Search results

Malicious package: JP-Soccer-MVP (npm) — Contagious Interview / Lazarus Group

Status: Open.

#1150 In ossf/malicious-packages;

· eaillaud opened on Mar 3, 2026

Overly broad version ranges in @browserbasehq/* Shai-Hulud advisories

Status: Open.

#1138 In ossf/malicious-packages;

· shrey150 opened on Feb 20, 2026

AI skills

Status: Open.

#1131 In ossf/malicious-packages;

· loganaden opened on Feb 7, 2026

False positive: @deputyapp/copilot2 - legitimate private package

Status: Open.

#1130 In ossf/malicious-packages;

· loicplaire opened on Feb 5, 2026

Non-malicious package flagged as malicious

Status: Open.

#1116 In ossf/malicious-packages;

· jeffmoss-ro opened on Dec 18, 2025

Advisory GHSA-v8f4-cj97-g2x4 is a false positive

Status: Open.

#1115 In ossf/malicious-packages;

· DNGRboat opened on Dec 17, 2025

OpenSSF Documentation Updates

Status: Open.

#1109 In ossf/malicious-packages;

· kborchers opened on Dec 12, 2025

Rust Supply Chain Attacks

Status: Open.

#1102 In ossf/malicious-packages;

· schirrmacher opened on Dec 9, 2025

Use a field to link together reports belonging to the same attack campaign

Status: Open.

#1097 In ossf/malicious-packages;

· conorfitch opened on Dec 5, 2025

Removing FP versions in three npm reports

Status: Open.

#798 In ossf/malicious-packages;

· mgdcvetko opened on Feb 4, 2025

Please remove all captivateiq instacnes

Status: Open.

#700 In ossf/malicious-packages;

· radical-izak opened on Dec 6, 2024

Corrections Needed for Several Malware Attributions

Status: Open.

#660 In ossf/malicious-packages;

· behnazh-w opened on Oct 9, 2024