{"id":"EUVD-2026-29352","revision":null,"records":[{"revision":"1b3b8789200e41a2ab7d27a7a9a60c45","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45321","aliases":[],"title":"Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys","description":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","state":0,"publishedAt":"2026-05-12T00:12:35.452+00:00","modifiedAt":"2026-08-04T03:56:09.005+00:00","affected":[{"ecosystem":"Vendor product","name":"arktype-adapter","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"arktype-adapter\",\n \"versions\": [\n {\n \"version\": \"1.166.12\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.15\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"eslint-plugin-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"eslint-plugin-router\",\n \"versions\": [\n {\n \"version\": \"1.161.9\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.161.12\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"eslint-plugin-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"eslint-plugin-start\",\n \"versions\": [\n {\n \"version\": \"0.0.4\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0.0.7\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"history","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"history\",\n \"versions\": [\n {\n \"version\": \"1.161.9\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.161.12\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"nitro-v2-vite-plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"nitro-v2-vite-plugin\",\n \"versions\": [\n {\n \"version\": \"1.154.12\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.154.15\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"react-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"react-router\",\n \"versions\": [\n {\n \"version\": \"1.169.5\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.169.8\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"react-router-devtools","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"react-router-devtools\",\n \"versions\": [\n {\n \"version\": \"1.166.16\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.19\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"react-router-ssr-query","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"react-router-ssr-query\",\n \"versions\": [\n {\n \"version\": \"1.166.15\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.18\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"react-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"react-start\",\n \"versions\": [\n {\n \"version\": \"1.167.68\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.167.71\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"react-start-client","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"react-start-client\",\n \"versions\": [\n {\n \"version\": \"1.166.51\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.54\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"react-start-rsc","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"react-start-rsc\",\n \"versions\": [\n {\n \"version\": \"0.0.47\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0.0.50\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"react-start-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"react-start-server\",\n \"versions\": [\n {\n \"version\": \"1.166.55\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.58\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"router-cli","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"router-cli\",\n \"versions\": [\n {\n \"version\": \"1.166.46\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.49\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"router-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"router-core\",\n \"versions\": [\n {\n \"version\": \"1.169.5\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.169.8\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"router-devtools","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"router-devtools\",\n \"versions\": [\n {\n \"version\": \"1.166.16\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.19\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"router-devtools-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"router-devtools-core\",\n \"versions\": [\n {\n \"version\": \"1.167.6\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.167.9\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"router-generator","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"router-generator\",\n \"versions\": [\n {\n \"version\": \"1.166.45\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.48\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"router-plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"router-plugin\",\n \"versions\": [\n {\n \"version\": \"1.167.38\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.167.41\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"router-ssr-query-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"router-ssr-query-core\",\n \"versions\": [\n {\n \"version\": \"1.168.3\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.168.6\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"router-utils","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"router-utils\",\n \"versions\": [\n {\n \"version\": \"1.161.11\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.161.14\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"outer-vite-plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"outer-vite-plugin\",\n \"versions\": [\n {\n \"version\": \"1.166.53\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.56\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"solid-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"solid-router\",\n \"versions\": [\n {\n \"version\": \"1.169.5\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.169.8\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"solid-router-devtools","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"solid-router-devtools\",\n \"versions\": [\n {\n \"version\": \"1.166.16\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.19\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"solid-router-ssr-query","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"solid-router-ssr-query\",\n \"versions\": [\n {\n \"version\": \"1.166.15\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.18\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"solid-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"solid-start\",\n \"versions\": [\n {\n \"version\": \"1.167.65\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.167.68\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"solid-start-client","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"solid-start-client\",\n \"versions\": [\n {\n \"version\": \"1.166.50\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.53\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"solid-start-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"solid-start-server\",\n \"versions\": [\n {\n \"version\": \"1.166.54\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.57\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"start-client-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"start-client-core\",\n \"versions\": [\n {\n \"version\": \"1.168.5\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.168.8\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"start-fn-stubs","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"start-fn-stubs\",\n \"versions\": [\n {\n \"version\": \"1.161.9\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.161.12\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"start-plugin-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"start-plugin-core\",\n \"versions\": [\n {\n \"version\": \"1.169.23\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.169.26\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"start-server-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"start-server-core\",\n \"versions\": [\n {\n \"version\": \"1.167.33\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.167.36\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"start-static-server-functions","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"start-static-server-functions\",\n \"versions\": [\n {\n \"version\": \"1.166.44\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.47\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"start-storage-context","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"start-storage-context\",\n \"versions\": [\n {\n \"version\": \"1.166.38\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.41\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"valibot-adapter","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"valibot-adapter\",\n \"versions\": [\n {\n \"version\": \"1.166.12\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.15\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"virtual-file-routes","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"virtual-file-routes\",\n \"versions\": [\n {\n \"version\": \"1.161.10\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.161.13\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"vue-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"vue-router\",\n \"versions\": [\n {\n \"version\": \"1.169.5\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.169.8\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"vue-router-devtools","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"vue-router-devtools\",\n \"versions\": [\n {\n \"version\": \"1.166.16\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.19\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"vue-router-ssr-query","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"vue-router-ssr-query\",\n \"versions\": [\n {\n \"version\": \"1.166.15\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.18\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"vue-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"vue-start\",\n \"versions\": [\n {\n \"version\": \"1.167.61\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.167.64\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"vue-start-client","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"vue-start-client\",\n \"versions\": [\n {\n \"version\": \"1.166.46\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.49\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"vue-start-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"vue-start-server\",\n \"versions\": [\n {\n \"version\": \"1.166.50\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.53\",\n \"status\": \"affected\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"zod-adapter","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"@tanstack\",\n \"product\": \"zod-adapter\",\n \"versions\": [\n {\n \"version\": \"1.166.12\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"1.166.15\",\n \"status\": \"affected\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","https://github.com/TanStack/router/issues/7383","https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45321","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45321","identifiers":["CVE-2026-45321"]},"retained":false,"historicalAffected":[]},{"revision":"8c8b787c79b44122b12c181b0c3a59ee","observedAt":"2026-11-07T10:33:55.365+00:00","statement":{"source":"euvd","id":"EUVD-2026-29352","aliases":["CVE-2026-45321"],"title":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher bin…","description":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":null}],"references":["https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","https://github.com/TanStack/router/issues/7383","https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29352","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 12, 2026, 12:12:35 AM","dateUpdated":"Aug 4, 2026, 3:56:09 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-29352","identifiers":["EUVD-2026-29352","CVE-2026-45321"]},"retained":false,"historicalAffected":[]},{"revision":"97d5c3b5401e41a6b6ee0a5501c7c3e1","observedAt":"2026-10-27T11:12:23.45+00:00","statement":{"source":"nvd","id":"CVE-2026-45321","aliases":[],"title":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher bin…","description":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","state":0,"publishedAt":"2026-05-12T01:16:46.82+00:00","modifiedAt":"2026-10-26T18:10:00.173+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/TanStack/router/issues/7383","https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45321","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-506"],"productCriteria":["cpe:2.3:a:tanstack:tanstack\\/arktype-adapter:1.166.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/arktype-adapter:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/eslint-plugin-router:1.161.9:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/eslint-plugin-router:1.161.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/eslint-plugin-start:0.0.4:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/eslint-plugin-start:0.0.7:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/history:1.161.9:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/history:1.161.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/nitro-v2-vite-plugin:1.154.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/nitro-v2-vite-plugin:1.154.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router:1.169.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router:1.169.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router-devtools:1.166.16:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router-devtools:1.166.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-start:1.167.68:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-start:1.167.71:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-start-client:1.166.51:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-start-client:1.166.54:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-start-rsc:0.0.47:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-start-rsc:0.0.50:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-start-server:1.166.55:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-start-server:1.166.58:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-cli:1.166.46:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-cli:1.166.49:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-core:1.169.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-core:1.169.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-devtools:1.166.16:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-devtools:1.166.