False positive: GHSA-hpcx-pg6g-x697 flags legitimate astro@7.1.0 as malware

[faro507agencia-pixel]

GHSA-hpcx-pg6g-x697 classifies the official astro@7.1.0 release as registry
impersonation malware. This is a false positive, and the upstream source has
already retracted it.

Evidence:

1. The source entry (OSSF malicious-packages MAL-2026-10726) was removed as a
   false positive on 2026-07-22 via
   Remove false positive astro advisory ossf/malicious-packages#1383 — five days before this
   GHSA was published.

2. astro@7.1.0 carries valid SLSA provenance tying the tarball to the
   withastro/astro GitHub Actions release workflow
   (.github/workflows/release.yml), published by the project's actual
   maintainers on 2026-07-16. The astro@7.1.0 git tag exists upstream.

3. The advisory's own premise is outdated: it states Astro "is on the v5.x
   line". That was true in early 2025. Astro is currently on 7.1.x, with 7.1.6
   published as of 2026-07-29.

4. The flagged dependencies are not typosquats. piccolore is maintained by
   delucis (Chris Swithinbank, Astro core maintainer, Starlight lead) and obug
   by sxzz (Kevin Deng, Vue core team). Both are clean: no network, no
   filesystem access, no child_process, no install scripts.

5. npm has not unpublished or deprecated the package, and six further releases
   have shipped since.

Requesting this advisory be withdrawn to match the upstream retraction.