{"id":"gbsec:assessment:280f71493e3db042285d2803af48ba306a38a1f4","kind":"public_artifact_assessment","schema_version":"2.2.0","revision":1,"created_at":"2026-10-18T08:44:00Z","updated_at":"2026-10-18T08:44:00Z","data_classification":"public","artifact":{"ecosystem":"npm","registry_host":"registry.npmjs.org","name":"event-stream","version":"3.3.6","digest":null,"public_visibility":"asserted_public"},"result":"affected","relationship_state":"single_incident_record","incidents":[{"incident_id":"gbsec:catalog-incident:37d4fb3160c7485c0afeb876839877a966d2fbb7","revision":2,"status":"confirmed","confidence":"confirmed","classification":"compromised","title":"Compromised package evidence: GHSA-MH6F-8J2X-4483","last_changed_at":"2023-01-12T05:08:40Z","report_relationship":"single_report","relationship_basis":"catalog_assignment","source_reports":[{"origin_context":null,"applies_to_version":true,"fixed_versions":["4.0.0"],"source_id":"gbsec:source:github-advisory-database","source_name":"GitHub Advisory Database","upstream_record_id":"GHSA-mh6f-8j2x-4483","state":"active","source_updated_at":"2023-01-12T05:08:40Z","observed_at":"2026-09-27T14:58:21Z"}],"source_reports_truncated":false,"applies_to_version":true,"affected_range_ids":["gbsec:advisory-package:a9136e9a5fb59ca0318a7d481db43a471eeb7e49"],"fixed_versions":["4.0.0"],"aliases":["GHSA-mh6f-8j2x-4483"],"upstream_urls":["https://github.com/advisories/GHSA-mh6f-8j2x-4483"]}],"cve_context":[],"preliminary_warnings":[],"preliminary_warnings_truncated":false,"incident_ids":["gbsec:catalog-incident:37d4fb3160c7485c0afeb876839877a966d2fbb7"],"affected_range_ids":["gbsec:advisory-package:a9136e9a5fb59ca0318a7d481db43a471eeb7e49"],"recommended_action_ids":[],"evidence_maturity":{"composition":"present","provenance":"present","signature":"unknown","vex":"unknown","deployment":"unknown","runtime":"unknown"},"coverage":{"ecosystem":"npm","stage":"matched","result":"supported","as_of":"2026-10-18T08:40:10Z"},"registry_state":"unknown","unknowns":[],"feed_revision":"gbsec:feed-revision:54f4ccc93fd531f3dcebb21f7f25f8abb382e1f3","not_applicable_incident_count":0,"incidents_truncated":false,"source_freshness":[{"source_id":"gbsec:source:github-advisory-database","record_type":"malware_advisory","freshness_state":"fresh","last_success_at":"2026-10-18T08:00:49Z"},{"source_id":"gbsec:source:github-advisory-database","record_type":"reviewed_advisory","freshness_state":"fresh","last_success_at":"2026-10-18T08:00:49Z"},{"source_id":"gbsec:source:github-advisory-database","record_type":"unreviewed_advisory","freshness_state":"fresh","last_success_at":"2026-10-18T08:00:49Z"},{"source_id":"gbsec:source:openssf-malicious-packages","record_type":"malicious_package_catalog","freshness_state":"complete","last_success_at":"2026-10-18T08:35:53Z"}],"signature":{"algorithm":"Ed25519","public_key_id":"gbsec:snapshot-public-key:f6784a9aad09174da618475dd55ffcdf4ed5ab5f","canonicalization":"smithguard-canonical-json-v1","value":"ezAwPnDTegO5DcJQYoF99E/UvELLhpbofB+cftRDutPdsCN4jXQI3bpXtYKgmGbdDh1qU26MeWM8+/5gq9yGCA=="}}