This was introduced at the beginning of the project.
Specifically, one of the [Vulnerability-Contributing Commits](/articles/vccs) is identified as an **origin commit**. In our curations, we look at commits that mark the beginning of the project. These are usually when lots of files are introduce in one commit (e.g. from forking another project, or adapting code).