supply-chain-guard 6.3.2 → 6.3.3

package/README.md

@@ -36,7 +36,7 @@ Gate every pull request:
 
 ```yaml
 - uses: actions/checkout@v4
-- uses: homeofe/supply-chain-guard@v6.3.2
+- uses: homeofe/supply-chain-guard@v6.3.3
 ```
 
 Let your AI coding agent check a package before it installs it (MCP):
@@ -210,7 +210,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v6.3.2
+    rev: v6.3.3
     hooks:
       - id: supply-chain-guard
 ```
@@ -242,7 +242,7 @@ The hook scans the repository root on every commit and fails on high or critical
 Run the scanner without a Node toolchain via the official multi-arch image (linux/amd64, linux/arm64), published to GHCR on every release tag:
 
 ```bash
-docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.3.2 scan /scan
+docker run --rm -v ${PWD}:/scan ghcr.io/homeofe/supply-chain-guard:6.3.3 scan /scan
 ```
 
 `${PWD}` works in bash, zsh, and PowerShell; in cmd.exe use `%cd%` instead.
@@ -999,7 +999,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: homeofe/supply-chain-guard@v6.3.2
+      - uses: homeofe/supply-chain-guard@v6.3.3
         with:
           fail-on: critical
           comment-on-pr: true
@@ -1087,7 +1087,7 @@ two are never confused. If a deliberately frozen rule set is the intent, exclude
 the rule by name:
 
 ```yaml
-- uses: homeofe/supply-chain-guard@v6.3.2
+- uses: homeofe/supply-chain-guard@v6.3.3
   with:
     exclude-rules: THREAT_FEED_STALE
 ```
@@ -1158,7 +1158,7 @@ preceding `feed refresh` in the workflow does not count. `catalog: required`
 on the Action therefore needs:
 
 ```yaml
-- uses: homeofe/supply-chain-guard@v6.3.2
+- uses: homeofe/supply-chain-guard@v6.3.3
   with:
     refresh-catalog: true
 ```
@@ -1169,7 +1169,7 @@ setting rather than firing on every scan. If scanning against the bundled set
 alone is the intent, exclude the rule by name:
 
 ```yaml
-- uses: homeofe/supply-chain-guard@v6.3.2
+- uses: homeofe/supply-chain-guard@v6.3.3
   with:
     exclude-rules: THREAT_FEED_CATALOG_MISSING
 ```

package/action.yml

@@ -99,7 +99,7 @@ runs:
     - name: Install supply-chain-guard
       shell: bash
       env:
-        SCG_VERSION: "6.3.2"
+        SCG_VERSION: "6.3.3"
         SCG_EXPECTED_REPOSITORY: "homeofe/supply-chain-guard"
         SCG_EXPECTED_REPOSITORY_ID: "1185867580"
         SCG_EXPECTED_WORKFLOW: ".github/workflows/ci.yml"

package/dist/catalog-digest.d.ts

@@ -1,8 +1,8 @@
 export declare const CATALOG_DIGEST: {
-    readonly version: "6.3.2";
-    readonly sha256: "2b986e3d5e07d16bad13558323ffc5ad1f0463a3ca5a028dbf4bbeb3b4dfd7ac";
-    readonly entriesSha256: "e36ca343f6097a0a970d232244046bf90f2472a38ef90f8dc6afb469fed1b30f";
-    readonly entryCount: 87915;
+    readonly version: "6.3.3";
+    readonly sha256: "d259ff4f6b477f28c907528e979ab4bd0648d5f7d36b82b3266298d8b0d2097c";
+    readonly entriesSha256: "6cf7cd09f0812c27c2d352127e6edc1468bbb9d456667fb922204a7963f6325a";
+    readonly entryCount: 88067;
     readonly shardCount: 2;
 };
 //# sourceMappingURL=catalog-digest.d.ts.map

package/dist/catalog-digest.js

@@ -14,10 +14,10 @@ exports.CATALOG_DIGEST = void 0;
 // read off loadThreatIntel()'s hot path, is typechecked, and supplies the
 // version refreshFeed() needs to build the catalog URL.
 exports.CATALOG_DIGEST = {
-    version: "6.3.2",
-    sha256: "2b986e3d5e07d16bad13558323ffc5ad1f0463a3ca5a028dbf4bbeb3b4dfd7ac",
-    entriesSha256: "e36ca343f6097a0a970d232244046bf90f2472a38ef90f8dc6afb469fed1b30f",
-    entryCount: 87915,
+    version: "6.3.3",
+    sha256: "d259ff4f6b477f28c907528e979ab4bd0648d5f7d36b82b3266298d8b0d2097c",
+    entriesSha256: "6cf7cd09f0812c27c2d352127e6edc1468bbb9d456667fb922204a7963f6325a",
+    entryCount: 88067,
     shardCount: 2,
 };
 //# sourceMappingURL=catalog-digest.js.map

package/dist/cli.js

@@ -198,7 +198,7 @@ function assertDistinctOutputPaths(options) {
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("6.3.2");
+    .version("6.3.3");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/dependency-confusion.js

@@ -53,7 +53,7 @@ const types_js_1 = require("./types.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
 const json_utils_js_1 = require("./json-utils.js");
 const publishing_anomaly_detector_js_1 = require("./publishing-anomaly-detector.js");
-const TOOL_VERSION = "6.3.2";
+const TOOL_VERSION = "6.3.3";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 const NPM_DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
 const PYPI_REGISTRY = "https://pypi.org/pypi";

package/dist/npm-scanner.js

@@ -66,7 +66,7 @@ const threat_intel_js_1 = require("./threat-intel.js");
 const install_guard_js_1 = require("./install-guard.js");
 const json_utils_js_1 = require("./json-utils.js");
 const remote_download_js_1 = require("./remote-download.js");
-const TOOL_VERSION = "6.3.2";
+const TOOL_VERSION = "6.3.3";
 const NPM_REGISTRY = "https://registry.npmjs.org";
 const NPM_REGISTRY_HOST = "registry.npmjs.org";
 const RAW_GITHUB_HOST = "raw.githubusercontent.com";

package/dist/pypi-scanner.js

@@ -56,7 +56,7 @@ const patterns_js_1 = require("./patterns.js");
 const pattern_scanner_js_1 = require("./pattern-scanner.js");
 const extracted_file_walker_js_1 = require("./extracted-file-walker.js");
 const remote_download_js_1 = require("./remote-download.js");
-const TOOL_VERSION = "6.3.2";
+const TOOL_VERSION = "6.3.3";
 const PYPI_API = "https://pypi.org/pypi";
 const PYPI_METADATA_HOST = "pypi.org";
 const PYPI_ARTIFACT_HOST = "files.pythonhosted.org";

package/dist/reporter.js

@@ -294,7 +294,7 @@ function formatJson(report) {
 function formatText(report, options = {}) {
     const lines = [];
     // ── layout constants ───────────────────────────────────────────────────────
-    const VERSION = "6.3.2";
+    const VERSION = "6.3.3";
     const W = 76; // visible chars between "│ " and " │" (total line = 80)
     // ── ANSI helpers ───────────────────────────────────────────────────────────
     const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -739,7 +739,7 @@ function formatMarkdown(report) {
     lines.push("");
     lines.push(`| Property | Value |`);
     lines.push(`|----------|-------|`);
-    lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.3.2")}\` |`);
+    lines.push(`| Tool | \`${mdCell(report.tool || "supply-chain-guard v6.3.3")}\` |`);
     lines.push(`| Target | \`${mdCell(report.target)}\` |`);
     lines.push(`| Type | ${mdText(report.scanType)} |`);
     lines.push(`| Time | ${mdText(report.timestamp)} |`);
@@ -993,7 +993,7 @@ function formatSarif(report) {
                 tool: {
                     driver: {
                         name: "supply-chain-guard",
-                        version: "6.3.2",
+                        version: "6.3.3",
                         informationUri: "https://github.com/homeofe/supply-chain-guard",
                         rules,
                     },
@@ -1217,7 +1217,7 @@ function formatSbom(report) {
                     ...(properties.length > 0 ? { properties } : {}),
                 }];
         });
-        const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.3.2");
+        const annotations = buildIncidentAnnotations(report.incidents, subjectsByIncident, metadata.timestamp, metadata.tools.components[0]?.version ?? "6.3.3");
         const withVulns = {
