Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

False positive: GHSA-hpcx-pg6g-x697 flags legitimate astro@7.1.0 as malware

Open
#8,871 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript
Domain
security

Research direction

Start by reviewing the GHSA record, the linked malicious-packages PR 1383, and the provenance evidence for astro@7.1.0, including .github/workflows/release.yml. Done means the advisory database confirms the false positive and withdraws the advisory as requested.

Written by the indexing model from the issue text.

Description

GHSA-hpcx-pg6g-x697 classifies the official astro@7.1.0 release as registry
impersonation malware. This is a false positive, and the upstream source has
already retracted it.

Evidence:

  1. The source entry (OSSF malicious-packages MAL-2026-10726) was removed as a
    false positive on 2026-07-22 via
    https://github.com/ossf/malicious-packages/pull/1383 — five days before this
    GHSA was published.

  2. astro@7.1.0 carries valid SLSA provenance tying the tarball to the
    withastro/astro GitHub Actions release workflow
    (.github/workflows/release.yml), published by the project's actual
    maintainers on 2026-07-16. The astro@7.1.0 git tag exists upstream.

  3. The advisory's own premise is outdated: it states Astro "is on the v5.x
    line". That was true in early 2025. Astro is currently on 7.1.x, with 7.1.6
    published as of 2026-07-29.

  4. The flagged dependencies are not typosquats. piccolore is maintained by
    delucis (Chris Swithinbank, Astro core maintainer, Starlight lead) and obug
    by sxzz (Kevin Deng, Vue core team). Both are clean: no network, no
    filesystem access, no child_process, no install scripts.

  5. npm has not unpublished or deprecated the package, and six further releases
    have shipped since.

Requesting this advisory be withdrawn to match the upstream retraction.

Dominant language
No language data
Stars
2.5k
Forks
772
Avg merge
3d 18h
Merged PRs (30d)
48

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/advisory-database

All issues in github/advisory-database

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.