{"id":"CVE-2026-75915","revision":null,"records":[{"revision":"ec4ffdc2656f480eac66b049f0f6d0bb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-75915","aliases":[],"title":"CodeWhale before 0.8.64 Environment Variable Leak via js_execution","description":"CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.","state":0,"publishedAt":"2026-08-18T15:22:02.935+00:00","modifiedAt":"2026-08-18T15:36:49.746+00:00","affected":[{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/deepseek-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.32\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.41\"\n                        },\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/deepseek-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.32\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.41\"\n                        },\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/codewhale-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.64\"\n                        },\n                        {\n                            \"version\": \"0.8.64\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/codewhale\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.64\"\n                        },\n                        {\n                            \"version\": \"0.8.64\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4","https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://www.vulncheck.com/advisories/codewhale-before-environment-variable-leak-via-js-execution"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-75915","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-75915","identifiers":["CVE-2026-75915"]},"retained":false,"historicalAffected":[]},{"revision":"bf0473a9916343fd84bfc4a584658404","observedAt":"2026-11-07T14:28:18.276+00:00","statement":{"source":"euvd","id":"EUVD-2026-60973","aliases":["CVE-2026-75915","GHSA-h539-c7r8-3xq4"],"title":"CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code…","description":"CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4","https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://www.vulncheck.com/advisories/codewhale-before-environment-variable-leak-via-js-execution"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60973","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 3:22:02 PM","dateUpdated":"Aug 18, 2026, 3:36:49 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-60973","identifiers":["EUVD-2026-60973","CVE-2026-75915","GHSA-h539-c7r8-3xq4"]},"retained":false,"historicalAffected":[]},{"revision":"d5d9ba8fef064c17b8908d1656ba8f73","observedAt":"2026-10-25T16:19:04.694+00:00","statement":{"source":"nvd","id":"CVE-2026-75915","aliases":[],"title":"CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code…","description":"CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.","state":0,"publishedAt":"2026-08-18T16:18:23.97+00:00","modifiedAt":"2026-10-22T22:10:00.25+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4","https://www.vulncheck.com/advisories/codewhale-before-environment-variable-leak-via-js-execution"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75915","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-200"],"productCriteria":[],"sourceDates":{"published":"2026-08-18T16:18:23.970","lastModified":"2026-10-22T22:10:00.250"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-75915","identifiers":["CVE-2026-75915"]},"retained":false,"historicalAffected":[]},{"revision":"75e8bb31bfb648139500b609b99e7aaa","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-h539-c7r8-3xq4","aliases":["CVE-2026-75915"],"title":"CodeWhale: js_execution leaks parent environment to model context via missing env scrub","description":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n### Summary\n\njs_execution exposes parent process environment to model-provided JavaScript\n\nThe js_execution tool spawns Node with tokio::process::Command::new without calling the child_env scrubber that exec_shell, the Python REPL, and the MCP launcher all use. Model-provided JavaScript reads process.env and the values flow back to the parent transcript as the tool's stdout, exposing API keys, cloud credentials, and forge tokens to the next model turn.\n\n### Details\n\nIn `crates/tui/src/tools/js_execution.rs` (v0.8.37, lines 91-105):\n\n```rust\nlet temp_dir = tempfile::tempdir()\n    .map_err(|e| ToolError::execution_failed(format!