[GHSA-wmg3-h8mf-wgvr] Correct affected ecosystem from PyPI to npm

[devjoinedthechat]

This advisory is mapped to the PyPI ecosystem, but the affected software is the npm package.

• NVD assigns CVE-2026-61459 the CPE cpe:2.3:a:suyogs:mcp-server-kubernetes:*:*:*:*:*:node.js:*:*, with target software node.js.
• The referenced repository Flux159/mcp-server-kubernetes is a TypeScript project and contains no Python packaging (package.json only at the root).
• The npm package mcp-server-kubernetes declares repository: git+https://github.com/Flux159/mcp-server-kubernetes.git and publishes 3.9.0, matching the referenced release tag and fix commit d7890f5.
• The PyPI project of the same name is unrelated: five releases of 1.4–2.7 KB uploaded in March 2025, with no author, homepage or project URLs connecting it to that repository, and no version above 0.1.6 — so the recorded fixed: 3.9.0 does not correspond to any version that package has published.
• Five other advisories for this project (GHSA-6mx4-4h42-r8vh, GHSA-cr22-wjx7-2w6m, GHSA-4xqg-gf5c-ghwq, GHSA-wvxp-jp4w-w8wg, GHSA-gjv4-ghm7-q58q) are mapped to npm alone.

As currently mapped, users of the affected npm package receive no alert for this CVE, while every released version of the unrelated PyPI package (0.1.0–0.1.6) falls inside < 3.9.0 and is reported as critical.

This PR changes the affected package from PyPI: mcp-server-kubernetes to npm: mcp-server-kubernetes. The existing range (introduced: 0, fixed: 3.9.0) is already correct for the npm package and is unchanged.