Search results

False positive: MAL-2026-10726 — astro (npm) 7.1.0; flagged dependencies are declared at the official withastro/astro tags

Status: Open.

#1406 In ossf/malicious-packages;

· ptp-engine-bot opened on Jul 28, 2026

Update MAL-2026-10677 (deployowl) — Fixed in v2.3.0+, all vulnerable versions deprecated

Status: Open.

#1390 In ossf/malicious-packages;

· emika389 opened on Jul 20, 2026

Bulk import request: 10 npm malicious package reports from YoSheep

Status: Open.

#1373 In ossf/malicious-packages;

· YoSheep opened on Jul 14, 2026

Fields unification, data deduplication and presentation in OSV

Status: Open.

#1315 In ossf/malicious-packages;

· kam193 opened on Jun 15, 2026

False Positive: MAL-2025-41914 - npm/@ibm-integration/flow-canvas/MAL-2025-41914.json

Status: Open.

#1311 In ossf/malicious-packages;

· PPD-IBM opened on Jun 15, 2026

[npm] js-web3.prc - Private key exfiltration / typosquatting

Status: Open.

#1286 In ossf/malicious-packages;

· CoinSmitty opened on Jun 1, 2026

Proposal: Standardizing Behavioral Indicators for Malicious Package Reporting

Status: Open.

#1233 In ossf/malicious-packages;

· nddmars opened on May 3, 2026

Proposal: Integrate Continuous Code Scanning Signals for Malicious Package Detection

Status: Open.

#1232 In ossf/malicious-packages;

· nddmars opened on May 3, 2026

False Positive

Status: Open.

#1173 In ossf/malicious-packages;

· noetro opened on Mar 24, 2026

[enhancement] add more info to details section about what was flagged for malicious domains

Status: Open.

#1170 In ossf/malicious-packages;

· antpili opened on Mar 19, 2026

Malicious package: JP-Soccer-MVP (npm) — Contagious Interview / Lazarus Group

Status: Open.

#1150 In ossf/malicious-packages;

· eaillaud opened on Mar 3, 2026

Overly broad version ranges in @browserbasehq/* Shai-Hulud advisories

Status: Open.

#1138 In ossf/malicious-packages;

· shrey150 opened on Feb 20, 2026