{"status":"attested","page":"https://annalist.dev/mcp/com.a2awire/data-dependency-vulnerability-malicious-package-security","statement":{"type":"annalist.mcp-check/v1","issuer":"https://annalist.dev","subject":{"name":"com.a2awire/data-dependency-vulnerability-malicious-package-security","url":"https://a2awire.com/mcp/data/ghsawatch-package-dependency-vulnerabilities-malicious-package-advisories-d21673/http"},"issued_at":"2026-10-17T01:08:37Z","valid_until":"2026-10-24T01:08:37Z","grade":"A","score":100,"facts":{"probes_7d":3,"up_pct_7d":100,"median_ms":411,"access":"open","tools_count":16,"tools_changed_14d":false,"last_tools_change":null,"domain_age_days":126,"registry_status":"active"},"flags":[],"reasons":["+: answered 100% of our probes in 7 days"],"method":"mcp-1","evidence":{"probes":"derived/checks/mcp/probes/","ledger":"https://github.com/ryanroskowski/annalist-ledger"}},"signature":"7Sh6RSLdBWY17Lii1Xi1NsYyMD-6P5tlxEQ_3bhqsdrqTdg0rK98MkZ9G0S6gwyLmjXVJ3mvCfRST1jgv8__CA","key_id":"187e49f200625a2f","public_key_url":"https://api.annalist.dev/.well-known/annalist-key.json","how_to_verify":"Ed25519 signature (base64url) over the RFC 8785 canonical JSON of `statement`, checked with the public key at https://api.annalist.dev/.well-known/annalist-key.json (key_id must match). Then check valid_until. The probes behind it are archived daily, and each day's archive hashes are in the public ledger."}