{"id":"CVE-2026-62369","revision":null,"records":[{"revision":"378dbd13223246ea8967b350d728f1d1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-62369","aliases":[],"title":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join","description":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","state":0,"publishedAt":"2026-09-21T17:10:57.979+00:00","modifiedAt":"2026-09-24T22:24:33.145+00:00","affected":[{"ecosystem":"Vendor product","name":"kubeedge","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"kubeedge\",\n                    \"product\": \"kubeedge\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.16.0, < 1.21.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.22.0, < 1.22.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.23.0, < 1.23.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d","https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047","https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62369","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-62369","identifiers":["CVE-2026-62369"]},"retained":false,"historicalAffected":[]},{"revision":"e5b84229ee174807b1a9014ac7578a61","observedAt":"2026-11-11T15:04:55.962+00:00","statement":{"source":"euvd","id":"EUVD-2026-84005","aliases":["CVE-2026-62369","GHSA-9vm9-pqxx-x83v"],"title":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.…","description":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","score":8.1,"severity":null}],"references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d","https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047","https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84005","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 21, 2026, 5:10:57 PM","dateUpdated":"Sep 24, 2026, 10:24:33 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-84005","identifiers":["EUVD-2026-84005","CVE-2026-62369","GHSA-9vm9-pqxx-x83v"]},"retained":false,"historicalAffected":[]},{"revision":"d1817681cbeb475786a8badbbc68825a","observedAt":"2026-10-25T14:19:28.838+00:00","statement":{"source":"nvd","id":"CVE-2026-62369","aliases":[],"title":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.…","description":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","state":0,"publishedAt":"2026-09-21T18:17:09.58+00:00","modifiedAt":"2026-09-24T23:17:14.04+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d","https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047","https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1","https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62369","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-09-21T18:17:09.580","lastModified":"2026-09-24T23:17:14.040"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-62369","identifiers":["CVE-2026-62369"]},"retained":false,"historicalAffected":[]},{"revision":"d653e800f1bc4f7a8ff67f6233a18acf","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-9vm9-pqxx-x83v","aliases":["CVE-2026-62369","GO-2026-6563"],"title":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join","description":"## Description\n\nKubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction function.\n\nArchive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory.\n\nThe issue is particularly relevant to Windows edge nodes during the `keadm join` or installation process when `keadm` extracts downloaded component archives.\n\n## Impact\n\nAn attacker who can cause an affected `keadm` process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running `keadm`.\n\nOn Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the `keadm` process, successful exploitation could lead to persistent system modification or code execution.\n\nExploitation requires the attacker to influence the contents of an archive processed by `keadm`, such as through a compromised, replaced, or otherwise untrusted download source.\n\n## Patches\n\nThe extraction logic now:\n\n* resolves the destination directory to an absolute path;\n* rejects empty archive entry names;\n* normalizes Windows-style path separators before validation;\n* rejects parent-directory traversal paths;\n* rejects absolute and Windows drive-prefixed paths;\n* uses `filepath-securejoin` to ensure extracted files remain within the destination directory.\n\nFixes are planned for the following maintained releases:\n\n* v1.23.1\n* v1.22.2\n* v1.21.2\n\n## Workarounds\n\nUntil a patched release is available:\n\n* only install or join edge nodes using trusted KubeEdge package sources;\n* verify the integrity and origin of downloaded archives before extraction;\n* do not use custom or untrusted component archives with `keadm`;\n* restrict write permissions and administrative privileges for the account running `keadm`;\n* avoid performing Windows edge-node installation or join operations when the package source cannot be trusted.\n\n## Credits\n\nKubeEdge thanks Sang-Hoon Choi ([KoreaSecurity](https://github.com/KoreaSecurity), Sejong University)\nfor responsibly reporting this issue and for coordinating with the KubeEdge\nmaintainers through the security disclosure process.","state":0,"publishedAt":"2026-09-22T20:36:59+00:00","modifiedAt":"2026-10-01T20:55:52.7774522+00:00","affected":[{"ecosystem":"Go","name":"github.com/kubeedge/kubeedge","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.16.0"},{"kind":"fixed","version":"1.21.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/kubeedge/kubeedge","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.22.0"},{"kind":"fixed","version":"1.22.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/kubeedge/kubeedge","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.23.0"},{"kind":"fixed","version":"1.23.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v","https://nvd.nist.gov/vuln/detail/CVE-2026-62369","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d","https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047","https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40","https://github.com/kubeedge/kubeedge","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"sourceUrl":"https://github.com/advisories/GHSA-9vm9-pqxx-x83v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9vm9-pqxx-x83v","identifiers":["GHSA-9vm9-pqxx-x83v","CVE-2026-62369","GO-2026-6563"]},"retained":false,"historicalAffected":[]},{"revision":"c1349f550d1843a589dbb2f117f125e9","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6563","aliases":["CVE-2026-62369","GHSA-9vm9-pqxx-x83v"],"title":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge","description":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge","state":0,"publishedAt":"2026-10-01T20:23:38+00:00","modifiedAt":"2026-10-01T20:45:13.1826614+00:00","affected":[{"ecosystem":"Go","name":"github.com/kubeedge/kubeedge","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.16.0"},{"kind":"fixed","version":"1.21.2"},{"kind":"introduced","version":"1.22.0"},{"kind":"fixed","version":"1.22.2"},{"kind":"introduced","version":"1.23.0"},{"kind":"fixed","version":"1.23.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v","https://nvd.nist.gov/vuln/detail/CVE-2026-62369","https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d","https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047","https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6563","license":"OSV · upstream source license applies","key":"osv:GO-2026-6563","identifiers":["GO-2026-6563","CVE-2026-62369","GHSA-9vm9-pqxx-x83v"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7696899+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7696907+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-0cd050aa4e3407be88a99da87c4684cdd6e2bb2192e7b5d8516c5221fe2996c0","complete":true,"records":424321,"lastAttemptAt":"2026-11-11T21:56:53.6118096+00:00","lastSuccessAt":"2026-11-11T21:56:53.4062549+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.6118096+00:00","snapshotPublishedAt":"2026-11-11T21:25:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0211f24f7dd2479496f11922c7aad014","complete":false,"records":13760,"lastAttemptAt":"2026-11-11T22:09:10.3527395+00:00","lastSuccessAt":"2026-11-11T22:09:09.323+00:00","error":"346 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T22:09:09.323+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13257,"expectedIdentifiers":13813,"failedIdentifiers":346},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7704457+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7704461+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e103bc43c8e54398a828cba9bdd81bf5","complete":true,"records":13754,"lastAttemptAt":"2026-11-11T21:59:28.9840194+00:00","lastSuccessAt":"2026-11-11T21:59:28.981+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:59:28.981+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T21:58:49.3669281+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.3669281+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T21:56:53.7926299+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.7926299+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T21:58:49.4873797+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.4873797+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-11T21:58:49.2338613+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.2338613+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}