, source: "GHSA-54pw-m2xf-hj23, MAL-2026-14532", firstSeen: "2026-08-26" },
1602
- { type: "package", value: "analytics-v2@4.0.0", severity: "critical", confidence: 1.0, source: "GHSA-c4w9-3vw5-6h6w, MAL-2026-14531", firstSeen: "2026-08-26" },
1603
- { type: "package", value: "@lordmega/baileys", severity: "critical", confidence: 1.0, source: "GHSA-98ch-w7w3-xfq9, MAL-2026-14540", firstSeen: "2026-08-26" },
1604
- { type: "package", value: "baileys-mbuilder", severity: "critical", confidence: 1.0, source: "GHSA-8m87-xx52-4rjw, MAL-2026-14529", firstSeen: "2026-08-26" },
1605
- { type: "package", value: "@fongsidev/scraper", severity: "critical", confidence: 1.0, source: "GHSA-cm89-9x7j-wr2g, MAL-2026-14527", firstSeen: "2026-08-26" },
1606
- { type: "package", value: "baileys-inmemory-store", severity: "critical", confidence: 1.0, source: "GHSA-gr9h-5xx6-g7cc, MAL-2026-14528", firstSeen: "2026-08-26" },
1607
- { type: "package", value: "infomedia", severity: "critical", confidence: 1.0, source: "GHSA-mpxq-q6j7-77jh, MAL-2026-14530", firstSeen: "2026-08-26" },
1608
- { type: "package", value: "pypi:bigquery-agent-analytics-tracing@0.0.0", severity: "critical", confidence: 1.0, source: "GHSA-3757-66f7-2vxg, MAL-2026-14524", firstSeen: "2026-08-26" },
1609
- { type: "package", value: "pypi:bigquery-agent-analytics-tracing@0.0.1", severity: "critical", confidence: 1.0, source: "GHSA-3757-66f7-2vxg, MAL-2026-14524", firstSeen: "2026-08-26" },
1610
- { type: "package", value: "pypi:0xfighter3@0.1", severity: "critical", confidence: 1.0, source: "GHSA-w8cx-q6rx-qfj2, MAL-2026-14525", firstSeen: "2026-08-26" },
1611
- { type: "package", value: "omniauth-recharge-rails-example@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-88ff-297x-5h43, MAL-2026-14526", firstSeen: "2026-08-26" },
1612
1573
  // Imported from GitHub Advisory Database (2026-08-14) - see docs/threat-feed-sources.md
1613
1574
  { type: "package", value: "pypi:flyteplugins-nsight@2.6.10", severity: "critical", confidence: 1.0, source: "GHSA-33m6-gx9h-9qv5, MAL-2026-14583", firstSeen: "2026-08-28" },
1614
1575
  { type: "package", value: "pypi:flyteplugins-agento11y@2.6.10", severity: "critical", confidence: 1.0, source: "GHSA-8cpp-43j8-xg7c, MAL-2026-14581", firstSeen: "2026-08-28" },
@@ -2653,7 +2614,6 @@ const FEED_CHUNK_14 = [
2653
2614
  // Imported from GitHub Advisory Database (2026-08-17) - see docs/threat-feed-sources.md
2654
2615
  { type: "package", value: "vxhjkseuiaqkb@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-2qw7-9xxw-rx96, MAL-2026-15620", firstSeen: "2026-08-31" },
2655
2616
  { type: "package", value: "skxcmwuncbg2@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-q832-gxg8-6r47, MAL-2026-15617", firstSeen: "2026-08-31" },
2656
- { type: "package", value: "testdgdbcsd", severity: "critical", confidence: 1.0, source: "GHSA-f3pc-2866-vh84, MAL-2026-15619", firstSeen: "2026-08-26" },
2657
2617
  { type: "package", value: "tesgfvbncsdbcv@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-gh7p-8vpj-q8cg, MAL-2026-15618", firstSeen: "2026-08-31" },
2658
2618
  { type: "package", value: "ndmushdkeqe@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-p464-h76r-rj42, MAL-2026-15615", firstSeen: "2026-08-31" },
2659
2619
  { type: "package", value: "ndmxchdjxn2@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-274w-3vcj-jp83, MAL-2026-15616", firstSeen: "2026-08-31" },
@@ -2667,7 +2627,6 @@ const FEED_CHUNK_14 = [
2667
2627
  { type: "package", value: "mn4xcouzvhus@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-cjhr-wxvm-qjvx, MAL-2026-15611", firstSeen: "2026-08-31" },
2668
2628
  { type: "package", value: "m3fdfocdoewn@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-qjqg-87v3-xm2f, MAL-2026-15606", firstSeen: "2026-08-31" },
2669
2629
