False positive malware advisory for official astro@7.1.0 release

[pmort]

GitHub advisory GHSA-hpcx-pg6g-x697 incorrectly classifies astro@7.1.0 as malicious.

The advisory claims that:

• The legitimate Astro project is still on the v5.x release line
• astro@7.1.0 impersonates the real package
• obug, piccolore, and @astrojs/markdown-satteri are attacker-controlled typosquats

These claims are incorrect.

astro@7.1.0 is an official Astro release:

• Official release: https://github.com/withastro/astro/releases/tag/astro%407.1.0
• Official tag commit: fdd673cc193734d7818fe5ace39c86b9500b2754
• The release commit has GitHub’s verified signature
• The official package manifest declares version 7.1.0
• The official manifest includes obug, piccolore, and @astrojs/markdown-satteri
• The npm tarball integrity matches the official release

The dependencies are also legitimate:

• obug is maintained at https://github.com/sxzz/obug
• piccolore is maintained at https://github.com/delucis/piccolore
• @astrojs/markdown-satteri is maintained in the official Astro monorepo
• Astro’s v7 release notes explicitly document making Sätteri the default Markdown processor

Most importantly, the originating OpenSSF record has already been withdrawn as a false positive here.

The OpenSSF PR is titled “Remove false positive astro advisory.” The person who submitted the package on behalf of the Amazon researcher also commented:

Following @tolgaergin's rationale, I concur this was a false positive. Apologies for the inconvenience.

The withdrawn OSV record is here:

https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/astro/MAL-2026-10726.json

It contains:

"withdrawn": "2026-07-17T08:42:02Z"

It appears GitHub imported or published the advisory after the originating record had already been withdrawn. This is currently causing npm audit to report a critical malware finding for a legitimate Astro release.