(\"tempdir failed: {e}\")))?;\nlet script_path = temp_dir.path().join(\"js_execution.js\");\ntokio::fs::write(&script_path, code)\n    .await\n    .map_err(|e| ToolError::execution_failed(format!(\"tempfile write failed: {e}\")))?;\n\nlet mut cmd = tokio::process::Command::new(&node);\ncmd.arg(&script_path);\ncmd.current_dir(workspace);\n\nlet output = tokio::time::timeout(Duration::from_secs(120), cmd.output())\n    .await\n    .map_err(|_| ToolError::Timeout { seconds: 120 })\n    .and_then(|res| res.map_err(|e| ToolError::execution_failed(e.to_string())))?;\n```\n\nThe Command is built without `cmd.env_clear()` and without the project's `crate::child_env::apply_to_tokio_command` helper. Every variable in the parent process environment is inherited by the spawned `node`.\n\nFor comparison, exec_shell (`crates/tui/src/tools/shell.rs:790-792`) and the Python REPL (`crates/tui/src/repl/runtime.rs:238`) both apply the scrubber:\n\n```rust\nchild_env::apply_to_command(&mut cmd, child_env::string_map_env(&exec_env.env));\n```\n\napply_to_tokio_command calls `cmd.env_clear()` and then re-installs only the keys that pass `is_allowed_parent_env_key` (PATH, HOME, USER, LANG/LC_*, TMPDIR, proxy variables, Windows toolchain context, terminal settings). Secret-bearing variables (DEEPSEEK_API_KEY, OPENAI_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, etc.) are not on the allowlist and are dropped before the child starts. The js_execution path bypasses both the env_clear and the allowlist.\n\nCommit history makes the gap explicit. Commit `e6d4eae fix(security): scrub child process environments` (2026-05-08) introduced child_env.rs and rewrote exec_shell, the Python REPL, the MCP launcher, and main.rs to use it. Commit `2566f3c feat(tools): add js_execution tool` (2026-05-12) added this file four days later and never picked up the helper.\n\nThe tool is described to the model and surfaced in the approval pane as \"Run model-provided JavaScript code in local Node.js execution sandbox\" (`crates/tui/src/core/engine/turn_loop.rs:1174-1176`). No sandbox is applied beyond a 120-second timeout; Node has full filesystem and network access in addition to the inherited environment. The wording understates the trust boundary that the user is being asked to cross.\n\nIn YOLO mode (`auto_approve=true`) the JS body runs without any prompt at all, so a single adversarial prompt-injection from a README, fetched web page, or MCP server output drains the parent environment to the next model turn.\n\n### PoC\n\nA standalone Cargo test reproduces the unscrubbed-env behavior. Save as `crates/tui/tests/js_execution_env_leak.rs` and run with `cargo test -p deepseek-tui --test js_execution_env_leak -- --nocapture`:\n\n```rust\nuse deepseek_tui::tools::js_execution::execute_js_execution_tool;\nuse serde_json::json;\nuse tempfile::tempdir;\n\n#[tokio::test]\nasync fn js_execution_inherits_parent_secrets() {\n    if deepseek_tui::dependencies::resolve_node().is_none() {\n        eprintln!(\"node not on PATH; skipping\");\n        return;\n    }\n    unsafe {\n        std::env::set_var(\"AWS_SECRET_ACCESS_KEY\", \"leak-marker-AKIA-EXAMPLE\");\n        std::env::set_var(\"DEEPSEEK_API_KEY\", \"leak-marker-sk-EXAMPLE\");\n    }\n    let tmp = tempdir().unwrap();\n    let result = execute_js_execution_tool(\n        &json!({\"code\": \"console.log(process.env.AWS_SECRET_ACCESS_KEY + '|' + process.env.DEEPSEEK_API_KEY)\"}),\n        tmp.path(),\n    ).await.expect(\"execute\");\n    let payload: serde_json::Value = serde_json::from_str(&result.content).unwrap();\n    let stdout = payload[\"stdout\"].as_str().unwrap_or(\"\");\n    assert!(stdout.contains(\"leak-marker-AKIA-EXAMPLE\"), \"AWS leaked: {stdout}\");\n    assert!(stdout.contains(\"leak-marker-sk-EXAMPLE\"), \"DEEPSEEK leaked: {stdout}\");\n}\n```\n\nEquivalent reproducer against the binary:\n\n```bash\nexport AWS_SECRET_ACCESS_KEY=\"leak-marker-AKIA-EXAMPLE\"\nexport DEEPSEEK_API_KEY=\"leak-marker-sk-EXAMPLE\"\ndeepseek\n# Ask the model to run:\n#   js_execution({\"code\":\"console.log(JSON.stringify(process.env))\"})\n# Approve once. The returned stdout contains every parent env value verbatim,\n# including the markers above, and is now part of the model's context for the next request.