a lot of malware was added 4 hours ago

[christianhaller3000]

https://github.com/advisories?query=type%3Amalware

what happened here?

[Angus-Moore-Dev]

Not sure, but a lot of the npm packages in that list have been purged from the registry...

[philippmoehler0440]

Not sure, but a lot of the npm packages in that list have been purged from the registry...

Do you have an example for a removed package? Stil can find any of them. The only thing I saw is that every package is originated by the same author.

[JosephKrebs]

Do you have an example for a removed package? Stil can find any of them. The only thing I saw is that every package is originated by the same author.

V8:
https://www.npmjs.com/package/v8

[philippmoehler0440]

Do you have an example for a removed package? Stil can find any of them. The only thing I saw is that every package is originated by the same author.

V8: https://www.npmjs.com/package/v8

Thanks, it seems that this one doesn`t came from the mentioned author. Time being I found one of this single user that got the typical Security holding package: https://www.npmjs.com/package/passme

Perhaps it is a precaution to include all packages of an author in the advisory database if one or more were affected of this single publisher? At least it would make sense.

[KateCatlin]

Hi @christianhaller3000 @Angus-Moore-Dev @philippmoehler0440 and @JosephKrebs,
Thanks for writing in about this. We had a large influx of packages that were misidentified as malware. We’ve removed all of the inaccurate advisories and are taking steps to ensure this doesn’t occur again in the future.
I’ll go ahead and close this issue for now!
Cheers,
Kate