{"id":"GO-2026-6834","revision":null,"records":[{"revision":"e306c30b52b54be3a7222cc9cb11f7d5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-62204","aliases":[],"title":"SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install","description":"SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.","state":0,"publishedAt":"2026-08-22T12:26:41.933+00:00","modifiedAt":"2026-08-26T17:53:20.106+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.4\"\n                        },\n                        {\n                            \"version\": \"3.7.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","score":5.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L","score":6.6,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj","https://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62204","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-62204","identifiers":["CVE-2026-62204"]},"retained":false,"historicalAffected":[]},{"revision":"307c0f64f64a4776819dbec4e48883d5","observedAt":"2026-11-07T13:27:56.327+00:00","statement":{"source":"euvd","id":"EUVD-2026-64270","aliases":["CVE-2026-62204","GHSA-989h-w3q9-3m2f","GHSA-rpx2-p6hp-x5gj"],"title":"SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName…","description":"SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","score":5.9,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj","https://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64270","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 22, 2026, 12:26:41 PM","dateUpdated":"Aug 26, 2026, 5:53:20 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-64270","identifiers":["EUVD-2026-64270","CVE-2026-62204","GHSA-989h-w3q9-3m2f","GHSA-rpx2-p6hp-x5gj"]},"retained":false,"historicalAffected":[]},{"revision":"dd7ce33c8a774d9b9f693f17efbf7aee","observedAt":"2026-10-25T14:19:28.838+00:00","statement":{"source":"nvd","id":"CVE-2026-62204","aliases":[],"title":"SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName…","description":"SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.","state":0,"publishedAt":"2026-08-22T13:16:39.547+00:00","modifiedAt":"2026-10-12T16:10:00.22+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":5.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L","score":6.6,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj","https://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62204","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-345"],"productCriteria":[],"sourceDates":{"published":"2026-08-22T13:16:39.547","lastModified":"2026-10-12T16:10:00.220"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-62204","identifiers":["CVE-2026-62204"]},"retained":false,"historicalAffected":[]},{"revision":"69f195d11f164cec8c147df35ffa94ae","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-989h-w3q9-3m2f","aliases":[],"title":"Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-rpx2-p6hp-x5gj. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.","state":2,"publishedAt":"2026-08-22T15:31:02+00:00","modifiedAt":"2026-10-23T18:45:08.5786327+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj","https://nvd.nist.gov/vuln/detail/CVE-2026-62204","https://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install"],"sourceUrl":"https://github.com/advisories/GHSA-989h-w3q9-3m2f","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-989h-w3q9-3m2f","identifiers":["GHSA-989h-w3q9-3m2f"]},"retained":false,"historicalAffected":[]},{"revision":"7e00c9b20bb84e299d104530b7ce3b8f","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GHSA-rpx2-p6hp-x5gj","aliases":["CVE-2026-62204","GO-2026-6834"],"title":"SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin","description":"## Summary\n\n`installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept\n`packageName`, `repoURL`, and `repoHash` as independent request fields with no validation that\nthey refer to the same package. `packageName` alone determines the install destination;\n`repoURL`/`repoHash` alone determine what content gets downloaded and written there. A request\ncan name an already-installed, already-enabled plugin as `packageName` while pointing `repoURL`/\n`repoHash` at different, attacker-influenced content, silently overwriting the existing plugin's\nfiles.\n\n## Affected code\n\n`kernel/api/bazaar.go`:\n```go\nutil.BindJsonArg(\"packageName\", &packageName, true, true)\nutil.BindJsonArg(\"repoURL\", &repoURL, true, true)\nutil.BindJsonArg(\"repoHash\", &repoHash, true, true)\nerr := model.InstallBazaarPackage(\"plugins\", repoURL, repoHash, packageName, 0)\n```\n\n`kernel/model/bazaar.go`:\n```go\nfunc getPackageInstallPath(pkgType, packageName string) (string, string, error) {\n    case \"plugins\":\n        return filepath.Join(util.DataDir, \"plugins\", packageName), \"plugin.json\", nil\n```\n\n`kernel/bazaar/install.go`:\n```go\nfunc installPackage(data []byte, installPath string) (err error) {\n    ...\n    if err = filelock.Copy(srcPath, installPath); err != nil { return }\n    return\n}\n```\n\n`installPath` is derived solely from `packageName`; the downloaded `data` is derived solely from\n`repoURL`/`repoHash`; nothing cross-validates them, and `installPackage` performs no check for\nwhether `installPath` already contains an existing package before copying into it. The same\npattern applies to the widget/icon/template/theme install endpoints, which share\n`getPackageInstallPath`.\n\nThis does not involve path traversal — `installPath` always resolves inside\n`DataDir/plugins/` (or the corresponding directory for other package types), so this is not an\ninstance of \"arbitrary file write outside the workspace path\" (excluded by this project's\nSECURITY.md). The issue is that the write lands in the *wrong, existing* location within the\nintended directory, not outside it — an authorization/identity-verification gap, not a path\ntraversal.\n\n## Reachability / why this is not trivially remote\n\nThe bazaar endpoints are gated by `model.CheckAuth`, `model.CheckAdminRole`, `model.CheckReadonly`.