\n```\n\nThe fix is one line added next to the existing `cmd.current_dir(workspace)` call:\n\n```rust\nlet mut cmd = tokio::process::Command::new(&node);\ncmd.arg(&script_path);\ncmd.current_dir(workspace);\ncrate::child_env::apply_to_tokio_command(&mut cmd, std::iter::empty::<(&str, &str)>());\n```\n\nThis calls the existing helper with no overrides, mirroring how repl/runtime.rs spawns the Python REPL. The behavior the description string already promises (sandbox) is then partially honored: secret-bearing parent variables stay in the parent.\n\n### Impact\n\nThe tool returns parent-environment secrets to the model on a single approval, or with no approval in YOLO mode. Any variable the user has exported becomes part of the next model request and travels to the configured LLM provider's logs. Common variables that the codebase's own provider clients read from process env, and therefore the values most likely to be present, include DEEPSEEK_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, MISTRAL_API_KEY, AZURE_OPENAI_API_KEY, XAI_API_KEY, GROQ_API_KEY, and TOGETHER_API_KEY. Cloud and source-control credentials commonly exported in developer shells include AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GOOGLE_APPLICATION_CREDENTIALS, GITHUB_TOKEN, GH_TOKEN, GITLAB_TOKEN, NPM_TOKEN, CARGO_REGISTRY_TOKEN, PYPI_API_TOKEN, and DATABASE_URL-style secrets. The local-sandbox wording shown at approval time understates the trust boundary, so users approving what they read as a sandboxed snippet do not anticipate that every shell-exported credential is reachable from the snippet. The remediation matches the pattern already adopted across exec_shell, the Python REPL, and the MCP launcher, so the gap is a missed call site rather than a design tradeoff.","state":0,"publishedAt":"2026-09-04T18:03:08+00:00","modifiedAt":"2026-09-04T19:00:04.288553+00:00","affected":[{"ecosystem":"crates.io","name":"deepseek-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.32"},{"kind":"last_affected","version":"0.8.41"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"deepseek-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.32"},{"kind":"fixed","version":"0.8.41"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"codewhale-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.41"},{"kind":"fixed","version":"0.8.64"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"codewhale","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.41"},{"kind":"fixed","version":"0.8.64"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4","https://nvd.nist.gov/vuln/detail/CVE-2026-75915","https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://github.com/Hmbown/CodeWhale","https://www.vulncheck.com/advisories/codewhale-before-environment-variable-leak-via-js-execution"],"sourceUrl":"https://github.com/advisories/GHSA-h539-c7r8-3xq4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-h539-c7r8-3xq4","identifiers":["GHSA-h539-c7r8-3xq4","CVE-2026-75915"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0239033+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0239043+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-83dbcd705162368a7389ef21c7d5877b90bc9ecd8679671f4b5e02683a8e1d4f","complete":true,"records":421074,"lastAttemptAt":"2026-11-08T06:06:40.5628876+00:00","lastSuccessAt":"2026-11-08T06:06:40.5495855+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.5628876+00:00","snapshotPublishedAt":"2026-11-08T05:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T06:07:06.8623217+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0246874+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0246876+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f61a222d691b4992bb1403f1a88575db","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T06:07:06.2347163+00:00","lastSuccessAt":"2026-11-08T06:07:06.231+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:07:06.231+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T06:06:40.830411+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.830411+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T06:06:40.6194681+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.6194681+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T06:06:40.8424247+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.8424247+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T06:06:40.7260451+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.7260451+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}