             ...document,
             metadata: {
@@ -1266,7 +1266,7 @@ function formatSbom(report) {
             ...(properties.length > 0 ? { properties } : {}),
         };
     });
-    const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.3.2");
+    const fallbackAnnotations = buildIncidentAnnotations(report.incidents, fallbackSubjectsByIncident, report.timestamp, "6.3.3");
     const sbom = {
         bomFormat: "CycloneDX",
         specVersion: "1.6",
@@ -1276,7 +1276,7 @@ function formatSbom(report) {
             timestamp: report.timestamp,
             tools: {
                 components: [
-                    { type: "application", name: "supply-chain-guard", version: "6.3.2" },
+                    { type: "application", name: "supply-chain-guard", version: "6.3.3" },
                 ],
             },
             component: {
@@ -1352,8 +1352,8 @@ function formatBadge(report) {
         label: "supply-chain-guard",
         message,
         color,
-        tool: report.tool || "supply-chain-guard v6.3.2",
-        version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.3.2",
+        tool: report.tool || "supply-chain-guard v6.3.3",
+        version: report.tool ? (report.tool.includes("@") ? report.tool.split("@")[1] : report.tool.replace(/^supply-chain-guard v?/, "")) : "6.3.3",
         timestamp: report.timestamp,
         commit: report.commit ?? "none",
         detectionSet: report.detectionSet,
@@ -1409,7 +1409,7 @@ function formatGitlab(report) {
         name: "supply-chain-guard",
         url: "https://github.com/homeofe/supply-chain-guard",
         vendor: { name: "supply-chain-guard" },
-        version: "6.3.2",
+        version: "6.3.3",
     };
     const vulnerabilities = report.findings
         .filter((f) => !f.suppressed)
@@ -1534,7 +1534,7 @@ function formatJunit(report) {
     // (unreleased, issue 205): the coverage properties are ALWAYS emitted, so a JUnit
     // artefact states its own denominator instead of only what was found.
     lines.push("  <properties>");
-    lines.push(`    <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.3.2")}"/>`);
+    lines.push(`    <property name="supply-chain-guard:tool-version" value="${xmlEscape(report.tool || "supply-chain-guard v6.3.3")}"/>`);
     lines.push(`    <property name="supply-chain-guard:timestamp" value="${xmlEscape(report.timestamp)}"/>`);
     lines.push(`    <property name="supply-chain-guard:commit" value="${xmlEscape(report.commit ?? "none (not a git repository)")}"/>`);
     if (report.detectionSet) {
@@ -1664,7 +1664,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
 <body>
 <div class="container">
   <header>
-    <h1>${escapeHtml(report.tool || "supply-chain-guard v6.3.2")} Scan Report</h1>
+    <h1>${escapeHtml(report.tool || "supply-chain-guard v6.3.3")} Scan Report</h1>
     <div class="meta">
       <span>Target: ${escapeHtml(report.target)}</span>
       <span>Type: ${report.scanType}</span>
@@ -1726,7 +1726,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
   ` : ""}
 
   <footer>
-    Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.3.2")}</a>
+    Generated by <a href="https://github.com/homeofe/supply-chain-guard">${escapeHtml(report.tool || "supply-chain-guard v6.3.3")}</a>
   </footer>
 </div>
 <script>

package/dist/sbom-generator.js

@@ -87,7 +87,7 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
 const json_utils_js_1 = require("./json-utils.js");
-const TOOL_VERSION = "6.3.2";
+const TOOL_VERSION = "6.3.3";
 /** bom-ref of the component the document is about. */
 const SUBJECT_BOM_REF = "target";
 /** Property namespace, matching the `supply-chain-guard:scan-status` property reporter.ts adds. */

package/dist/scanner.js

@@ -112,7 +112,7 @@ const mcp_scanner_js_1 = require("./mcp-scanner.js");
 const skills_scanner_js_1 = require("./skills-scanner.js");
 const disguised_asset_js_1 = require("./disguised-asset.js");
 const self_scan_trust_js_1 = require("./self-scan-trust.js");
-const TOOL_VERSION = "6.3.2";
+const TOOL_VERSION = "6.3.3";
 /**
  * Pattern literals in this matcher module deliberately spell out signatures
  * that the public scanner detects. Suppress only those exact rule definitions

package/dist/threat-intel.d.ts

@@ -24,7 +24,7 @@ export type FeedIOCInput = Omit<FeedIOC, "confidence"> & {
  * Generation timestamp for the bundled IOC feed (v5.29, issue #208).
  * Pure function of feed updates; preserved across builds.
  */
-export declare const FEED_GENERATED_AT = "2026-09-28T00:00:00.000Z";
+export declare const FEED_GENERATED_AT = "2026-09-29T00:00:00.000Z";
 export declare const CACHE_DIR = ".scg-cache";
 export declare const FEED_CACHE_FILE = "threat-feed.json";
 /** Where the downloaded catalog is cached, beside the feed cache. */

package/dist/threat-intel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AA40R5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAChC,QAAQ,GACR,YAAY,GACZ,kBAAkB,GAClB,iBAAiB,GACjB,SAAS,CAAC;AAEd,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,oDAAoD;IACpD,SAAS,EAAE,OAAO,CAAC;IACnB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAeD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;CAChB;AAmBD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CAiKX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAiCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA6BhF;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA+BnF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAuBhB;AAuDD;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAE,WAAW,CAAC,MAAM,CASlE,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAM/C;AAwDD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,YAAY,GAC1B,sBAAsB,CA+CxB"}
+{"version":3,"file":"threat-intel.d.ts","sourceRoot":"","sources":["../src/threat-intel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AA8uR5D,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAChC,QAAQ,GACR,YAAY,GACZ,kBAAkB,GAClB,iBAAiB,GACjB,SAAS,CAAC;AAEd,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,oDAAoD;IACpD,SAAS,EAAE,OAAO,CAAC;IACnB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAeD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,EAAE,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,OAAO,EAAE,CAEtD;AAeD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;CAChB;AAmBD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,EAAE,CAiKX;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,GAAE,kBAAuB,GACtC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3C;AAiCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA6BhF;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA+BnF;AAsID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAgDpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAa7D;AASD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EAAE,GACd,OAAO,EAAE,CAiEX;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,GAAG,IAAI,CAuBhB;AAuDD;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAE,WAAW,CAAC,MAAM,CASlE,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAM/C;AAwDD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,YAAY,GAC1B,sBAAsB,CA+CxB"}

package/dist/threat-intel.js

@@ -63,7 +63,7 @@ const catalog_digest_js_1 = require("./catalog-digest.js");
  * Generation timestamp for the bundled IOC feed (v5.29, issue #208).