\nWhen no lock-screen password is configured (the common desktop default), `CheckAuth` still\nenforces a same-origin check:\n```go\nif !localhost || ... || (\"\" != origin && !util.IsLocalOrigin(origin)) || ... {\n    // reject with 401\n}\n```\nI verified `IsLocalOrigin`/`IsLocalHostname` correctly parse the `Origin` header via `url.Parse`\nand check exact hostname / loopback IP:\n```go\nfunc IsLocalOrigin(origin string) bool {\n    if u, err := url.Parse(origin); err == nil {\n        return IsLocalHostname(u.Hostname())\n    }\n    return false\n}\nfunc IsLocalHostname(hostname string) bool {\n    if \"localhost\" == hostname || strings.HasSuffix(hostname, \".localhost\") {\n        return true\n    }\n    if ip := net.ParseIP(hostname); nil != ip {\n        return ip.IsLoopback()\n    }\n    return false\n}\n```\nThis was tested against common bypass patterns (subdomain-suffix tricks like\n`localhost.attacker.com`, and `Origin: null` as sent by sandboxed iframes) and found no bypass —\nthis is a correctly-implemented check. This means a purely remote attacker (e.g. a malicious\nwebsite) cannot invoke this endpoint via CSRF; a request must originate from SiYuan's own\nrenderer origin.\n\n## Realistic impact\n\nGiven SiYuan runs as an Electron app with `nodeIntegration: true` (per prior advisories in this\nrepository), a same-origin script-execution primitive (e.g. an XSS bug in the renderer, of which\nseveral have been fixed in this repository recently) is typically already sufficient for direct\ncode execution. This bug's marginal value is **persistence**: a transient XSS-driven compromise\ncan use this endpoint to overwrite an existing, trusted, already-enabled plugin's `index.js`,\nconverting a one-time compromise into code that runs on every future launch of the application,\nsurviving after the original XSS vector is closed.\n\nThe overwrite does not effect immediately, via this specific\nendpoint. `PushReloadPlugin` (the websocket event that triggers frontend hot-reload without\nrestart) is only called from the batch-update path (`InstallBazaarPackages`, used by\n`batchUpdatePackage`), which explicitly checks `if petal != nil && petal.Enabled` before forcing\na reload via `SetPetalEnabled`. The single-package install endpoint (`installBazaarPlugin`) does\nnot call `PushReloadPlugin` at all — it only pushes a generic success toast. So an overwrite via\nthis endpoint activates on the next app restart or manual plugin toggle, rather than instantly \nstill a realistic and frequent event for a desktop application, but not an instant hot-reload.\n\n## Suggested fix\n\nVerify that `packageName` matches the package name declared in the downloaded package's own\n`plugin.json`/`theme.json`/etc. before copying into `installPath`, and/or refuse to install over\nan existing, non-empty destination directory unless the request is explicitly an update of that\nsame package (matching by source repo identity, not just by request-supplied name).\n\n## Verification notes\n\nConfirmed via static source review of `kernel/api/bazaar.go`, `kernel/model/bazaar.go`,\n`kernel/bazaar/install.go`, `kernel/model/session.go` (CheckAuth), `kernel/util/net.go`\n(IsLocalOrigin/IsLocalHostname), and `kernel/model/push_reload.go` /\n`app/src/plugin/loader.ts` (reload trigger wiring). I do not have a running SiYuan instance\nin this environment to execute an end-to-end proof of concept; findings are based on tracing\nthe actual, unmodified control flow across these files rather than assumption.","state":0,"publishedAt":"2026-10-23T18:38:25+00:00","modifiedAt":"2026-11-05T23:25:52.5912591+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260808010544-26ccb40d390e"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj","https://nvd.nist.gov/vuln/detail/CVE-2026-62204","https://github.com/siyuan-note/siyuan/commit/26ccb40d390eb7d9b04673629a58ab1d69cc7e53","https://github.com/siyuan-note/siyuan","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0","https://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install"],"sourceUrl":"https://github.com/advisories/GHSA-rpx2-p6hp-x5gj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rpx2-p6hp-x5gj","identifiers":["GHSA-rpx2-p6hp-x5gj","CVE-2026-62204","GO-2026-6834"]},"retained":false,"historicalAffected":[]},{"revision":"f3aac63a628b4e9893a89ed4aa15bc79","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6834","aliases":["CVE-2026-62204","GHSA-rpx2-p6hp-x5gj"],"title":"SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-11-05T22:54:22+00:00","modifiedAt":"2026-11-05T23:15:13.612224+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260808010544-26ccb40d390e"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj","https://nvd.nist.gov/vuln/detail/CVE-2026-62204","https://github.com/siyuan-note/siyuan/commit/26ccb40d390eb7d9b04673629a58ab1d69cc7e53","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0","https://www.vulncheck.com/advisories/siyuan-before-plugin-overwrite-via-bazaar-install"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6834","license":"OSV · upstream source license applies","key":"osv:GO-2026-6834","identifiers":["GO-2026-6834","CVE-2026-62204","GHSA-rpx2-p6hp-x5gj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T05:06:54.7224170+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T05:06:54.722417+00:00","lastSuccessAt":"2026-11-08T05:06:54.8753142+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.875316+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-5f996ab4d545d4c69ea2b6ee3009c8c4105f63df9cfbbf4c578c7470282be4b4","complete":true,"records":421074,"lastAttemptAt":"2026-11-08T05:06:53.5215713+00:00","lastSuccessAt":"2026-11-08T05:06:53.4988286+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:53.5215713+00:00","snapshotPublishedAt":"2026-11-08T04:25:52+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T05:08:40.2673541+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T05:06:54.7224170+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T05:06:54.722417+00:00","lastSuccessAt":"2026-11-08T05:06:54.8762568+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.8762573+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-449054d6321e4ff8818c6b898fdac406","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T05:08:11.1749792+00:00","lastSuccessAt":"2026-11-08T05:08:11.17+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:11.17+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T05:06:54.1714031+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.1714031+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T05:06:53.6785795+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:53.6785795+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T05:06:54.5508124+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.5508124+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T05:06:54.0611713+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.0611713+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}