OpenSSF Malicious Packages · OSV format
MAL-2026-12456 · Malicious code in statist-statist-core (npm)MAL-2026-12237 · Malicious code in tinkoff-codeceptjs-storyshots-alpha (npm)MAL-2026-12230 · Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)MAL-2026-13450 · Malicious code in move-bcs-codec (npm)MAL-2026-13273 · Malicious code in devplatform-vite-plugin-gle (npm)MAL-2026-12766 · Malicious code in devplatform-spa-plugin-error-boundary (npm)MAL-2026-12719 · Malicious code in devplatform-jscodeshift-utils (npm)MAL-2026-12708 · Malicious code in devplatform-data-table (npm)MAL-2026-13485 · Malicious code in weight2loss (npm)MAL-2026-13435 · Malicious code in @united-airlines-org/atmos-design-system (npm)MAL-2026-10752 · Malicious code in xxdxa (npm)MAL-2026-13473 · Malicious code in alphalend-layouts (PyPI)MAL-2026-13471 · Malicious code in zyr-agent (npm)MAL-2026-13469 · Malicious code in xxdxax (npm)MAL-2026-13465 · Malicious code in vite-vue-path-map (npm)MAL-2026-13360 · Malicious code in uzair-rajput-new (npm)MAL-2026-10751 · Malicious code in vanexa-agent (npm)MAL-2026-13462 · Malicious code in trimprompt (npm)MAL-2026-13458 · Malicious code in squeez (npm)MAL-2026-13457 · Malicious code in shadowx-fca (npm)MAL-2026-13455 · Malicious code in remote-claude-daemon (npm)MAL-2026-13454 · Malicious code in poc-ch4rlygr (npm)MAL-2026-13452 · Malicious code in opencode-optimised-toolings (npm)MAL-2026-12669 · Malicious code in dbk-ui-forms (npm)MAL-2026-12368 · Malicious code in electrode-ota-ui-app (npm)MAL-2025-6894 · Malicious code in commonweb-flow (npm)MAL-2026-13445 · Malicious code in elephant-tusk-runner (npm)MAL-2026-13209 · Malicious code in @guangnao/claude-cli (npm)MAL-2026-12504 · Malicious code in @cy4dev/cydemo-bg-color (npm)MAL-2026-12334 · Malicious code in ach-detail (npm)数据来源：OpenSSF Malicious Packages。已撤回记录保留用于审计，不应作为当前活跃检测结果。