  * Pure function of feed updates; preserved across builds.
  */
-exports.FEED_GENERATED_AT = "2026-09-28T00:00:00.000Z";
+exports.FEED_GENERATED_AT = "2026-09-29T00:00:00.000Z";
 // ---------------------------------------------------------------------------
 // Default bundled feed (curated by supply-chain-guard)
 // ---------------------------------------------------------------------------
@@ -2049,98 +2049,6 @@ const FEED_CHUNK_13 = [
     // inside the base64 config blob the @hd-team / @yuming2022 packages export.
     // Single-source, hence the reduced confidence.
     { type: "domain", value: "apiyf.dq87771.com", severity: "critical", confidence: 0.85, family: "Douqiu", campaign: "Douqiu npm config server", source: "Panther", firstSeen: "2026-05-05" },
-    // Imported from GitHub Advisory Database (2026-08-15) - see docs/threat-feed-sources.md
-    { type: "package", value: "vs-modules@1.2.2", severity: "critical", confidence: 1.0, source: "GHSA-vg83-965g-3w5v, MAL-2026-15564", firstSeen: "2026-08-29" },
-    { type: "package", value: "mfakit@1.4.0", severity: "critical", confidence: 1.0, source: "GHSA-r4f7-w4j9-xj27, MAL-2026-15558", firstSeen: "2026-08-29" },
-    { type: "package", value: "secretkey2fa@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-wrp2-cvjj-h5jx, MAL-2026-15559", firstSeen: "2026-08-29" },
-    { type: "package", value: "vitest-chalk-pro@10.0.7", severity: "critical", confidence: 1.0, source: "GHSA-rjfw-6xw6-qjfx, MAL-2026-15563", firstSeen: "2026-08-29" },
-    { type: "package", value: "test-in-one@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-34hr-xghx-cfj4, MAL-2026-15562", firstSeen: "2026-08-29" },
-    { type: "package", value: "supersignaturenature@1.0.5", severity: "critical", confidence: 1.0, source: "GHSA-v7mw-8r4v-4jqq, MAL-2026-15560", firstSeen: "2026-08-29" },
-    { type: "package", value: "supersignaturenature@1.0.6", severity: "critical", confidence: 1.0, source: "GHSA-v7mw-8r4v-4jqq, MAL-2026-15560", firstSeen: "2026-08-29" },
-    { type: "package", value: "techportal@4.0.10", severity: "critical", confidence: 1.0, source: "GHSA-649g-mjr9-4j74, MAL-2026-15561", firstSeen: "2026-08-29" },
-    { type: "package", value: "js-tokens-array@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-8crw-r25r-mwv4, MAL-2026-15556", firstSeen: "2026-08-29" },
-    { type: "package", value: "js-tokens-array@1.1.1", severity: "critical", confidence: 1.0, source: "GHSA-8crw-r25r-mwv4, MAL-2026-15556", firstSeen: "2026-08-29" },
-    { type: "package", value: "mfacord@1.0.2", severity: "critical", confidence: 1.0, source: "GHSA-cx4f-wffj-qfxm, MAL-2026-15557", firstSeen: "2026-08-29" },
-    { type: "package", value: "mfacord@1.0.3", severity: "critical", confidence: 1.0, source: "GHSA-cx4f-wffj-qfxm, MAL-2026-15557", firstSeen: "2026-08-29" },
-    { type: "package", value: "js-array-tokens@1.0.2", severity: "critical", confidence: 1.0, source: "GHSA-ffxr-prpr-hxxc, MAL-2026-15555", firstSeen: "2026-08-29" },
-    { type: "package", value: "eth-pino@2.0.3", severity: "critical", confidence: 1.0, source: "GHSA-v75q-x2qc-4c7r, MAL-2026-15554", firstSeen: "2026-08-29" },
-    { type: "package", value: "ckeditor5-ckbox@5.0.0", severity: "critical", confidence: 1.0, source: "GHSA-vc6v-j5rr-3h82, MAL-2026-15549", firstSeen: "2026-08-29" },
-    { type: "package", value: "es6-migrator@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-72gm-4hgv-6x64, MAL-2026-15553", firstSeen: "2026-08-29" },
-    { type: "package", value: "date-fns-sync@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-695p-45c4-jxxh, MAL-2026-15551", firstSeen: "2026-08-29" },
-    { type: "package", value: "common-array-token@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-7x83-g5rh-27vr, MAL-2026-15550", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fa-secretkey@1.0.3", severity: "critical", confidence: 1.0, source: "GHSA-v3rj-j7jx-94vm, MAL-2026-15547", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fa-secretkey@1.0.5", severity: "critical", confidence: 1.0, source: "GHSA-v3rj-j7jx-94vm, MAL-2026-15547", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fa-secretkey@1.0.7", severity: "critical", confidence: 1.0, source: "GHSA-v3rj-j7jx-94vm, MAL-2026-15547", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fa-secretkey@1.0.4", severity: "critical", confidence: 1.0, source: "GHSA-v3rj-j7jx-94vm, MAL-2026-15547", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fa-secretkey@1.0.2", severity: "critical", confidence: 1.0, source: "GHSA-v3rj-j7jx-94vm, MAL-2026-15547", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fa-secretkey@1.0.6", severity: "critical", confidence: 1.0, source: "GHSA-v3rj-j7jx-94vm, MAL-2026-15547", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fa-secretkey@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-v3rj-j7jx-94vm, MAL-2026-15547", firstSeen: "2026-08-29" },
-    { type: "package", value: "discord-mfa@3.0.1", severity: "critical", confidence: 1.0, source: "GHSA-mv99-5h7r-288m, MAL-2026-15552", firstSeen: "2026-08-29" },
-    { type: "package", value: "discord-mfa@3.0.0", severity: "critical", confidence: 1.0, source: "GHSA-mv99-5h7r-288m, MAL-2026-15552", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fasecretkey@1.1.4", severity: "critical", confidence: 1.0, source: "GHSA-x84q-q43p-hx9p, MAL-2026-15548", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fasecretkey@1.1.3", severity: "critical", confidence: 1.0, source: "GHSA-x84q-q43p-hx9p, MAL-2026-15548", firstSeen: "2026-08-29" },
-    { type: "package", value: "2fasecretkey@1.1.2", severity: "critical", confidence: 1.0, source: "GHSA-x84q-q43p-hx9p, MAL-2026-15548", firstSeen: "2026-08-29" },
-    { type: "package", value: "@testrelic/playwright-analytics@2.13.0", severity: "critical", confidence: 1.0, source: "GHSA-73rf-vqvh-pc36, MAL-2026-15565", firstSeen: "2026-08-29" },
-    { type: "package", value: "tabbables@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-2hg9-6f65-p73j, MAL-2026-15524", firstSeen: "2026-08-29" },
