{
  "matches": [
    {
      "vulnerability": {
        "id": "NOVUS-SAMPLE-2026-0001",
        "dataSource": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0001",
        "namespace": "novus-sample:language:javascript",
        "severity": "High",
        "urls": [
          "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0001"
        ],
        "description": "SAMPLE advisory: fabricated improper-input-validation issue in a fictional logging library.",
        "cvss": [
          {
            "source": "novus-sample",
            "type": "Primary",
            "version": "3.1",
            "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "metrics": {
              "baseScore": 8.1,
              "exploitabilityScore": 3.9,
              "impactScore": 3.6
            }
          }
        ],
        "fix": {
          "versions": [
            "3.5.0"
          ],
          "state": "fixed"
        },
        "advisories": []
      },
      "relatedVulnerabilities": [
        {
          "id": "SAMPLE-CVE-2026-0001",
          "namespace": "novus-sample:alias",
          "dataSource": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0001",
          "severity": "High"
        }
      ],
      "matchDetails": [
        {
          "type": "exact-direct-match",
          "matcher": "javascript-matcher",
          "searchedBy": {
            "language": "javascript",
            "namespace": "novus-sample"
          },
          "found": {
            "versionConstraint": "<3.5.0 (semver)",
            "vulnerabilityID": "NOVUS-SAMPLE-2026-0001"
          }
        }
      ],
      "artifact": {
        "id": "c2b27e94192bf406",
        "name": "example-logger",
        "version": "3.4.1",
        "type": "npm",
        "language": "javascript",
        "locations": [
          {
            "path": "/app/node_modules/example-logger"
          }
        ],
        "licenses": [
          "MIT"
        ],
        "purl": "pkg:npm/example-logger@3.4.1"
      }
    },
    {
      "vulnerability": {
        "id": "NOVUS-SAMPLE-2026-0002",
        "dataSource": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0002",
        "namespace": "novus-sample:language:javascript",
        "severity": "Critical",
        "urls": [
          "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0002"
        ],
        "description": "SAMPLE advisory: fabricated unsafe-deserialisation issue in a fictional cache library.",
        "cvss": [
          {
            "source": "novus-sample",
            "type": "Primary",
            "version": "3.1",
            "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "metrics": {
              "baseScore": 9.3,
              "exploitabilityScore": 3.9,
              "impactScore": 3.6
            }
          }
        ],
        "fix": {
          "versions": [
            "0.9.5"
          ],
          "state": "fixed"
        },
        "advisories": []
      },
      "relatedVulnerabilities": [
        {
          "id": "SAMPLE-CVE-2026-0002",
          "namespace": "novus-sample:alias",
          "dataSource": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0002",
          "severity": "Critical"
        }
      ],
      "matchDetails": [
        {
          "type": "exact-direct-match",
          "matcher": "javascript-matcher",
          "searchedBy": {
            "language": "javascript",
            "namespace": "novus-sample"
          },
          "found": {
            "versionConstraint": ">=0.9.0 <0.9.5 (semver)",
            "vulnerabilityID": "NOVUS-SAMPLE-2026-0002"
          }
        }
      ],
      "artifact": {
        "id": "c92da4b12f05fc1a",
        "name": "example-cache",
        "version": "0.9.2",
        "type": "npm",
        "language": "javascript",
        "locations": [
          {
            "path": "/app/node_modules/example-cache"
          }
        ],
        "licenses": [
          "BSD-3-Clause"
        ],
        "purl": "pkg:npm/example-cache@0.9.2"
      }
    },
    {
      "vulnerability": {
        "id": "NOVUS-SAMPLE-2026-0003",
        "dataSource": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0003",
        "namespace": "novus-sample:language:javascript",
        "severity": "Medium",
        "urls": [
          "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0003"
        ],
        "description": "SAMPLE advisory: fabricated uncontrolled-resource-consumption issue in a fictional parser.",
        "cvss": [
          {
            "source": "novus-sample",
            "type": "Primary",
            "version": "3.1",
            "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "metrics": {
              "baseScore": 5.4,
              "exploitabilityScore": 3.9,
              "impactScore": 3.6
            }
          }
        ],
        "fix": {
          "versions": [
            "1.2.0"
          ],
          "state": "fixed"
        },
        "advisories": []
      },
      "relatedVulnerabilities": [
        {
          "id": "SAMPLE-CVE-2026-0003",
          "namespace": "novus-sample:alias",
          "dataSource": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0003",
          "severity": "Medium"
        }
      ],
      "matchDetails": [
        {
          "type": "exact-direct-match",
          "matcher": "javascript-matcher",
          "searchedBy": {
            "language": "javascript",
            "namespace": "novus-sample"
          },
          "found": {
            "versionConstraint": "<1.2.0 (semver)",
            "vulnerabilityID": "NOVUS-SAMPLE-2026-0003"
          }
        }
      ],
      "artifact": {
        "id": "96af495a9489f05f",
        "name": "example-yaml-lite",
        "version": "1.1.7",
        "type": "npm",
        "language": "javascript",
        "locations": [
          {
            "path": "/app/node_modules/example-yaml-lite"
          }
        ],
        "licenses": [
          "Apache-2.0"
        ],
        "purl": "pkg:npm/example-yaml-lite@1.1.7"
      }
    },
    {
      "vulnerability": {
        "id": "NOVUS-SAMPLE-2026-0004",
        "dataSource": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0004",
        "namespace": "novus-sample:language:javascript",
        "severity": "Low",
        "urls": [
          "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0004"
        ],
        "description": "SAMPLE advisory: fabricated allocation-without-limits issue in a fictional query library.",
        "cvss": [
          {
            "source": "novus-sample",
            "type": "Primary",
            "version": "3.1",
            "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L",
            "metrics": {
              "baseScore": 3.1,
              "exploitabilityScore": 3.9,
              "impactScore": 3.6
            }
          }
        ],
        "fix": {
          "versions": [
            "2.1.0"
          ],
          "state": "fixed"
        },
        "advisories": []
      },
      "relatedVulnerabilities": [
        {
          "id": "SAMPLE-CVE-2026-0004",
          "namespace": "novus-sample:alias",
          "dataSource": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0004",
          "severity": "Low"
        }
      ],
      "matchDetails": [
        {
          "type": "exact-direct-match",
          "matcher": "javascript-matcher",
          "searchedBy": {
            "language": "javascript",
            "namespace": "novus-sample"
          },
          "found": {
            "versionConstraint": "<2.1.0 (semver)",
            "vulnerabilityID": "NOVUS-SAMPLE-2026-0004"
          }
        }
      ],
      "artifact": {
        "id": "b30640c08846f9c2",
        "name": "example-json-path",
        "version": "2.0.5",
        "type": "npm",
        "language": "javascript",
        "locations": [
          {
            "path": "/app/node_modules/example-json-path"
          }
        ],
        "licenses": [
          "MIT"
        ],
        "purl": "pkg:npm/example-json-path@2.0.5"
      }
    }
  ],
  "source": {
    "type": "directory",
    "target": "/app"
  },
  "distro": {
    "name": "example-linux",
    "version": "3.20",
    "idLike": []
  },
  "descriptor": {
    "name": "grype-shaped SAMPLE scanner",
    "version": "0.0.0-sample",
    "timestamp": "2026-01-01T00:00:00Z"
  },
  "novus_sample_note": "Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists."
}