GHSA-fr84-p27r-73vj: add npm package and version range for ssh-mcp

[tufantunc]

GHSA-fr84-p27r-73vj has an empty affected array, so the advisory carries no package or ecosystem mapping. This adds the npm package and the version range.

I am the maintainer of the affected project.

Change

"affected": [
  {
    "package": { "ecosystem": "npm", "name": "ssh-mcp" },
    "ranges": [
      { "type": "ECOSYSTEM", "events": [{ "introduced": "0" }, { "fixed": "2.0.0" }] }
    ]
  }
]

Plus one reference: the repository advisory I published for the same vulnerability, which is the public source for the range.

Why the range is < 2.0.0

The advisory text says "up to 1.5.0", which is correct but expressed against tags rather than the ecosystem. 1.5.0 is the last 1.x release on npm (1.0.0 … 1.5.0, 15 versions) and 2.0.0 is the next one, so "up to 1.5.0" and < 2.0.0 describe the same set of published versions.

2.0.0 is where the fix landed: credentials moved out of CLI arguments to environment variables, config files and the SSH agent. That is recorded in GHSA-j4q8-xwr2-344g (< 2.0.0 vulnerable, 2.0.0 patched) and in the project's SECURITY.md, which lists "Credential leakage via CLI args (CWE-214)" against that mitigation.

What this fixes downstream

With affected empty, the record is not reachable by ecosystem:

gh api "advisories?ecosystem=npm&affects=ssh-mcp"   →  []

and consumers that resolve npm packages see nothing. Verified against a genuinely affected version:

$ npm i ssh-mcp@1.5.0 && npm audit
found 0 vulnerabilities

1.5.0 is inside the range this advisory describes.

Scope

One advisory, one change, no formatting edits. The affected array is the only structural field touched; I have not modified the details text, the CVSS vectors, the CWE or modified.

One thing I have deliberately left alone, in case you would rather handle it: the details text ends "The project was informed of the problem early through an issue report but has not responded yet." That was accurate when the record was created in April, and is no longer — the issue was fixed in 2.0.0 and a repository advisory was published on 2026-08-09. I have not rewritten another CNA's description, but I am happy to if you would prefer that in the same PR.

[tufantunc]

Amended: my first commit reformatted the whole file from 2-space to 4-space indentation, which made the diff +78/-54. That was unrelated formatting noise and against the contributing guidance. The branch now keeps the file's original formatting, so the diff is +25/-1 — the affected array and one reference, nothing else.