False positive malware advisory for official astro@7.1.0 release
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 58/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- javascript
- Domain
- security
Research direction
Start by comparing the GitHub advisory GHSA-hpcx-pg6g-x697 with the withdrawn OSV record at osv/withdrawn/npm/astro/MAL-2026-10726.json and the linked OpenSSF PR #1383. Confirm the withdrawal evidence and trace how the advisory is represented in this repository; done means the false-positive advisory no longer flags the official astro@7.1.0 release.
Written by the indexing model from the issue text.
Description
GitHub advisory GHSA-hpcx-pg6g-x697 incorrectly classifies astro@7.1.0 as malicious.
The advisory claims that:
- The legitimate Astro project is still on the v5.x release line
- astro@7.1.0 impersonates the real package
- obug, piccolore, and @astrojs/markdown-satteri are attacker-controlled typosquats
These claims are incorrect.
astro@7.1.0 is an official Astro release:
- Official release: https://github.com/withastro/astro/releases/tag/astro%407.1.0
- Official tag commit: fdd673cc193734d7818fe5ace39c86b9500b2754
- The release commit has GitHub’s verified signature
- The official package manifest declares version 7.1.0
- The official manifest includes obug, piccolore, and @astrojs/markdown-satteri
- The npm tarball integrity matches the official release
The dependencies are also legitimate:
- obug is maintained at https://github.com/sxzz/obug
- piccolore is maintained at https://github.com/delucis/piccolore
- @astrojs/markdown-satteri is maintained in the official Astro monorepo
- Astro’s v7 release notes explicitly document making Sätteri the default Markdown processor
Most importantly, the originating OpenSSF record has already been withdrawn as a false positive here.
The OpenSSF PR is titled “Remove false positive astro advisory.” The person who submitted the package on behalf of the Amazon researcher also commented:
Following @tolgaergin's rationale, I concur this was a false positive. Apologies for the inconvenience.
The withdrawn OSV record is here:
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/astro/MAL-2026-10726.json
It contains:
"withdrawn": "2026-07-17T08:42:02Z"
It appears GitHub imported or published the advisory after the originating record had already been withdrawn. This is currently causing npm audit to report a critical malware finding for a legitimate Astro release.
- Dominant language
- No language data
- Stars
- 2.5k
- Forks
- 772
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 48
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/advisory-database
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#9255 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#9164 · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8994 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#8898 · 4 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8841 ·
All issues in github/advisory-database
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
punkpeye/mcp-remote#369 ·
-
Mend: dependency security vulnerability untriaged
Difficulty 1/5 Under an hour Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
cisagov/vulnrichment#337 ·
-
bug DUP Reservations
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
bcgov/reserve-rec-public#896 ·