  { type: "package", value: "m2fcsfyjkuxb@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-8pf5-9qh7-qc5h, MAL-2026-15605", firstSeen: "2026-08-31" },
2670
- { type: "package", value: "@worrisome/reutil", severity: "critical", confidence: 1.0, source: "GHSA-2pgx-9rv6-xj93, MAL-2026-15604", firstSeen: "2026-08-26" },
2671
2630
  { type: "package", value: "pypi:pyservercheck@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-p6mp-76cr-jhjq, MAL-2026-15603 (kam193)", firstSeen: "2026-08-31" },
2672
2631
  { type: "package", value: "pypi:pyservercheck@0.1.1", severity: "critical", confidence: 1.0, source: "GHSA-p6mp-76cr-jhjq, MAL-2026-15603 (kam193)", firstSeen: "2026-08-31" },
2673
2632
  { type: "package", value: "classlink-ilhmof2m", severity: "critical", confidence: 0.9, source: "GHSA-9v93-m4jq-33pq, MAL-2026-15094 (ghsa-malware)", firstSeen: "2026-08-28" },
@@ -3338,21 +3297,6 @@ const FEED_CHUNK_15 = [
3338
3297
  { type: "package", value: "isite@2025.5.1", severity: "critical", confidence: 1.0, source: "GHSA-hmvc-prpq-wwcr, MAL-2026-10735", firstSeen: "2026-08-27" },
3339
3298
  { type: "package", value: "isite@2025.7.1", severity: "critical", confidence: 1.0, source: "GHSA-hmvc-prpq-wwcr, MAL-2026-10735", firstSeen: "2026-08-27" },
3340
3299
  { type: "package", value: "@cortana-md/engine", severity: "critical", confidence: 0.9, source: "GHSA-2569-5468-g975, MAL-2026-14553 (ghsa-malware)", firstSeen: "2026-08-27" },
3341
- { type: "package", value: "mndsxcusiwlk1", severity: "critical", confidence: 0.9, source: "MAL-2026-15612", firstSeen: "2026-08-26" },
3342
- { type: "package", value: "m2fcsfyjkuxb", severity: "critical", confidence: 0.9, source: "MAL-2026-15605", firstSeen: "2026-08-26" },
3343
- { type: "package", value: "mn2adskhweox", severity: "critical", confidence: 0.9, source: "MAL-2026-15609", firstSeen: "2026-08-26" },
3344
- { type: "package", value: "mobiwaefhxc3", severity: "critical", confidence: 0.9, source: "MAL-2026-15613", firstSeen: "2026-08-26" },
3345
- { type: "package", value: "ndmxchdjxn2", severity: "critical", confidence: 0.9, source: "MAL-2026-15616", firstSeen: "2026-08-26" },
3346
- { type: "package", value: "ndmfguyhoxc3", severity: "critical", confidence: 0.9, source: "MAL-2026-15614", firstSeen: "2026-08-26" },
3347
- { type: "package", value: "tesgfvbncsdbcv", severity: "critical", confidence: 0.9, source: "MAL-2026-15618", firstSeen: "2026-08-26" },
3348
- { type: "package", value: "vxhjkseuiaqkb", severity: "critical", confidence: 0.9, source: "MAL-2026-15620", firstSeen: "2026-08-26" },
3349
- { type: "package", value: "mbxcnsuwgs1", severity: "critical", confidence: 0.9, source: "MAL-2026-15607", firstSeen: "2026-08-26" },
3350
- { type: "package", value: "skxcmwuncbg2", severity: "critical", confidence: 0.9, source: "MAL-2026-15617", firstSeen: "2026-08-26" },
3351
- { type: "package", value: "ndmushdkeqe", severity: "critical", confidence: 0.9, source: "MAL-2026-15615", firstSeen: "2026-08-26" },
3352
- { type: "package", value: "mjsdqwocvn", severity: "critical", confidence: 0.9, source: "MAL-2026-15608", firstSeen: "2026-08-26" },
3353
- { type: "package", value: "m3fdfocdoewn", severity: "critical", confidence: 0.9, source: "MAL-2026-15606", firstSeen: "2026-08-26" },
3354
- { type: "package", value: "mn3sadkoiewu", severity: "critical", confidence: 0.9, source: "MAL-2026-15610", firstSeen: "2026-08-26" },
3355
- { type: "package", value: "mn4xcouzvhus", severity: "critical", confidence: 0.9, source: "MAL-2026-15611", firstSeen: "2026-08-26" },
3356
3300
  { type: "package", value: "pypi:calcboxlite@1.0", severity: "critical", confidence: 0.9, source: "MAL-2026-15488 (amazon-inspector)", firstSeen: "2026-08-28" },
3357
3301
  // Imported from GitHub Advisory Database (2026-08-18) - see docs/threat-feed-sources.md
3358
3302
