OpenSSF Malicious Packages · OSV format
MAL-2026-13615 · Malicious code in agenthub-ai (npm)MAL-2026-13614 · Malicious code in aclade-agent (npm)MAL-2026-13617 · Malicious code in ts-utility-plus (npm)MAL-2026-13616 · Malicious code in hardhat-cap (npm)MAL-2026-12488 · Malicious code in tt-help-cli-ycl (npm)MAL-2026-13449 · Malicious code in merchantweb-lang-cookie-reset (npm)MAL-2026-13611 · Malicious code in mangomind-agent (npm)MAL-2026-13612 · Malicious code in transform-es2015-unicode-regex (npm)MAL-2026-13610 · Malicious code in f-termx (npm)MAL-2026-13608 · Malicious code in @vertexa/prisma-fetch-engine (npm)MAL-2026-10717 · Malicious code in @onescience/onecode (npm)MAL-2026-13609 · Malicious code in hardhat-set (npm)MAL-2026-13607 · Malicious code in speed-hashes (PyPI)MAL-2026-13605 · Malicious code in yakuza0 (npm)MAL-2026-13475 · Malicious code in sui-graphql-client (npm)MAL-2026-12043 · Malicious code in sextant-cli-linux-arm64 (npm)MAL-2026-12029 · Malicious code in sextant-cli-linux-amd64 (npm)MAL-2026-12028 · Malicious code in sextant-cli-darwin-amd64 (npm)MAL-2026-11997 · Malicious code in sextant-cli-darwin-arm64 (npm)MAL-2026-13483 · Malicious code in internallib_v514 (npm)MAL-2026-13398 · Malicious code in @xiaohhhh1/canvas-agent (npm)MAL-2026-13412 · Malicious code in @apicity/meta (npm)MAL-2026-13520 · Malicious code in @aster110/cc2wechat (npm)MAL-2026-13549 · Malicious code in dojo-rn-interview (npm)MAL-2026-13539 · Malicious code in delivery-ci-codeceptjs (npm)MAL-2026-13574 · Malicious code in dolyame-ui-inputautocomplete (npm)MAL-2026-13547 · Malicious code in devplatform-spa-plugin-remote-module (npm)MAL-2026-13557 · Malicious code in dolyame-ui-checkablegroup (npm)MAL-2026-13577 · Malicious code in dolyame-ui-inputdate (npm)MAL-2026-13542 · Malicious code in delivery-ci-jira (npm)数据来源：OpenSSF Malicious Packages。已撤回记录保留用于审计，不应作为当前活跃检测结果。