OSV withdrew 157 OSV malware reports after automated false positives incorrectly flagged trusted npm and PyPI packages, sending bad records into tools that rely…

OSV withdrew 157 malicious-package reports on May 26 after automated Amazon Inspector detections incorrectly flagged npm and PyPI packages as malware. The false positives were caused by automated malware detection systems that flagged suspicious dependency changes without verifying actual malicious payloads. FastAPI 0.136.3 was flagged for adding an undocumented dependency 'fastar>=0.9.0' to its standard optional dependency group, which was interpreted as a potential dependency-confusion or typosquat attack vector. The automated reports from Amazon Inspector were integrated into OpenSSF's malicious-packages repository in October 2025, creating a path for unvalidated detections to enter public package intelligence databases.