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-devtools-core:1.167.6:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-devtools-core:1.167.9:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-generator:1.166.45:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-generator:1.166.48:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-plugin:1.167.38:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-plugin:1.167.41:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-ssr-query-core:1.168.3:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-ssr-query-core:1.168.6:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-utils:1.161.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-utils:1.161.14:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-vite-plugin:1.166.53:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-vite-plugin:1.166.56:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router:1.169.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router:1.169.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router-devtools:1.166.16:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router-devtools:1.166.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-start:1.167.65:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-start:1.167.68:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-start-client:1.166.50:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-start-client:1.166.53:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-start-server:1.166.54:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-start-server:1.166.57:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-client-core:1.168.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-client-core:1.168.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-fn-stubs:1.161.9:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-fn-stubs:1.161.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-plugin-core:1.169.23:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-plugin-core:1.169.26:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-server-core:1.167.33:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-server-core:1.167.36:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-static-server-functions:1.166.44:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-static-server-functions:1.166.47:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-storage-context:1.166.38:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-storage-context:1.166.41:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/valibot-adapter:1.166.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/valibot-adapter:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/virtual-file-routes:1.161.10:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/virtual-file-routes:1.161.13:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router:1.169.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router:1.169.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router-devtools:1.166.16:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router-devtools:1.166.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start:1.167.61:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start:1.167.64:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start-client:1.166.46:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start-client:1.166.49:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start-server:1.166.50:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start-server:1.166.53:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/zod-adapter:1.166.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/zod-adapter:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:mistral:mistralai:2.4.6:*:*:*:*:python:*:*","cpe:2.3:a:mistral:mistralai\\/mistralai:2.2.3:*:*:*:*:node.js:*:*","cpe:2.3:a:mistral:mistralai\\/mistralai:2.2.4:*:*:*:*:node.js:*:*","cpe:2.3:a:mistral:mistralai\\/mistralai-azure:1.7.2:*:*:*:*:node.js:*:*","cpe:2.3:a:mistral:mistralai\\/mistralai-azure:1.7.3:*:*:*:*:node.js:*:*","cpe:2.3:a:mistral:mistralai\\/mistralai-gcp:1.7.2:*:*:*:*:node.js:*:*","cpe:2.3:a:mistral:mistralai\\/mistralai-gcp:1.7.3:*:*:*:*:node.js:*:*","cpe:2.3:a:antoinebcx:ml-toolkit-ts:1.0.4:*:*:*:*:node.js:*:*","cpe:2.3:a:antoinebcx:ml-toolkit-ts:1.0.5:*:*:*:*:node.js:*:*","cpe:2.3:a:antoinebcx:ml-toolkit-ts\\/preprocessing:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:antoinebcx:ml-toolkit-ts\\/preprocessing:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:antoinebcx:ml-toolkit-ts\\/xgboost:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:antoinebcx:ml-toolkit-ts\\/xgboost:1.0.4:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.2:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.3:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.4:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.5:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.6:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.7:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.8:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.9:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.10:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.12:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.13:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.14:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.15:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.16:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.17:*:*:*:*:node.js:*:*","cpe:2.3:a:beproduct:beproduct\\/nestjs-auth:0.1.19:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:git-git-git:1.0.8:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:git-git-git:1.0.9:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:git-git-git:1.0.10:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:git-git-git:1.0.12:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:git_branch_selector:1.3.3:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:git_branch_selector:1.3.4:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:git_branch_selector:1.3.5:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:git_branch_selector:1.3.7:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:nextmove-mcp:0.1.3:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:nextmove-mcp:0.1.4:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:nextmove-mcp:0.1.5:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:nextmove-mcp:0.1.7:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:tolka\\/cli:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:tolka\\/cli:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:tolka\\/cli:1.0.4:*:*:*:*:node.js:*:*","cpe:2.3:a:christianalares:tolka\\/cli:1.0.6:*:*:*:*:node.js:*:*","cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.3:*:*:*:*:node.js:*:*","cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.4:*:*:*:*:node.js:*:*","cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.5:*:*:*:*:node.js:*:*","cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.6:*:*:*:*:node.js:*:*","cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.7:*:*:*:*:node.js:*:*","cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.8:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/cli:0.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/cli:0.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/cli:0.0.4:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/cli:0.0.5:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/cli:0.0.6:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/cli:0.0.7:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/sdk:0.