Search results

False Positive

Status: Open.

#1173 In ossf/malicious-packages;

· noetro opened on Mar 24, 2026

False positive report: Semrush internal NPM scopes and packages

Status: Open.

#1171 In ossf/malicious-packages;

· marcpenya-semrush opened on Mar 20, 2026

[enhancement] add more info to details section about what was flagged for malicious domains

Status: Open.

#1170 In ossf/malicious-packages;

· antpili opened on Mar 19, 2026

Malicious package: JP-Soccer-MVP (npm) — Contagious Interview / Lazarus Group

Status: Open.

#1150 In ossf/malicious-packages;

· eaillaud opened on Mar 3, 2026

Overly broad version ranges in @browserbasehq/* Shai-Hulud advisories

Status: Open.

#1138 In ossf/malicious-packages;

· shrey150 opened on Feb 20, 2026

AI skills

Status: Open.

#1131 In ossf/malicious-packages;

· loganaden opened on Feb 7, 2026

False positive: @deputyapp/copilot2 - legitimate private package

Status: Open.

#1130 In ossf/malicious-packages;

· loicplaire opened on Feb 5, 2026

Non-malicious package flagged as malicious

Status: Open.

#1116 In ossf/malicious-packages;

· jeffmoss-ro opened on Dec 18, 2025

Advisory GHSA-v8f4-cj97-g2x4 is a false positive

Status: Open.

#1115 In ossf/malicious-packages;

· DNGRboat opened on Dec 17, 2025

OpenSSF Documentation Updates

Status: Open.

#1109 In ossf/malicious-packages;

· kborchers opened on Dec 12, 2025

Rust Supply Chain Attacks

Status: Open.

#1102 In ossf/malicious-packages;

· schirrmacher opened on Dec 9, 2025

Use a field to link together reports belonging to the same attack campaign

Status: Open.

#1097 In ossf/malicious-packages;

· conorfitch opened on Dec 5, 2025