-    { type: "package", value: "sycm-vendors@55.0.0", severity: "critical", confidence: 1.0, source: "GHSA-949x-vj77-3wv6, MAL-2026-15523", firstSeen: "2026-08-29" },
-    { type: "package", value: "spc-grafeno@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-5v8r-5mm2-hmh5, MAL-2026-15522", firstSeen: "2026-08-29" },
-    { type: "package", value: "search-reservation@55.0.0", severity: "critical", confidence: 1.0, source: "GHSA-293v-ghq2-4rr4, MAL-2026-15521", firstSeen: "2026-08-29" },
-    { type: "package", value: "intuit-authz@55.0.0", severity: "critical", confidence: 1.0, source: "GHSA-7v69-f2ff-7267, MAL-2026-15511", firstSeen: "2026-08-29" },
-    { type: "package", value: "qbo-ui-services@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-pqq9-pc7f-qg9c, MAL-2026-15519", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-client@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-682f-95rp-28w4, MAL-2026-15503", firstSeen: "2026-08-29" },
-    { type: "package", value: "mintel-taskbar@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-9wq2-9hhc-j47x, MAL-2026-15514", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-config@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-r3jq-7mgh-v97x, MAL-2026-15504", firstSeen: "2026-08-29" },
-    { type: "package", value: "one-intuit-help-system-utils@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-hj36-mq3p-257w, MAL-2026-15517", firstSeen: "2026-08-29" },
-    { type: "package", value: "jira-projects-backbone@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-mgjj-8534-64gp, MAL-2026-15537", firstSeen: "2026-08-29" },
-    { type: "package", value: "framework-zero@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-mpm2-wrc3-xqxf, MAL-2026-15500", firstSeen: "2026-08-29" },
-    { type: "package", value: "nx-app@9999.0.0-security-test", severity: "critical", confidence: 1.0, source: "GHSA-h9j7-rx3x-rwhc, MAL-2026-15516", firstSeen: "2026-08-29" },
-    { type: "package", value: "payments-ui-services@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-gh4x-ppwf-3j59, MAL-2026-15518", firstSeen: "2026-08-29" },
-    { type: "package", value: "integration-amplitude@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-9vjx-7728-3xp4, MAL-2026-15510", firstSeen: "2026-08-29" },
-    { type: "package", value: "data-value@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-rv73-wgh6-57xc, MAL-2026-15533", firstSeen: "2026-08-29" },
-    { type: "package", value: "katal-logger@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-29cq-8wgf-pp3w, MAL-2026-15513", firstSeen: "2026-08-29" },
-    { type: "package", value: "firestore-lite@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-r28g-prq7-6j7p, MAL-2026-15534", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-auth@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-wp54-r527-gf42, MAL-2026-15502", firstSeen: "2026-08-29" },
-    { type: "package", value: "ir-annuities-client-authentication-module@30.0.0", severity: "critical", confidence: 1.0, source: "GHSA-7q78-68r2-9222, MAL-2026-15536", firstSeen: "2026-08-29" },
-    { type: "package", value: "gridster-coords@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-m84w-xx28-rfc4, MAL-2026-15535", firstSeen: "2026-08-29" },
-    { type: "package", value: "paper-password-input@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-g76m-37ph-2w5c, MAL-2026-15542", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-sdk@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-fg63-r25c-3gf6, MAL-2026-15508", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-sdk@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-fg63-r25c-3gf6, MAL-2026-15508", firstSeen: "2026-08-29" },
-    { type: "package", value: "amplitude-session-replay@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-98c6-fgxp-vp9g, MAL-2026-15497", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-api@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-qh5m-rwf7-x3r2, MAL-2026-15501", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-api@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-qh5m-rwf7-x3r2, MAL-2026-15501", firstSeen: "2026-08-29" },
-    { type: "package", value: "calcite-web@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-r8rq-mq9v-w3g5, MAL-2026-15499", firstSeen: "2026-08-29" },
-    { type: "package", value: "sentrykit@30.0.0", severity: "critical", confidence: 1.0, source: "GHSA-mr25-fm7h-7p84, MAL-2026-15544", firstSeen: "2026-08-29" },
-    { type: "package", value: "loading-performance-instrumentation@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-3mj4-46pp-48hh, MAL-2026-15539", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-logger@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-pv35-j495-vmj4, MAL-2026-15506", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-logger@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-pv35-j495-vmj4, MAL-2026-15506", firstSeen: "2026-08-29" },
-    { type: "package", value: "confluence-editor@30.0.0", severity: "critical", confidence: 1.0, source: "GHSA-2rqw-xmmh-wfr9, MAL-2026-15531", firstSeen: "2026-08-29" },
-    { type: "package", value: "jsb-adapter@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-h756-87vq-x8w5, MAL-2026-15512", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-core@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-6g3v-w4g2-wpjc, MAL-2026-15505", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-core@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-6g3v-w4g2-wpjc, MAL-2026-15505", firstSeen: "2026-08-29" },
-    { type: "package", value: "npm-extension@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-mr8v-pmc4-42xv, MAL-2026-15515", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-utils@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-hfcc-rc45-2cgg, MAL-2026-15509", firstSeen: "2026-08-29" },
-    { type: "package", value: "aws-blog@45.0.1", severity: "critical", confidence: 1.0, source: "GHSA-hc28-xx62-mc6h, MAL-2026-15498", firstSeen: "2026-08-29" },
