GHSA-pq9g-f2rr-m4hw is a False Positve

[geynis-jfrog]

There is no malicious code there. What are the indications?

[taladrane]

Thanks for raising this. We understand the concern, but we aren’t able to share detailed indicators of compromise (IoCs) or specific detection signals publicly.

In this case, the package was removed as part of npm’s malware takedown policies and process: https://docs.npmjs.com/reporting-malware-in-an-npm-package

If you believe the package was removed in error, the best next step is to follow npm’s guidance for disputes/appeals and provide any supporting context (e.g., source repo, release process, ownership/maintainer info, and an explanation of the flagged behavior) so it can be reviewed through the appropriate channel: https://www.npmjs.com/support

[tjenkinson]

Please can you share the findings with the package/repo maintainers?