OpenSSF Malicious Packages · OSV format
MAL-2026-1254 · Malicious code in pear-apps-utils-qr (npm)MAL-2026-1253 · Malicious code in pear-apps-utils-date (npm)MAL-2026-1252 · Malicious code in pear-apps-utils-avatar-initials (npm)MAL-2026-1251 · Malicious code in pear-apps-lib-ui-react-hooks (npm)MAL-2026-1250 · Malicious code in pear-apps-lib-feedback (npm)MAL-2026-1246 · Malicious code in pearpass-utils-password-check (npm)MAL-2026-1245 · Malicious code in nf-referral-backend-placeholder (npm)MAL-2026-1243 · Malicious code in nf-referral-backend (npm)MAL-2026-1239 · Malicious code in pearpass-lib-vault-core (npm)MAL-2026-1238 · Malicious code in pearpass-lib-vault (npm)MAL-2026-1237 · Malicious code in pearpass-lib-ui-theme-provider (npm)MAL-2026-1216 · Malicious code in pdfjs-dist-v5 (npm)MAL-2026-1206 · Malicious code in polymarket-trade-bot-api (npm)MAL-2026-1205 · Malicious code in polymarket-provider (npm)MAL-2026-1204 · Malicious code in polygon-bitquery-api (npm)MAL-2026-1203 · Malicious code in polmarket (npm)MAL-2026-1201 · Malicious code in mongos-api (npm)MAL-2026-1200 · Malicious code in mongoose-apis (npm)MAL-2026-1153 · Malicious code in primexuu-libsignal (npm)MAL-2026-1152 · Malicious code in pool-check (npm)MAL-2026-1151 · Malicious code in openclaw-droid (npm)MAL-2026-1132 · Malicious code in npm-doc-builder (npm)MAL-2026-1131 · Malicious code in ngaturkids (npm)MAL-2026-1111 · Malicious code in mqttoken (npm)MAL-2026-1249 · Malicious code in imhuman-fw-logger (npm)MAL-2026-1179 · Malicious code in magala (npm)MAL-2026-1178 · Malicious code in hiagentevilmcp (npm)MAL-2026-1150 · Malicious code in libsignal-yazxz (npm)MAL-2026-1130 · Malicious code in kazumarii (npm)MAL-2026-1110 · Malicious code in loadash-lint (npm)数据来源：OpenSSF Malicious Packages。已撤回记录保留用于审计，不应作为当前活跃检测结果。