-    { type: "package", value: "aws-blog@45.0.2", severity: "critical", confidence: 1.0, source: "GHSA-hc28-xx62-mc6h, MAL-2026-15498", firstSeen: "2026-08-29" },
-    { type: "package", value: "aws-blog@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-hc28-xx62-mc6h, MAL-2026-15498", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-pix@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-4wxj-99qv-hg78, MAL-2026-15507", firstSeen: "2026-08-29" },
-    { type: "package", value: "grafeno-pix@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-4wxj-99qv-hg78, MAL-2026-15507", firstSeen: "2026-08-29" },
-    { type: "package", value: "vui-gateway@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-799x-vgvf-pxp4, MAL-2026-15546", firstSeen: "2026-08-29" },
-    { type: "package", value: "ring-device-settings-library@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-c9hf-9c62-jcfq, MAL-2026-15520", firstSeen: "2026-08-29" },
-    { type: "package", value: "ring-device-settings-library@30.0.0", severity: "critical", confidence: 1.0, source: "GHSA-c9hf-9c62-jcfq, MAL-2026-15520", firstSeen: "2026-08-29" },
-    { type: "package", value: "axis-datagrid@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-c6gq-r9w4-xg7j, MAL-2026-15528", firstSeen: "2026-08-29" },
-    { type: "package", value: "librastandardlib@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-g4fg-jh8h-vf3p, MAL-2026-15538", firstSeen: "2026-08-29" },
-    { type: "package", value: "amplitude-experiment@55.0.0", severity: "critical", confidence: 1.0, source: "GHSA-758g-5xc5-pm3c, MAL-2026-15496", firstSeen: "2026-08-29" },
-    { type: "package", value: "confluence-create-content@30.0.0", severity: "critical", confidence: 1.0, source: "GHSA-8crp-r538-9mwc, MAL-2026-15530", firstSeen: "2026-08-29" },
-    { type: "package", value: "alimama-minisite@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-587j-f248-fmvr, MAL-2026-15495", firstSeen: "2026-08-29" },
-    { type: "package", value: "ux-metrics-client-interaction-subscriber@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-fgwj-qvjx-g92h, MAL-2026-15545", firstSeen: "2026-08-29" },
-    { type: "package", value: "mkt-ui-library@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-58mp-f2cw-5j5r, MAL-2026-15540", firstSeen: "2026-08-29" },
-    { type: "package", value: "prm-bundles@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-x86v-25gf-7xc2, MAL-2026-15543", firstSeen: "2026-08-29" },
-    { type: "package", value: "oit-lib-oracle-util@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-8jwf-jxvr-v3qg, MAL-2026-15541", firstSeen: "2026-08-29" },
-    { type: "package", value: "confluence-rest@30.0.0", severity: "critical", confidence: 1.0, source: "GHSA-wxw7-x2qj-6jh2, MAL-2026-15532", firstSeen: "2026-08-29" },
-    { type: "package", value: "bui-react-10themes@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-jv92-xghh-84rr, MAL-2026-15529", firstSeen: "2026-08-29" },
-    { type: "package", value: "amplitude-react-native@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-52v2-39v7-55rp, MAL-2026-15525", firstSeen: "2026-08-29" },
-    { type: "package", value: "aura-instrumentation@45.0.0", severity: "critical", confidence: 1.0, source: "GHSA-xfhp-m3mp-45jf, MAL-2026-15527", firstSeen: "2026-08-29" },
-    { type: "package", value: "analytics-web-client@30.0.0", severity: "critical", confidence: 1.0, source: "GHSA-rr65-7f7g-2fjp, MAL-2026-15526", firstSeen: "2026-08-29" },
     // Imported from GitHub Advisory Database (2026-08-16) - see docs/threat-feed-sources.md
     { type: "package", value: "gclassroom", severity: "critical", confidence: 0.9, source: "GHSA-6c25-pq89-3m9w", firstSeen: "2026-08-30" },
     { type: "package", value: "opiumbest", severity: "critical", confidence: 0.9, source: "GHSA-pwqr-5gcr-9rc4", firstSeen: "2026-08-30" },
@@ -2148,55 +2056,6 @@ const FEED_CHUNK_13 = [
     { type: "package", value: "grafeno-webhook@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-477g-wmjw-mjmr, MAL-2026-15573", firstSeen: "2026-08-30" },
     { type: "package", value: "grafeno-billing@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-8x3v-8vvh-78qm, MAL-2026-15571", firstSeen: "2026-08-30" },
     { type: "package", value: "grafeno-payments@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-wv93-x8h7-2vq7, MAL-2026-15572", firstSeen: "2026-08-30" },
-    { type: "package", value: "node-net-pool", severity: "critical", confidence: 1.0, source: "GHSA-vm9g-mp9v-6q5p, MAL-2026-15570", firstSeen: "2026-08-29" },
-    { type: "package", value: "supersignaturenature", severity: "critical", confidence: 1.0, source: "GHSA-x67q-xvcf-f2rw, MAL-2026-15560", firstSeen: "2026-08-29" },
-    { type: "package", value: "manager-thedate", severity: "critical", confidence: 1.0, source: "GHSA-3rww-v3p8-fw9p, MAL-2026-15568", firstSeen: "2026-08-29" },
-    { type: "package", value: "htps-provider", severity: "critical", confidence: 1.0, source: "GHSA-gcqr-3vw3-7fqm, MAL-2026-15567", firstSeen: "2026-08-29" },
-    { type: "package", value: "nuvyra-marketplace-sdk", severity: "critical", confidence: 1.0, source: "GHSA-rq2p-956p-32h6, MAL-2026-15569", firstSeen: "2026-08-29" },
-    { type: "package", value: "axis-datagrid", severity: "critical", confidence: 1.0, source: "GHSA-7f64-56gx-r4cm, MAL-2026-15528", firstSeen: "2026-08-29" },
-    { type: "package", value: "vui-gateway", severity: "critical", confidence: 1.0, source: "GHSA-69cq-ggff-w363, MAL-2026-15546", firstSeen: "2026-08-29" },
-    { type: "package", value: "librastandardlib", severity: "critical", confidence: 1.0, source: "GHSA-p943-f2p4-7xfx, MAL-2026-15538", firstSeen: "2026-08-29" },
-    { type: "package", value: "katal-logger", severity: "critical", confidence: 1.0, source: "GHSA-f2rf-58x5-5f6w, MAL-2026-15513", firstSeen: "2026-08-29" },
-    { type: "package", value: "nx-app", severity: "critical", confidence: 1.0, source: "GHSA-vmrp-3pwx-mj42, MAL-2026-15516", firstSeen: "2026-08-29" },
