OpenSSF Malicious Packages · OSV format
MAL-2026-6607 · Malicious code in @content-editor/common (npm)MAL-2026-6606 · Malicious code in @concerns/i18n (npm)MAL-2026-6605 · Malicious code in @bscom/styling (npm)MAL-2026-6601 · Malicious code in @appsource/utils (npm)MAL-2026-6600 · Malicious code in @anna-money/anna-web-lib (npm)MAL-2026-6599 · Malicious code in @alerts/components (npm)MAL-2026-6410 · Malicious code in @su-doughnym/react-dlb (npm)MAL-2026-6409 · Malicious code in @su-doughnym/metrics-js (npm)MAL-2026-6408 · Malicious code in @su-doughnym/loginui (npm)MAL-2026-6407 · Malicious code in @su-doughnym/hubspot-loginui-poc (npm)MAL-2026-5665 · Malicious code in @visma-net-platform/module-navigator (npm)MAL-2026-5664 · Malicious code in @tribe-digital/shopify-starter-theme (npm)MAL-2026-5663 · Malicious code in @tenforce/toolbox-fontmap (npm)MAL-2026-5662 · Malicious code in @snowsight/debug-tooling (npm)MAL-2026-5658 · Malicious code in @marketplace-shared/components (npm)MAL-2026-5655 · Malicious code in @hatcha-captcha/core (npm)MAL-2026-5498 · Malicious code in @validator-sdk/pubkey (npm)MAL-2026-5497 · Malicious code in @validate-sdk/v2 (npm)MAL-2026-5496 · Malicious code in @validate-ethereum-address/core (npm)MAL-2026-5495 · Malicious code in @solana-launchpad/sdk (npm)MAL-2026-5494 · Malicious code in @meme-sdk/trade (npm)MAL-2026-5433 · Malicious code in @webda-infra/search (npm)MAL-2026-5432 · Malicious code in @webda-features/dashboard (npm)MAL-2026-5431 · Malicious code in @webd-infra/query-designer-domain (npm)MAL-2026-4465 · Malicious code in @web-3d-tool/sdk (npm)MAL-2026-4464 · Malicious code in @vtmn-play/react (npm)MAL-2026-4463 · Malicious code in @vivaux/telemetry (npm)MAL-2026-4460 · Malicious code in @trackking/core (npm)MAL-2026-4440 · Malicious code in @serviceshub/x-web-core (npm)MAL-2026-4389 · Malicious code in @flipbit2-bb/test-auth-state (npm)数据来源：OpenSSF Malicious Packages。已撤回记录保留用于审计，不应作为当前活跃检测结果。