OpenSSF Malicious Packages · OSV format
MAL-2026-18298 · Malicious code in claudeopusfile (PyPI)MAL-2026-18297 · Malicious code in nebulallm (PyPI)MAL-2026-17878 · Malicious code in util-foriepft (npm)MAL-2026-18324 · Malicious code in publish-poc-test3 (npm)MAL-2026-18249 · Malicious code in noelc-css-blender (npm)MAL-2026-17848 · Malicious code in orderly-plugin-liquidity-heatmap (npm)MAL-2026-18257 · Malicious code in insta-api-wrapper (npm)MAL-2026-18213 · Malicious code in @cecm-web-sdk/core (npm)MAL-2026-18323 · Malicious code in publish-poc-base (npm)MAL-2026-18216 · Malicious code in @grabcad/preferences-client (npm)MAL-2026-18214 · Malicious code in @grabcad/company-server-shared (npm)MAL-2026-17924 · Malicious code in @apexacc/cli (npm)MAL-2026-18301 · Malicious code in dictmerge-lite (PyPI)MAL-2026-18290 · Malicious code in react-native-bright-sdk (npm)MAL-2026-17758 · Malicious code in react-dropzone-v4 (npm)MAL-2026-17849 · Malicious code in brass-common (npm)MAL-2026-17806 · Malicious code in ap3-foundations-ui (npm)MAL-2026-18311 · Malicious code in bow-test (npm)MAL-2026-18314 · Malicious code in css-hnhxwd-polyfill (npm)MAL-2026-18312 · Malicious code in css-flexgap-shim (npm)MAL-2026-17515 · Malicious code in monitoring-agent (npm)MAL-2026-17808 · Malicious code in @s4yhiitestpoc/r2-https-b (npm)MAL-2026-17766 · Malicious code in @s4yhiitestpoc/scan-https-d (npm)MAL-2026-18303 · Malicious code in @s4yhiitestpoc/r2-dns (npm)MAL-2026-18302 · Malicious code in @s4yhiitestpoc/r2-control (npm)MAL-2026-18309 · Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm)MAL-2026-18307 · Malicious code in @s4yhiitestpoc/scan-dns-c (npm)MAL-2026-18305 · Malicious code in @s4yhiitestpoc/r2-https-dualuse (npm)MAL-2026-18304 · Malicious code in @s4yhiitestpoc/r2-echo (npm)MAL-2026-18308 · Malicious code in @s4yhiitestpoc/scan-echo-b (npm)数据来源:OpenSSF Malicious Packages。已撤回记录保留用于审计,不应作为当前活跃检测结果。