All issues

Search results

Request to update MAL-2026-13416: affected versions are limited to 0.1.0-beta through 0.1.7-beta

Status: Open.

#1474 In ossf/malicious-packages;

· bananakitssu opened on Aug 28, 2026

False positive: MAL-2026-10708 — @aicommander/agent 1.0.34 (npm)

Status: Open.

#1471 In ossf/malicious-packages;

· lksrz opened on Aug 26, 2026

False-positive dispute: @vanexalabs-ai/vanexa-agent (MAL-2026-13397) & @ikbal_fadilah_vanexa01/vanexa-agent (MAL-2026-13364)

Status: Open.

#1470 In ossf/malicious-packages;

· ikbalsakata500445jensen opened on Aug 25, 2026

New IoCs for MAL-2026-13631: same jsonbin C2 bin (6a718a58da38895dfeb6e2ed) delivered via fake freelance repo

Status: Open.

#1457 In ossf/malicious-packages;

· San-77x opened on Aug 19, 2026

Allow detail merging strategy to be configurable per-source.

enhancementNew feature or requestNew feature or request

Status: Open.

#1440 In ossf/malicious-packages;

· calebbrown opened on Aug 12, 2026

[Discussion]: SafeDep Automated Ingestion Pipeline.

Status: Open.

#1439 In ossf/malicious-packages;

· KunalSin9h opened on Aug 12, 2026

Update MAL-2026-10677 (deployowl) — Fixed in v2.3.0+, all vulnerable versions deprecated

Status: Open.

#1390 In ossf/malicious-packages;

· emika389 opened on Jul 20, 2026

Fields unification, data deduplication and presentation in OSV

Status: Open.

#1315 In ossf/malicious-packages;

· kam193 opened on Jun 15, 2026

False Positive: MAL-2025-41914 - npm/@ibm-integration/flow-canvas/MAL-2025-41914.json

Status: Open.

#1311 In ossf/malicious-packages;

· PPD-IBM opened on Jun 15, 2026

[npm] js-web3.prc - Private key exfiltration / typosquatting

Status: Open.

#1286 In ossf/malicious-packages;

· CoinSmitty opened on Jun 1, 2026

Proposal: Standardizing Behavioral Indicators for Malicious Package Reporting

Status: Open.

#1233 In ossf/malicious-packages;

· nddmars opened on May 3, 2026

Proposal: Integrate Continuous Code Scanning Signals for Malicious Package Detection

Status: Open.

#1232 In ossf/malicious-packages;

· nddmars opened on May 3, 2026