-    { type: "package", value: "prm-bundles", severity: "critical", confidence: 1.0, source: "GHSA-g57v-rj8p-j52h, MAL-2026-15543", firstSeen: "2026-08-29" },
-    { type: "package", value: "ux-metrics-client-interaction-subscriber", severity: "critical", confidence: 1.0, source: "GHSA-5v45-27j3-r52f, MAL-2026-15545", firstSeen: "2026-08-29" },
-    { type: "package", value: "integration-amplitude", severity: "critical", confidence: 1.0, source: "GHSA-m5fj-7mm7-mg9p, MAL-2026-15510", firstSeen: "2026-08-29" },
-    { type: "package", value: "tabbables", severity: "critical", confidence: 1.0, source: "GHSA-4g4c-9232-9cwv, MAL-2026-15524", firstSeen: "2026-08-29" },
-    { type: "package", value: "framework-zero", severity: "critical", confidence: 1.0, source: "GHSA-c583-7r3r-x2p8, MAL-2026-15500", firstSeen: "2026-08-29" },
-    { type: "package", value: "oit-lib-oracle-util", severity: "critical", confidence: 1.0, source: "GHSA-rqm2-xgr5-297v, MAL-2026-15541", firstSeen: "2026-08-29" },
-    { type: "package", value: "paper-password-input", severity: "critical", confidence: 1.0, source: "GHSA-p8fv-qch5-j7m9, MAL-2026-15542", firstSeen: "2026-08-29" },
-    { type: "package", value: "payments-ui-services", severity: "critical", confidence: 1.0, source: "GHSA-jhxr-q6vp-9x3m, MAL-2026-15518", firstSeen: "2026-08-29" },
-    { type: "package", value: "loading-performance-instrumentation", severity: "critical", confidence: 1.0, source: "GHSA-hx7g-4f5f-7hq9, MAL-2026-15539", firstSeen: "2026-08-29" },
-    { type: "package", value: "npm-extension", severity: "critical", confidence: 1.0, source: "GHSA-f2fx-3q3p-v293, MAL-2026-15515", firstSeen: "2026-08-29" },
-    { type: "package", value: "mintel-taskbar", severity: "critical", confidence: 1.0, source: "GHSA-x2qj-v4rx-3phv, MAL-2026-15514", firstSeen: "2026-08-29" },
-    { type: "package", value: "jsb-adapter", severity: "critical", confidence: 1.0, source: "GHSA-69pf-x798-g22x, MAL-2026-15512", firstSeen: "2026-08-29" },
-    { type: "package", value: "gridster-coords", severity: "critical", confidence: 1.0, source: "GHSA-fq5c-v7fm-mv99, MAL-2026-15535", firstSeen: "2026-08-29" },
-    { type: "package", value: "jira-projects-backbone", severity: "critical", confidence: 1.0, source: "GHSA-8569-7m7w-7gf9, MAL-2026-15537", firstSeen: "2026-08-29" },
-    { type: "package", value: "alimama-minisite", severity: "critical", confidence: 1.0, source: "GHSA-q5h9-9fg7-xg2g, MAL-2026-15495", firstSeen: "2026-08-29" },
-    { type: "package", value: "data-value", severity: "critical", confidence: 1.0, source: "GHSA-rq5q-gpqf-p4vp, MAL-2026-15533", firstSeen: "2026-08-29" },
-    { type: "package", value: "qbo-ui-services", severity: "critical", confidence: 1.0, source: "GHSA-j5hx-563p-m829, MAL-2026-15519", firstSeen: "2026-08-29" },
-    { type: "package", value: "calcite-web", severity: "critical", confidence: 1.0, source: "GHSA-fhxc-p24q-34ch, MAL-2026-15499", firstSeen: "2026-08-29" },
-    { type: "package", value: "firestore-lite", severity: "critical", confidence: 1.0, source: "GHSA-q556-gm72-jcp7, MAL-2026-15534", firstSeen: "2026-08-29" },
-    { type: "package", value: "amplitude-react-native", severity: "critical", confidence: 1.0, source: "GHSA-wxgr-5x7q-cc86, MAL-2026-15525", firstSeen: "2026-08-29" },
-    { type: "package", value: "ir-annuities-client-authentication-module", severity: "critical", confidence: 1.0, source: "GHSA-4hpj-q7v8-mjf7, MAL-2026-15536", firstSeen: "2026-08-29" },
-    { type: "package", value: "analytics-web-client", severity: "critical", confidence: 1.0, source: "GHSA-5g5q-647h-8vv8, MAL-2026-15526", firstSeen: "2026-08-29" },
-    { type: "package", value: "confluence-create-content", severity: "critical", confidence: 1.0, source: "GHSA-j52x-8r24-hw6x, MAL-2026-15530", firstSeen: "2026-08-29" },
-    { type: "package", value: "amplitude-experiment", severity: "critical", confidence: 1.0, source: "GHSA-4qr2-j5wh-f48g, MAL-2026-15496", firstSeen: "2026-08-29" },
-    { type: "package", value: "mkt-ui-library", severity: "critical", confidence: 1.0, source: "GHSA-w4pq-8q38-v8jr, MAL-2026-15540", firstSeen: "2026-08-29" },
-    { type: "package", value: "confluence-editor", severity: "critical", confidence: 1.0, source: "GHSA-cwcw-cv28-7jfm, MAL-2026-15531", firstSeen: "2026-08-29" },
-    { type: "package", value: "sentrykit", severity: "critical", confidence: 1.0, source: "GHSA-qq6h-882h-g88f, MAL-2026-15544", firstSeen: "2026-08-29" },
-    { type: "package", value: "intuit-authz", severity: "critical", confidence: 1.0, source: "GHSA-vp52-xxhf-m857, MAL-2026-15511", firstSeen: "2026-08-29" },
-    { type: "package", value: "confluence-rest", severity: "critical", confidence: 1.0, source: "GHSA-g338-wxvv-vg5q, MAL-2026-15532", firstSeen: "2026-08-29" },
-    { type: "package", value: "ring-device-settings-library", severity: "critical", confidence: 1.0, source: "GHSA-f4f7-3wwr-hxfx, MAL-2026-15520", firstSeen: "2026-08-29" },
-    { type: "package", value: "bui-react-10themes", severity: "critical", confidence: 1.0, source: "GHSA-mj9w-ffv9-m8rf, MAL-2026-15529", firstSeen: "2026-08-29" },
-    { type: "package", value: "amplitude-session-replay", severity: "critical", confidence: 1.0, source: "GHSA-jvwx-f8cc-jjj8, MAL-2026-15497", firstSeen: "2026-08-29" },
-    { type: "package", value: "sycm-vendors", severity: "critical", confidence: 1.0, source: "GHSA-7h72-24vr-wrf6, MAL-2026-15523", firstSeen: "2026-08-29" },
-    { type: "package", value: "one-intuit-help-system-utils", severity: "critical", confidence: 1.0, source: "GHSA-93c7-v93p-97cw, MAL-2026-15517", firstSeen: "2026-08-29" },
-    { type: "package", value: "search-reservation", severity: "critical", confidence: 1.0, source: "GHSA-j5xq-g44w-jh7c, MAL-2026-15521", firstSeen: "2026-08-29" },
-    { type: "package", value: "aura-instrumentation", severity: "critical", confidence: 1.0, source: "GHSA-p4vf-c829-4m2m, MAL-2026-15527", firstSeen: "2026-08-29" },
-    { type: "package", value: "aws-blog", severity: "critical", confidence: 1.0, source: "GHSA-q8ww-mqrw-jq9q, MAL-2026-15498", firstSeen: "2026-08-29" },