  { type: "package", value: "@yane88/hexhub-client", severity: "critical", confidence: 0.9, source: "GHSA-75h3-gh74-47p2, MAL-2026-15649 (ghsa-malware)", firstSeen: "2026-09-01" },
@@ -8104,7 +8048,6 @@ const FEED_CHUNK_20 = [
8104
8048
  { type: "package", value: "@aircanada/components", severity: "critical", confidence: 0.9, source: "GHSA-w6c3-rrw8-wxrx, MAL-2026-16018 (ghsa-malware)", firstSeen: "2026-09-07" },
8105
8049
  { type: "package", value: "@aircanada/core", severity: "critical", confidence: 0.9, source: "GHSA-46mp-56rw-qpmm, MAL-2026-16019 (ghsa-malware)", firstSeen: "2026-09-07" },
8106
8050
  { type: "package", value: "@aircanada/navigation-handler", severity: "critical", confidence: 0.9, source: "GHSA-356v-pcf2-7958, MAL-2026-16020 (ghsa-malware)", firstSeen: "2026-09-07" },
8107
- { type: "package", value: "octopus-action", severity: "critical", confidence: 1.0, source: "GHSA-27rc-jrqq-3wvj, MAL-2026-14537 (amazon-inspector+ghsa-malware)", firstSeen: "2026-08-26" },
8108
8051
  { type: "package", value: "service-home", severity: "critical", confidence: 0.9, source: "GHSA-m2c9-2v7c-fxf9, MAL-2026-16039 (ghsa-malware)", firstSeen: "2026-09-07" },
8109
8052
  { type: "package", value: "op-ts-server-core", severity: "critical", confidence: 0.9, source: "GHSA-cj4c-268v-m597, MAL-2026-16034 (ghsa-malware)", firstSeen: "2026-09-07" },
8110
8053
  { type: "package", value: "@idkruan-10/dpd-depconf-probe", severity: "critical", confidence: 0.9, source: "GHSA-994q-v55m-r2mw, MAL-2026-16021 (ghsa-malware)", firstSeen: "2026-09-07" },
@@ -9850,6 +9793,12 @@ const FEED_CHUNK_21 = [
9850
9793
  { type: "package", value: "pypi:cloushaar-poc-exfil-91827@0.0.1", severity: "critical", confidence: 1.0, source: "GHSA-6wmc-3vvj-9j5f, MAL-2026-16377 (amazon-inspector+kam193)", firstSeen: "2026-09-22" },
9851
9794
  { type: "package", value: "ruby:wurl_show_data@3.1.42.99", severity: "critical", confidence: 1.0, source: "GHSA-345f-5r88-8j64, MAL-2026-16466 (ossf-package-analysis)", firstSeen: "2026-09-22" },
9852
9795
  { type: "package", value: "eslint-config-compact-utils@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-qh87-q3mj-33jx, MAL-2026-16417 (amazon-inspector+ossf-package-analysis)", firstSeen: "2026-09-22" },
9796
+ // Imported from GitHub Advisory Database (2026-09-12) - see docs/threat-feed-sources.md
9797
+ { type: "package", value: "pypi:sherpy@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-74qh-6w69-w7vc, MAL-2026-17188 (kam193)", firstSeen: "2026-09-25" },
9798
+ { type: "package", value: "pypi:sherpy@0.1.1", severity: "critical", confidence: 1.0, source: "GHSA-74qh-6w69-w7vc, MAL-2026-17188 (kam193)", firstSeen: "2026-09-25" },
9799
+ { type: "package", value: "@digift/cli@99.99.100", severity: "critical", confidence: 1.0, source: "GHSA-2394-2grm-2336, MAL-2026-17187 (ossf-package-analysis)", firstSeen: "2026-09-25" },
9800
+ { type: "package", value: "@digift/cli@99.99.99", severity: "critical", confidence: 0.9, source: "npm registry: published by the account behind GHSA-2394-2grm-2336 in the same minute as 99.99.100, since unpublished; the advisory lists 99.99.100 only", firstSeen: "2026-09-25" },
9801
+ { type: "package", value: "@nubjs/types@0.9.4", severity: "critical", confidence: 0.9, source: "GHSA-7qx8-98q7-66p4, MAL-2026-17186 (ghsa-malware)", firstSeen: "2026-09-25" },
9853
9802
  ];
9854
9803
  // Composed from the chunks above. A single array literal of this size trips
9855
9804
  // TS2590 ("union type that is too complex to represent") in tsc; splitting it
@@ -10878,7 +10827,7 @@ function getDetectionSetProvenance(cacheDir, catalogState) {
10878
10827
  // No cache or invalid cache
10879
10828
  }
10880
10829
  return {
10881
- bundledVersion: "6.3.0",
10830
+ bundledVersion: "6.3.1",
10882
10831
  bundledEntryCount: BUNDLED_FEED.length,
10883
10832
  generatedAt: exports.FEED_GENERATED_AT,
10884
10833
  cacheMerged,