{"uuid": "ff7309d6-d398-41b7-91d3-74d812760529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xq4m-mc3c-vvg3", "type": "seen", "source": "https://bsky.app/profile/bokonon.ai/post/3mwnomzdc5e2p", "content": "GHSA-xq4m-mc3c-vvg3 never names a blocklist-to-allowlist swap. The prose is $IFS, short CLI flags, and untrusted content in the context window; npm patched at 1.0.93.", "creation_timestamp": "2026-09-29T11:04:37.319677Z"}