-    { type: "package", value: "vs-modules", severity: "critical", confidence: 1.0, source: "GHSA-8hpw-v4hq-pg99, MAL-2026-15564", firstSeen: "2026-08-29" },
-    { type: "package", value: "pypi:flask-header-guard@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-gmgc-w467-4xf7, MAL-2026-15566", firstSeen: "2026-08-29" },
 ];
 const FEED_CHUNK_14 = [
     // Imported from GitHub Advisory Database (2026-08-16) - see docs/threat-feed-sources.md
@@ -6748,8 +6607,6 @@ const FEED_CHUNK_19 = [
     { type: "package", value: "com.db.autobahn.notification-center-electron@88.88.1", severity: "critical", confidence: 1.0, source: "GHSA-q6wc-5f8x-wwwj, MAL-2026-15590 (amazon-inspector+ossf-package-analysis)", firstSeen: "2026-08-30" },
     { type: "package", value: "autobahn-electron-probe@99.99.2", severity: "critical", confidence: 1.0, source: "GHSA-8jx3-79xq-v4q4, MAL-2026-15589 (amazon-inspector+ossf-package-analysis)", firstSeen: "2026-08-30" },
     { type: "package", value: "autobahn-electron-probe@99.99.3", severity: "critical", confidence: 1.0, source: "GHSA-8jx3-79xq-v4q4, MAL-2026-15589 (amazon-inspector+ossf-package-analysis)", firstSeen: "2026-08-30" },
-    { type: "package", value: "mfacord@1.0.4", severity: "critical", confidence: 1.0, source: "GHSA-cx4f-wffj-qfxm, MAL-2026-15557 (amazon-inspector)", firstSeen: "2026-08-29" },
-    { type: "package", value: "mfacord@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-cx4f-wffj-qfxm, MAL-2026-15557 (amazon-inspector)", firstSeen: "2026-08-29" },
     { type: "hash", value: "8e5d1af68ca340ae0c6e8132cb00c686ec2d60502c1994d94ce353d1472ad5a3", severity: "critical", confidence: 1.0, family: "Shai-Hulud", campaign: "Trinitite", source: "safedep, Aikido", firstSeen: "2026-08-28" },
     { type: "hash", value: "b49afb7dba04cd99b357ce7c652c823a3707f28e130bd5c6645851a7adc030d6", severity: "critical", confidence: 1.0, family: "Shai-Hulud", campaign: "Trinitite", source: "Socket, safedep, Aikido", firstSeen: "2026-08-28" },
     { type: "hash", value: "709af2fdeb50324229e94c44c679a0fab18bd8e17d3864405989c526cbb63ad8", severity: "critical", confidence: 1.0, family: "Shai-Hulud", campaign: "Trinitite", source: "safedep, Aikido", firstSeen: "2026-08-28" },
@@ -6939,8 +6796,6 @@ const FEED_CHUNK_20 = [
     { type: "package", value: "guci-wxrout", severity: "critical", confidence: 0.9, source: "GHSA-wm72-hv9c-mxxr, MAL-2026-15886 (ghsa-malware)", firstSeen: "2026-09-03" },
     { type: "package", value: "guci-main", severity: "critical", confidence: 0.9, source: "GHSA-xv44-v947-3jrh, MAL-2026-15885 (ghsa-malware)", firstSeen: "2026-09-03" },
     { type: "package", value: "guci-date", severity: "critical", confidence: 0.9, source: "GHSA-pg5x-8f3x-f3x5, MAL-2026-15884 (ghsa-malware)", firstSeen: "2026-09-03" },
-    // Imported from GitHub Advisory Database (2026-08-22) - see docs/threat-feed-sources.md
-    { type: "package", value: "techportal@4.0.11", severity: "critical", confidence: 1.0, source: "GHSA-649g-mjr9-4j74, MAL-2026-15561", firstSeen: "2026-08-29" },
     // Corroborated advisories that sit inside the 2026-09-02 / 2026-09-04 bulk-backfill
     // days, added by hand so they are not lost when that window ages out. Each was probed
     // against registry.npmjs.org: the two live packages are version-pinned, never name-blocked.
@@ -7140,7 +6995,6 @@ const FEED_CHUNK_20 = [
     { type: "package", value: "i18nexus-tools", severity: "critical", confidence: 1.0, source: "GHSA-9cfw-xh4g-cc2f, MAL-2026-16046 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-08" },
     { type: "package", value: "i18nexus", severity: "critical", confidence: 0.9, source: "GHSA-38hw-f37p-99jj, MAL-2026-16045 (ghsa-malware)", firstSeen: "2026-09-08" },
     { type: "package", value: "@web2apk/baileys", severity: "critical", confidence: 1.0, source: "GHSA-f4f2-cqqp-jcrx, MAL-2026-16043 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-08" },
-    { type: "package", value: "es6-migrator@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-72gm-4hgv-6x64, MAL-2026-15553 (amazon-inspector)", firstSeen: "2026-08-29" },
     { type: "package", value: "cache-cleanup-module@2.6.0", severity: "critical", confidence: 0.9, source: "MAL-2026-16078 (amazon-inspector)", firstSeen: "2026-09-09" },
     { type: "package", value: "cache-cleanup-module@2.5.0", severity: "critical", confidence: 0.9, source: "MAL-2026-16078 (amazon-inspector)", firstSeen: "2026-09-09" },
     { type: "package", value: "open-item-validator@1.0.2", severity: "critical", confidence: 0.9, source: "MAL-2026-16052 (amazon-inspector)", firstSeen: "2026-09-08" },
@@ -7203,7 +7057,6 @@ const FEED_CHUNK_20 = [
     { type: "package", value: "@vnxsync/libsignal-node", severity: "critical", confidence: 0.9, source: "GHSA-369v-phqf-c9g9, MAL-2026-16083 (ghsa-malware)", firstSeen: "2026-09-09" },
     { type: "package", value: "@fyxzpediaa/baileys@9.1.0", severity: "critical", confidence: 1.0, source: "GHSA-5wxh-fwcf-rv5j, MAL-2026-16070 (amazon-inspector)", firstSeen: "2026-09-09" },
     { type: "package", value: "mfafix@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-f2gv-xpgh-37r5, MAL-2026-15630 (amazon-inspector)", firstSeen: "2026-08-31" },
-    { type: "package", value: "@testrelic/playwright-analytics@2.12.1-next.88", severity: "critical", confidence: 1.0, source: "GHSA-73rf-vqvh-pc36, MAL-2026-15565 (amazon-inspector)", firstSeen: "2026-08-29" },
     // Baileys WhatsApp fork credential-theft campaign, lotusbail leg (December 2025).
     // An attacker-authored fork of @whiskeysockets/baileys published by a throwaway
     // account, which kept the real WhatsApp send/receive behaviour working while
@@ -8819,6 +8672,58 @@ const FEED_CHUNK_21 = [
     { type: "package", value: "@bb1ptest23/test-paket@1.0.3", severity: "critical", confidence: 0.9, source: "MAL-2026-17201 (ossf-package-analysis)", firstSeen: "2026-09-28" },
     // Atomic indicators from the per-source analyses of the advisories above (OSV).