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/sdk:0.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/sdk:0.0.4:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/sdk:0.0.5:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/sdk:0.0.6:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:supersurkhet\\/sdk:0.0.7:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:taskflow-corp\\/cli:0.1.24:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:taskflow-corp\\/cli:0.1.25:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:taskflow-corp\\/cli:0.1.26:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:taskflow-corp\\/cli:0.1.27:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:taskflow-corp\\/cli:0.1.28:*:*:*:*:node.js:*:*","cpe:2.3:a:abhishake1:taskflow-corp\\/cli:0.1.29:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/components:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/components:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/components:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-medusa:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-medusa:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-medusa:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-shopify:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-shopify:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-shopify:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-vendure:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-vendure:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-vendure:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-woocommerce:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-woocommerce:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/connector-woocommerce:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/core:0.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/core:0.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/core:0.2.3:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/database:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/database:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/database:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/pos:0.1.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/pos:0.1.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/pos:0.1.3:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/storage-sqlite:0.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/storage-sqlite:0.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/storage-sqlite:0.2.3:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/theme:0.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/theme:0.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:kilbot:tallyui\\/theme:0.2.3:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftauth\\/client:0.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftauth\\/client:0.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftauth\\/core:0.13.1:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftauth\\/core:0.13.2:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftlab\\/auth:0.24.1:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftlab\\/auth:0.24.2:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftlab\\/auth-router:0.5.1:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftlab\\/auth-router:0.5.2:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftlab\\/db:0.16.1:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:draftlab\\/db:0.16.2:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:simple_type-safe_actions:0.8.3:*:*:*:*:node.js:*:*","cpe:2.3:a:matheuspergoli:simple_type-safe_actions:0.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:cross-stitch:1.1.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:cross-stitch:1.1.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:cross-stitch:1.1.6:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airports:0.6.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airports:0.6.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airports:0.6.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace:0.8.1:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace:0.8.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace:0.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace-data:0.5.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace-data:0.5.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace-data:0.5.6:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airway-data:0.5.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airway-data:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airway-data:0.5.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airways:0.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airways:0.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airways:0.4.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fix-data:0.6.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fix-data:0.6.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fix-data:0.6.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fixes:0.3.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fixes:0.3.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fixes:0.3.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flight-math:0.5.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flight-math:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flight-math:0.5.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flightplan:0.5.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flightplan:0.5.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flightplan:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/geo:0.4.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/geo:0.4.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/geo:0.4.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry:0.5.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry:0.5.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry-data:0.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry-data:0.8.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry-data:0.8.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/mcp:0.9.1:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/mcp:0.9.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/mcp:0.9.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaid-data:0.6.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaid-data:0.6.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaid-data:0.6.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaids:0.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaids:0.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaids:0.4.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/notams:0.3.6:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/notams:0.3.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/notams:0.3.9:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedure-data:0.7.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedure-data:0.7.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedure-data:0.7.6:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedures:0.5.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedures:0.5.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedures:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/types:0.8.1:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/types:0.8.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/types:0.