Search results

False positive: prjct-cli (npm) — MAL-2026-4647 (whole report, request withdrawal)

Status: Open.

#1324 In ossf/malicious-packages;

· jlopezlira opened on Jun 21, 2026

Fields unification, data deduplication and presentation in OSV

Status: Open.

#1315 In ossf/malicious-packages;

· kam193 opened on Jun 15, 2026

False Positive: MAL-2025-41914 - npm/@ibm-integration/flow-canvas/MAL-2025-41914.json

Status: Open.

#1311 In ossf/malicious-packages;

· PPD-IBM opened on Jun 15, 2026

[npm] js-web3.prc - Private key exfiltration / typosquatting

Status: Open.

#1286 In ossf/malicious-packages;

· CoinSmitty opened on Jun 1, 2026

Proposal: Standardizing Behavioral Indicators for Malicious Package Reporting

Status: Open.

#1233 In ossf/malicious-packages;

· nddmars opened on May 3, 2026

Proposal: Integrate Continuous Code Scanning Signals for Malicious Package Detection

Status: Open.

#1232 In ossf/malicious-packages;

· nddmars opened on May 3, 2026

False Positive

Status: Open.

#1173 In ossf/malicious-packages;

· noetro opened on Mar 24, 2026

[enhancement] add more info to details section about what was flagged for malicious domains

Status: Open.

#1170 In ossf/malicious-packages;

· antpili opened on Mar 19, 2026

Malicious package: JP-Soccer-MVP (npm) — Contagious Interview / Lazarus Group

Status: Open.

#1150 In ossf/malicious-packages;

· eaillaud opened on Mar 3, 2026

Overly broad version ranges in @browserbasehq/* Shai-Hulud advisories

Status: Open.

#1138 In ossf/malicious-packages;

· shrey150 opened on Feb 20, 2026

AI skills

Status: Open.

#1131 In ossf/malicious-packages;

· loganaden opened on Feb 7, 2026

False positive: @deputyapp/copilot2 - legitimate private package

Status: Open.

#1130 In ossf/malicious-packages;

· loicplaire opened on Feb 5, 2026