Issues

• Malicious npm package: array-inline-transform (remote-code loader used in fake job interview attacks)

  ossf/malicious-packages#1643 · Filter by author asenrusev opened on Oct 16, 2026

• vant (2.13.3, 2.13.4, 2.13.5, 3.6.13, 3.6.14, 4.9.12, 4.9.13, 4.9.14)

  ossf/malicious-packages#1628 · Filter by author Eniamza opened on Oct 12, 2026

• Git-based source: smiling-hyena (PyPI, npm)

  ossf/malicious-packages#1597 · Filter by author justkorean1681 opened on Oct 6, 2026

• False positive: MAL-2025-21003 flags npm security-holder package [email protected]

  ossf/malicious-packages#1560 · Filter by author themohitnair opened on Sep 28, 2026
  2

• Withdraw MAL-2026-10667 to match GHSA-f59f-vj5q-c725

  ossf/malicious-packages#1558 · Filter by author joniumGit opened on Sep 28, 2026

• Clarify MAL-2022-250 exact-version scope versus GHSA >= 0

  ossf/malicious-packages#1537 · Filter by author rockcorrybil opened on Sep 18, 2026

• validatePURL fails for VSCode ecosystem due to missing entry in purlEcosystems and incorrect namespace separator

  ossf/malicious-packages#1512 · Filter by author neo0007777 opened on Sep 10, 2026
  1

• Request to update MAL-2026-13416: affected versions are limited to 0.1.0-beta through 0.1.7-beta

  ossf/malicious-packages#1474 · Filter by author bananakitssu opened on Aug 28, 2026
  4

• False-positive dispute: @vanexalabs-ai/vanexa-agent (MAL-2026-13397) & @ikbal_fadilah_vanexa01/vanexa-agent (MAL-2026-13364)

  ossf/malicious-packages#1470 · Filter by author ikbalsakata500445jensen opened on Aug 25, 2026
  1

• New IoCs for MAL-2026-13631: same jsonbin C2 bin (6a718a58da38895dfeb6e2ed) delivered via fake freelance repo

  ossf/malicious-packages#1457 · Filter by author San-77x opened on Aug 19, 2026
  2

• Allow detail merging strategy to be configurable per-source.

  enhancement
  ossf/malicious-packages#1440 · Filter by author calebbrown opened on Aug 12, 2026
  3

• [Discussion]: SafeDep Automated Ingestion Pipeline.

  ossf/malicious-packages#1439 · Filter by author KunalSin9h opened on Aug 12, 2026
  2

• Update MAL-2026-10677 (deployowl) — Fixed in v2.3.0+, all vulnerable versions deprecated

  ossf/malicious-packages#1390 · Filter by author emika389 opened on Jul 20, 2026

• Fields unification, data deduplication and presentation in OSV

  ossf/malicious-packages#1315 · Filter by author kam193 opened on Jun 15, 2026

• False Positive: MAL-2025-41914 - npm/@ibm-integration/flow-canvas/MAL-2025-41914.json

  ossf/malicious-packages#1311 · Filter by author PPD-IBM opened on Jun 15, 2026
  2

• [npm] js-web3.prc - Private key exfiltration / typosquatting

  ossf/malicious-packages#1286 · Filter by author CoinSmitty opened on Jun 1, 2026

• Proposal: Standardizing Behavioral Indicators for Malicious Package Reporting

  ossf/malicious-packages#1233 · Filter by author nddmars opened on May 3, 2026
  3

• Proposal: Integrate Continuous Code Scanning Signals for Malicious Package Detection

  ossf/malicious-packages#1232 · Filter by author nddmars opened on May 3, 2026
  1

• False Positive

  ossf/malicious-packages#1173 · Filter by author noetro opened on Mar 24, 2026
  1

• [enhancement] add more info to details section about what was flagged for malicious domains

  ossf/malicious-packages#1170 · Filter by author antpili opened on Mar 19, 2026
  2

• Malicious package: JP-Soccer-MVP (npm) — Contagious Interview / Lazarus Group

  ossf/malicious-packages#1150 · Filter by author eaillaud opened on Mar 3, 2026
  2

• Overly broad version ranges in @browserbasehq/* Shai-Hulud advisories

  ossf/malicious-packages#1138 · Filter by author shrey150 opened on Feb 20, 2026

• AI skills

  ossf/malicious-packages#1131 · Filter by author loganaden opened on Feb 7, 2026

• False positive: @deputyapp/copilot2 - legitimate private package

  ossf/malicious-packages#1130 · Filter by author loicplaire opened on Feb 5, 2026

• Non-malicious package flagged as malicious

  ossf/malicious-packages#1116 · Filter by author jeffmoss-ro opened on Dec 18, 2025