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/units:0.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/units:0.4.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/units:0.4.6:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/weather:0.5.6:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/weather:0.5.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/weather:0.5.9:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:ts-dna:3.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:ts-dna:3.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:ts-dna:3.0.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:wot-api:0.8.1:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:wot-api:0.8.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:wot-api:0.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:agentworkhq:agentwork-cli:0.1.4:*:*:*:*:node.js:*:*","cpe:2.3:a:agentworkhq:agentwork-cli:0.1.5:*:*:*:*:node.js:*:*","cpe:2.3:a:dirigible:dirigible-ai\\/sdk:0.6.2:*:*:*:*:node.js:*:*","cpe:2.3:a:dirigible:dirigible-ai\\/sdk:0.6.3:*:*:*:*:node.js:*:*","cpe:2.3:a:guardrailsai:guardrails_ai:0.10.1:*:*:*:*:python:*:*","cpe:2.3:a:linuxfoundation:opensearch:3.6.2:*:*:*:*:node.js:*:*","cpe:2.3:a:mesa:mesadev\\/rest:0.28.3:*:*:*:*:node.js:*:*","cpe:2.3:a:mesa:mesadev\\/saguaro:0.4.22:*:*:*:*:node.js:*:*","cpe:2.3:a:mesa:mesadev\\/sdk:0.28.3:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/access-policy-sdk:0.3.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/access-policy-tool:0.3.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/admin-tool:0.1.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/agent-sdk:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/agent-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/agent.sdk:0.0.18:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/aops-policy-tool:0.3.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/ap-chat:1.5.7:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/api-workflow-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/apollo-core:5.9.2:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/apollo-react:4.24.5:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/apollo-wind:2.16.2:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/auth:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/case-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/cli:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/codedagent-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/codedagents-tool:0.1.12:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/codedapp-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/common:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/context-grounding-tool:0.1.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/data-fabric-tool:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/docsai-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/filesystem:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/flow-tool:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/functions-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/gov-tool:0.3.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/identity-tool:0.1.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/insights-sdk:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/insights-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/integrationservice-sdk:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/integrationservice-tool:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/llmgw-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/maestro-sdk:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/maestro-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/orchestrator-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/packager-tool-apiworkflow:0.0.19:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/packager-tool-bpmn:0.0.9:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/packager-tool-case:0.0.9:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/packager-tool-connector:0.0.19:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/packager-tool-flow:0.0.19:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/packager-tool-functions:0.1.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/packager-tool-webapp:1.0.6:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/packager-tool-workflowcompiler:0.0.16:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/packager-tool-workflowcompiler-browser:0.0.34:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/platform-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/project-packager:1.1.16:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/resource-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/resourcecatalog-tool:0.1.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/resources-tool:0.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/robot:1.3.4:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/rpa-legacy-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/rpa-tool:0.9.5:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/solution-packager:0.0.35:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/solution-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/solutionpackager-sdk:1.0.11:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/solutionpackager-tool-core:0.0.34:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/tasks-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/telemetry:0.0.7:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/test-manager-tool:1.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/tool-workflowcompiler:0.0.12:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/traces-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/ui-widgets-multi-file-upload:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/uipath-python-bridge:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/vertical-solutions-tool:1.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/vss:0.1.6:*:*:*:*:node.js:*:*","cpe:2.3:a:uipath:uipath\\/widget.sdk:1.2.3:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-05-12T01:16:46.820","lastModified":"2026-10-26T18:10:00.173"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-45321","identifiers":["CVE-2026-45321"]},"retained":false,"historicalAffected":[]},{"revision":"fec61fe72e7e4765b0fcc87801337d9a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-g7cv-rxg3-hmpx","aliases":["CVE-2026-45321"],"title":"Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys","description":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n - AWS instance metadata (IMDS) and Secrets Manager\n - GCP metadata service\n - Kubernetes service-account tokens\n - HashiCorp Vault tokens\n - `~/.npmrc` (npm tokens)\n - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n - SSH private keys (`~/.ssh/`)\n- Exfiltrates harvested data over the Session/Oxen messenger file-upload network (`filev2.getsession.org`, `seed{1,2,3}.getsession.org`). This is end-to-end encrypted with no attacker-controlled C2, so blocking by IP or domain is the only network mitigation.\n- Enumerates packages that the victim maintains via `registry.npmjs.org/-/v1/search?text=maintainer:` and republishes them with the same injection, propagating the compromise across npm.