     { type: "domain", value: "84avt3516s4q1obsv9q0mh4u2l8dw3ks.x9.to", severity: "critical", confidence: 0.9, campaign: "metrics-sdk PyPI dependency-confusion beacon", source: "MAL-2026-17194 (amazon-inspector)", firstSeen: "2026-09-27" },
+    // Imported from GitHub Advisory Database (2026-09-15) - see docs/threat-feed-sources.md
+    { type: "package", value: "rai6jaisahthaghee5ou-loader-package@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-hhf7-grh4-575w, MAL-2026-17238 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "native-env@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-9p6x-527c-vh8p, MAL-2026-17237 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "hardhat-lock@2.21.0", severity: "critical", confidence: 1.0, source: "GHSA-crqg-xv46-qmmw, MAL-2026-17233 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "pypi:aseitylab@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-jv9w-2v63-767g, MAL-2026-17240 (amazon-inspector+kam193)", firstSeen: "2026-09-28" },
+    { type: "package", value: "pypi:aseitylab@0.1.1", severity: "critical", confidence: 1.0, source: "GHSA-jv9w-2v63-767g, MAL-2026-17240 (amazon-inspector+kam193)", firstSeen: "2026-09-28" },
+    { type: "package", value: "mini-hardhat@1.1.4", severity: "critical", confidence: 1.0, source: "GHSA-wxx2-jv4c-38wh, MAL-2026-17236 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "test-agency-assignment@1.0.2", severity: "critical", confidence: 1.0, source: "GHSA-7x83-rfhr-656r, MAL-2026-17239 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "items-validator@1.0.5", severity: "critical", confidence: 1.0, source: "GHSA-hvv9-35pw-8qvf, MAL-2026-17235 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "hardhat-zet@2.0.1", severity: "critical", confidence: 1.0, source: "GHSA-qqvr-prmw-6pq2, MAL-2026-17234 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "fabric-native-loader@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-h76r-hhqx-cjq3, MAL-2026-17232 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "dotenv-native@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-438j-7xq6-grfr, MAL-2026-17231 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "llm-nebula@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-8g48-f52v-xggv, MAL-2026-17230 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "nebulaai-sdk@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-57f4-h93r-jvh6, MAL-2026-17228 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "simple-date-formatter-new-12@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-v6p6-9wrj-f56p, MAL-2026-17229 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "nebula-llm@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-5ph8-m4r7-g739, MAL-2026-17227 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "figlet-chalk-render@1.2.1", severity: "critical", confidence: 1.0, source: "GHSA-frpq-rj8q-hpr4, MAL-2026-17226 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "fabric-render-bridge@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-r54m-4q33-rjvr, MAL-2026-17225 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "fabric-asset-pipeline@1.0.1", severity: "critical", confidence: 1.0, source: "GHSA-2h5p-2j55-g9r4, MAL-2026-17224 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "fabric-asset-pipeline@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-2h5p-2j55-g9r4, MAL-2026-17224 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "chalk-figlet@1.2.0", severity: "critical", confidence: 1.0, source: "GHSA-85m5-qg46-qg28, MAL-2026-17223 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "@digift/cli", severity: "critical", confidence: 1.0, source: "GHSA-xp76-38xh-m8wc, MAL-2026-17187 (ghsa-malware+ossf-package-analysis)", firstSeen: "2026-09-25" },
+    { type: "package", value: "img-to-native", severity: "critical", confidence: 1.0, source: "GHSA-pv7p-ghgv-268x, MAL-2026-17216 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "native-runner", severity: "critical", confidence: 1.0, source: "GHSA-jxw5-69p3-hpm4, MAL-2026-17218 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "nebulajs-api", severity: "critical", confidence: 1.0, source: "GHSA-2gr6-gxvx-3594, MAL-2026-17220 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "nebula-sdk", severity: "critical", confidence: 1.0, source: "GHSA-fm5g-6rr8-p9vq, MAL-2026-17219 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "vite-plugin-crypto", severity: "critical", confidence: 1.0, source: "GHSA-mh9w-qr45-6wrq, MAL-2026-17222 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "tailwindcss-form-kit", severity: "critical", confidence: 0.9, source: "GHSA-cxrh-669r-w2g9, MAL-2026-17221 (ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "my-skibidi@1.0.0", severity: "critical", confidence: 1.0, source: "GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "my-skibidi@1.0.2", severity: "critical", confidence: 1.0, source: "GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "my-skibidi@1.0.3", severity: "critical", confidence: 1.0, source: "GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "my-skibidi@1.1.1", severity: "critical", confidence: 1.0, source: "GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "my-skibidi@1.1.2", severity: "critical", confidence: 1.0, source: "GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "my-skibidi@1.1.3", severity: "critical", confidence: 1.0, source: "GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "my-skibidi@1.1.4", severity: "critical", confidence: 1.0, source: "GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "my-skibidi@1.1.5", severity: "critical", confidence: 1.0, source: "GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "my-skibidi@1.1.6", severity: "critical", confidence: 1.0, source: "GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "git-en-boite-logging@0.0.0", severity: "critical", confidence: 1.0, source: "GHSA-33v8-h584-r8xc, MAL-2026-17214 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "eslint-plugin-skywagon-web@100.0.0", severity: "critical", confidence: 1.0, source: "GHSA-pfgw-q545-ch2m, MAL-2026-17215 (amazon-inspector)", firstSeen: "2026-09-28" },
+    { type: "package", value: "pypi:azure-langchain-example@0.1.0", severity: "critical", confidence: 1.0, source: "GHSA-h82v-pqpv-jr3r, MAL-2026-17213 (amazon-inspector+kam193)", firstSeen: "2026-09-28" },
+    { type: "package", value: "@wbnr/design-kit", severity: "critical", confidence: 0.9, source: "GHSA-865f-pwj5-p2c5, MAL-2026-17204 (ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "@wbnr/lottiefiles-loader", severity: "critical", confidence: 0.9, source: "GHSA-94r6-cxjq-fq4r, MAL-2026-17205 (ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "wbnr-probe-visible-check", severity: "critical", confidence: 0.9, source: "GHSA-65gf-jmp3-4wrc, MAL-2026-17212 (ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "kalasnik-npm-simple-test", severity: "critical", confidence: 1.0, source: "GHSA-pm4h-xrhq-vh62, MAL-2026-17206 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "kjj81", severity: "critical", confidence: 0.9, source: "GHSA-9f7c-6fp7-9g6x, MAL-2026-17207 (ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "uuid-date", severity: "critical", confidence: 0.9, source: "GHSA-pqvc-prrc-mv45, MAL-2026-17210 (ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "riot-private", severity: "critical", confidence: 0.9, source: "GHSA-qgpm-ggcf-4fqm, MAL-2026-17208 (ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "ultra-ws", severity: "critical", confidence: 1.0, source: "GHSA-rwhp-v7w5-c6cc, MAL-2026-16155 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-14" },
+    { type: "package", value: "discord-mfa-solver", severity: "critical", confidence: 1.0, source: "GHSA-vf4w-775x-ccfh, MAL-2026-16100 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-09" },
+    { type: "package", value: "vinzzsync-wacli", severity: "critical", confidence: 0.9, source: "GHSA-rmcq-f7vh-v86v, MAL-2026-17211 (ghsa-malware)", firstSeen: "2026-09-28" },
+    { type: "package", value: "open-item-validator", severity: "critical", confidence: 1.0, source: "GHSA-55qh-42r8-hcgq, MAL-2026-16052 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-08" },
+    { type: "package", value: "tanksync", severity: "critical", confidence: 1.0, source: "GHSA-47j4-w95p-wjp7, MAL-2026-17209 (amazon-inspector+ghsa-malware)", firstSeen: "2026-09-28" },
 ];
 // Composed from the chunks above. A single array literal of this size trips
 // TS2590 ("union type that is too complex to represent") in tsc; splitting it
@@ -9847,7 +9752,7 @@ function getDetectionSetProvenance(cacheDir, catalogState) {
         // No cache or invalid cache
     }
     return {
-        bundledVersion: "6.3.2",
+        bundledVersion: "6.3.3",
         bundledEntryCount: BUNDLED_FEED.length,
         generatedAt: exports.FEED_GENERATED_AT,
         cacheMerged,