Socket: OSV Withdraws 157 Malware Reports

What it is

Analysis of OpenSSF's May 26 withdrawal of 157 malicious-package reports from its malicious-packages repository (the source feeding the OSV database). The reports falsely flagged trusted npm and PyPI packages as malware. The exemplar record is MAL-2026-4750, "Malicious code in fastapi (PyPI)," covering FastAPI 0.136.3 and attributed to Amazon Inspector. The cleanup PR was titled "Withdraw FastAPI v0.136.3 and other FPs reports."

How it works

FastAPI's record did not describe a payload — no install-time execution, credential theft, C2, or exfiltration. It flagged that release 0.136.3 added an undocumented dependency, fastar>=0.9.0, to FastAPI's standard optional dependency group, calling fastar "typosquat-shaped" and a possible dependency-confusion vector. A suspicious-looking dependency change was promoted to a malicious-code record without maintainer verification.

The ingestion path: in October 2025 OpenSSF added Amazon Inspector as an automated source, authenticating to an OpenSSF-controlled AWS role that pulls reports from an Amazon Inspector bucket into OSV-format malware records. The final rollback commit left one still-active record under osv/malicious and moved the rest into osv/withdrawn. Chi Tran wrote in the PR: "We have paused our automation and taking actions."

Preconditions / Affected

Matters if your scanners, SBOM tooling, registry controls, dashboards, policy engines, or CI/CD gates consume OSV data as an enforcement source — a false malware record can block builds or deployments before the record is corrected. Affected packages span npm and PyPI: FastAPI, Strawberry GraphQL, @tanstack/start-storage-context, @nx/key, @ctrl/plex, rdflib, qontract-reconcile, massive, notebook-intelligence, pulumi-vcd, art-template, plus a long tail of MCP servers, AI tools, CLI packages, framework forks, component libraries, and API clients.

What to do

Malware alerts carry heavier operational weight than ordinary CVEs — they trigger emergency review, package removal, and credential-rotation, whereas vulnerabilities can be triaged by version range/reachability. If you gated on these records, re-check the affected packages and clear false positives rather than acting on the removal/rotation reflex.

Caveats

• Attribution is not uniform across the 157. Some are cleanly Amazon Inspector-attributed; others are mixed, preserving older origins from prior confirmed compromises alongside newer Inspector entries. Do not blanket-whitelist all withdrawn packages.
• @tanstack/start-storage-context is a mixed case: it had earlier genuine compromise context, while only the disputed 1.167.4 version was part of the May 26 false-positive cleanup. Treat prior compromises as still valid.