\n\nAny developer or CI environment that ran `npm install`, `pnpm install`, or `yarn install` against an affected version on 2026-05-11 should be considered compromised. All credentials accessible to the install process should be rotated immediately. Cloud audit logs should be reviewed for activity originating from the affected hosts during and after the install window.\n\n## Detection\n\nInspect the published manifest of any pinned `@tanstack/*` version. Malicious manifests contain this exact `optionalDependencies` entry:\n\n```json\n\"optionalDependencies\": {\n \"@tanstack/setup\": \"github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c\"\n}\n```\n\nTo check a version without running install scripts:\n\n```bash\nnpm pack @tanstack/@ # downloads tarball; does NOT execute lifecycle scripts\ntar -xzf *.tgz\ngrep -A3 optionalDependencies package/package.json\nls -la package/router_init.js # malicious payload, ~2.3 MB, present at package root\n```\n\nThe payload file `router_init.js` is approximately 2.3 MB of obfuscated JavaScript. It is placed at the tarball root and is intentionally not declared in the package's `\"files\"` array, so it does not appear in the package's documented contents.\n\n## Mechanism\n\n`@tanstack/setup` is not a real package on the npm registry. The `github:tanstack/router#79ac49ee...` specifier resolves to an orphan commit pushed to a fork in the `tanstack/router` GitHub fork network. GitHub serves commits across the entire fork network for git-URL dependencies, so the attacker did not require write access to `TanStack/router` itself — only the ability to fork and push to their own fork.\n\nWhen npm processes the optional dependency, it:\n\n1. Fetches the orphan commit from the fork network.\n2. Installs the commit's declared dependencies (which include a real `bun` binary).\n3. Runs the commit's `prepare` lifecycle script: `bun run tanstack_runner.js && exit 1`. The trailing `exit 1` causes the optional install to fail, after which npm silently discards it — leaving no `node_modules` trace.\n4. The `tanstack_runner.js` script in turn executes `router_init.js` from the host package's tarball.\n\n## Patches\n\nAffected versions are being deprecated on npm with a `SECURITY:` notice. Where npm policy allows (no existing third-party dependents), affected versions are also being unpublished. The npm security team has been engaged to pull tarballs server-side for versions that cannot be unpublished.\n\nClean follow-up releases are being prepared. Update to the patched version listed in the affected-products table for each package, then reinstall from a clean lockfile.\n\n## Workarounds\n\nUntil clean follow-up releases are available:\n\n- Pin every `@tanstack/*` dependency to a known-good version published before 2026-05-11 19:00 UTC. The last known-good version for most affected packages was published on 2026-03-15.\n- Delete `node_modules` and the lockfile, then reinstall to ensure no transitive dependency resolves to a malicious version.\n- Configure npm to skip lifecycle scripts on install (`npm config set ignore-scripts true`) as a temporary defense-in-depth measure.\n- For CI, audit any pipeline that ran `install` against `@tanstack/*` between 19:20 and 19:30 UTC on 2026-05-11. Treat the runner as compromised and rotate any secrets it had access to.\n\n## Indicators of compromise\n\n| Indicator | Value |\n|---|---|\n| Malicious git ref | `github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c` |\n| Fictitious package name | `@tanstack/setup` |\n| Payload filename | `router_init.js` (~2.3 MB, package root, undeclared in `files`) |\n| Helper filename in orphan commit | `tanstack_runner.js` |\n| Exfiltration network | `filev2.getsession.org`, `seed1.getsession.org`, `seed2.getsession.org`, `seed3.getsession.org` |\n| Second-stage payload URLs | `https://litter.catbox.moe/h8nc9u.js`, `https://litter.catbox.moe/7rrc6l.mjs` |\n| Poisoned cache key | `Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11` |\n| Publish window (UTC) | 2026-05-11 19:20 — 19:26 |\n| Publish mechanism | GitHub Actions OIDC trusted publisher (`oidc:db7d6f54-05d5-412b-8a10-e7a8398b303e`) |\n| Workflow runs | https://github.com/TanStack/router/actions/runs/25613093674 (attempt 4), https://github.com/TanStack/router/actions/runs/25691781302 |\n| Attacker GitHub accounts | `zblgg` (id 127806521), `voicproducoes` (id 269549300) |\n| Attacker fork (renamed to evade detection) | https://github.com/zblgg/configuration |\n\n## Credits\n\n- The security researcher who initially disclosed the vulnerability publicly with detailed analysis at https://github.com/TanStack/router/issues/7383\n\n## References\n\n- Public incident tracking issue: https://github.com/TanStack/router/issues/7383\n- Related research:\n - Adnan Khan, \"The Monsters in Your Build Cache: GitHub Actions Cache Poisoning\" (May 2024)\n - GitHub Security Lab, \"Keeping your GitHub Actions and workflows secure: Preventing Pwn Requests\"\n - StepSecurity, \"tj-actions/changed-files action is compromised\" (March 2025) — the malicious payload reuses this incident's runner-memory extraction technique verbatim","state":0,"publishedAt":"2026-05-12T00:12:49+00:00","modifiedAt":"2026-09-10T03:51:05.6086893+00:00","affected":[{"ecosystem":"npm","name":"@tanstack/arktype-adapter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.12"},{"kind":"fixed","version":"1.166.16"}]}],"versions":["1.166.12"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/eslint-plugin-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.9"},{"kind":"fixed","version":"1.161.13"}]}],"versions":["1.161.9"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/eslint-plugin-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.4"},{"kind":"fixed","version":"0.0.8"}]}],"versions":["0.0.4"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/history","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.9"},{"kind":"fixed","version":"1.161.13"}]}],"versions":["1.161.9"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/nitro-v2-vite-plugin","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.154.12"},{"kind":"fixed","version":"1.154.16"}]}],"versions":["1.154.12"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.5"},{"kind":"fixed","version":"1.169.9"}]}],"versions":["1.169.5"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-router-devtools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.16"},{"kind":"fixed","version":"1.166.20"}]}],"versions":["1.166.16"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-router-ssr-query","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.15"},{"kind":"fixed","version":"1.166.19"}]}],"versions":["1.166.15"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.68"},{"kind":"fixed","version":"1.167.72"}]}],"versions":["1.167.68"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-start-client","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.51"},{"kind":"fixed","version":"1.166.55"}]}],"versions":["1.166.51"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-start-rsc","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.47"},{"kind":"fixed","version":"0.0.51"}]}],"versions":["0.0.47"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-start-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.55"},{"kind":"fixed","version":"1.166.59"}]}],"versions":["1.166.55"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-cli","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.46"},{"kind":"fixed","version":"1.166.50"}]}],"versions":["1.166.46"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.5"},{"kind":"fixed","version":"1.169.9"}]}],"versions":["1.169.5"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-devtools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.16"},{"kind":"fixed","version":"1.166.20"}]}],"versions":["1.166.16"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-devtools-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.6"},{"kind":"fixed","version":"1.167.10"}]}],"versions":["1.167.6"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-generator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.45"},{"kind":"fixed","version":"1.166.49"}]}],"versions":["1.166.45"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-plugin","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.38"},{"kind":"fixed","version":"1.167.42"}]}],"versions":["1.167.38"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-ssr-query-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.168.3"},{"kind":"fixed","version":"1.168.7"}]}],"versions":["1.168.3"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-utils","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.11"},{"kind":"fixed","version":"1.161.15"}]}],"versions":["1.161.11"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-vite-plugin","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.53"},{"kind":"fixed","version":"1.166.57"}]}],"versions":["1.166.53"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.5"},{"kind":"fixed","version":"1.169.9"}]}],"versions":["1.169.5"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-router-devtools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.16"},{"kind":"fixed","version":"1.166.20"}]}],"versions":["1.166.16"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-router-ssr-query","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.15"},{"kind":"fixed","version":"1.166.19"}]}],"versions":["1.166.15"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.65"},{"kind":"fixed","version":"1.167.69"}]}],"versions":["1.167.65"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-start-client","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.50"},{"kind":"fixed","version":"1.166.54"}]}],"versions":["1.166.50"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-start-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.54"},{"kind":"fixed","version":"1.166.58"}]}],"versions":["1.166.54"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-client-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.168.5"},{"kind":"fixed","version":"1.168.9"}]}],"versions":["1.168.5"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-fn-stubs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.9"},{"kind":"fixed","version":"1.161.13"}]}],"versions":["1.161.9"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-plugin-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.23"},{"kind":"fixed","version":"1.169.27"}]}],"versions":["1.169.23"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-server-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.33"},{"kind":"fixed","version":"1.167.37"}]}],"versions":["1.167.33"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-static-server-functions","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.44"},{"kind":"fixed","version":"1.166.48"}]}],"versions":["1.166.44"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-storage-context","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.38"},{"kind":"fixed","version":"1.166.42"}]}],"versions":["1.166.38"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/valibot-adapter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.12"},{"kind":"fixed","version":"1.166.16"}]}],"versions":["1.166.12"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/virtual-file-routes","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.10"},{"kind":"fixed","version":"1.161.14"}]}],"versions":["1.161.10"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.5"},{"kind":"fixed","version":"1.169.9"}]}],"versions":["1.169.5"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-router-devtools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.16"},{"kind":"fixed","version":"1.166.20"}]}],"versions":["1.166.16"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-router-ssr-query","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.15"},{"kind":"fixed","version":"1.166.19"}]}],"versions":["1.166.15"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.61"},{"kind":"fixed","version":"1.167.65"}]}],"versions":["1.167.61"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-start-client","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.46"},{"kind":"fixed","version":"1.166.50"}]}],"versions":["1.166.46"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-start-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.50"},{"kind":"fixed","version":"1.166.54"}]}],"versions":["1.166.50"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/zod-adapter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.12"},{"kind":"fixed","version":"1.166.16"}]}],"versions":["1.166.12"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/arktype-adapter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.15"},{"kind":"fixed","version":"1.166.16"}]}],"versions":["1.166.15"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/eslint-plugin-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.12"},{"kind":"fixed","version":"1.161.13"}]}],"versions":["1.161.12"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/eslint-plugin-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.7"},{"kind":"fixed","version":"0.0.8"}]}],"versions":["0.0.7"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/history","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.12"},{"kind":"fixed","version":"1.161.13"}]}],"versions":["1.161.12"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/nitro-v2-vite-plugin","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.154.15"},{"kind":"fixed","version":"1.154.16"}]}],"versions":["1.154.15"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.8"},{"kind":"fixed","version":"1.169.9"}]}],"versions":["1.169.8"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-router-devtools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.19"},{"kind":"fixed","version":"1.166.20"}]}],"versions":["1.166.19"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-router-ssr-query","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.18"},{"kind":"fixed","version":"1.166.19"}]}],"versions":["1.166.18"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.71"},{"kind":"fixed","version":"1.167.72"}]}],"versions":["1.167.71"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-start-client","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.54"},{"kind":"fixed","version":"1.166.55"}]}],"versions":["1.166.54"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-start-rsc","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.50"},{"kind":"fixed","version":"0.0.51"}]}],"versions":["0.0.50"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/react-start-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.58"},{"kind":"fixed","version":"1.166.59"}]}],"versions":["1.166.58"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-cli","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.49"},{"kind":"fixed","version":"1.166.50"}]}],"versions":["1.166.49"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.8"},{"kind":"fixed","version":"1.169.9"}]}],"versions":["1.169.8"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-devtools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.19"},{"kind":"fixed","version":"1.166.20"}]}],"versions":["1.166.19"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-devtools-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.9"},{"kind":"fixed","version":"1.167.10"}]}],"versions":["1.167.9"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-generator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.48"},{"kind":"fixed","version":"1.166.49"}]}],"versions":["1.166.48"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-plugin","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.41"},{"kind":"fixed","version":"1.167.42"}]}],"versions":["1.167.41"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-ssr-query-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.168.6"},{"kind":"fixed","version":"1.168.7"}]}],"versions":["1.168.6"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-utils","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.14"},{"kind":"fixed","version":"1.161.15"}]}],"versions":["1.161.14"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/router-vite-plugin","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.56"},{"kind":"fixed","version":"1.166.57"}]}],"versions":["1.166.56"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.8"},{"kind":"fixed","version":"1.169.9"}]}],"versions":["1.169.8"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-router-devtools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.19"},{"kind":"fixed","version":"1.166.20"}]}],"versions":["1.166.19"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-router-ssr-query","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.18"},{"kind":"fixed","version":"1.166.19"}]}],"versions":["1.166.18"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.68"},{"kind":"fixed","version":"1.167.69"}]}],"versions":["1.167.68"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-start-client","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.53"},{"kind":"fixed","version":"1.166.54"}]}],"versions":["1.166.53"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/solid-start-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.57"},{"kind":"fixed","version":"1.166.58"}]}],"versions":["1.166.57"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-client-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.168.8"},{"kind":"fixed","version":"1.168.9"}]}],"versions":["1.168.8"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-fn-stubs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.12"},{"kind":"fixed","version":"1.161.13"}]}],"versions":["1.161.12"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-plugin-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.26"},{"kind":"fixed","version":"1.169.27"}]}],"versions":["1.169.26"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-server-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.36"},{"kind":"fixed","version":"1.167.37"}]}],"versions":["1.167.36"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-static-server-functions","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.47"},{"kind":"fixed","version":"1.166.48"}]}],"versions":["1.166.47"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/start-storage-context","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.41"},{"kind":"fixed","version":"1.166.42"}]}],"versions":["1.166.41"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/valibot-adapter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.15"},{"kind":"fixed","version":"1.166.16"}]}],"versions":["1.166.15"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/virtual-file-routes","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.161.13"},{"kind":"fixed","version":"1.161.14"}]}],"versions":["1.161.13"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.169.8"},{"kind":"fixed","version":"1.169.9"}]}],"versions":["1.169.8"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-router-devtools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.19"},{"kind":"fixed","version":"1.166.20"}]}],"versions":["1.166.19"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-router-ssr-query","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.18"},{"kind":"fixed","version":"1.166.19"}]}],"versions":["1.166.18"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.167.64"},{"kind":"fixed","version":"1.167.65"}]}],"versions":["1.167.64"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-start-client","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.49"},{"kind":"fixed","version":"1.166.50"}]}],"versions":["1.166.49"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/vue-start-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.53"},{"kind":"fixed","version":"1.166.54"}]}],"versions":["1.166.53"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@tanstack/zod-adapter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.166.15"},{"kind":"fixed","version":"1.166.16"}]}],"versions":["1.166.15"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","https://nvd.nist.gov/vuln/detail/CVE-2026-45321","https://github.com/TanStack/router/issues/7383","https://github.com/TanStack/router","https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"],"sourceUrl":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-g7cv-rxg3-hmpx","identifiers":["GHSA-g7cv-rxg3-hmpx","CVE-2026-45321"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T17:07:37.1829709+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T17:07:37.1829709+00:00","lastSuccessAt":"2026-11-07T17:07:37.3549159+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:37.3549172+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-715e663378e343ca50c7397586f2d227eca3ece57a7a73d5f48eaadc71eb9f69","complete":true,"records":420933,"lastAttemptAt":"2026-11-07T17:07:36.095653+00:00","lastSuccessAt":"2026-11-07T17:07:36.0305426+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:36.095653+00:00","snapshotPublishedAt":"2026-11-07T16:30:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce98ec71edc04bf7b5b5ed5b4106954c","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T17:19:56.3581416+00:00","lastSuccessAt":"2026-11-07T17:19:56.354+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:19:56.354+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T17:07:37.1829709+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T17:07:37.1829709+00:00","lastSuccessAt":"2026-11-07T17:07:37.3564231+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:37.3564236+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-57173bad19094db6a6a9d0334caa764d","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T17:08:02.7189692+00:00","lastSuccessAt":"2026-11-07T17:08:02.715+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:08:02.715+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T17:07:36.7559298+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:36.7559298+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T17:07:36.1583672+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:36.1583672+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T17:07:37.135444+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:37.135444+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T17:07:36.637447+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T17:07:36.637447+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}