Broken reference URL in GHSA-hrpm-xfxx-jp2g (blog.phylum.io)

[hara-satoshi-ymr]

Advisory

GHSA-hrpm-xfxx-jp2g

Issue

One of the references is no longer reachable:

https://blog.phylum.io/dozens-of-npm-packages-caught-attempting-to-deploy-reverse-shell

The TLS handshake fails because the server only returns Fastly's fallback certificate (CN=fallback.tls.fastly.net), which does not include blog.phylum.io in its SAN. Phylum was acquired by Veracode in January 2025 and its blog was migrated to veracode.com, so this old subdomain appears to be an orphaned/decommissioned host.

Suggested fix

Replace the reference with the migrated article on Veracode's blog (verified reachable, HTTP 200):

https://www.veracode.com/blog/dozens-of-npm-packages-caught-attempting-to-deploy-reverse-shell/

[hara-satoshi-ymr]

Filed the fix at the source instead: ossf/malicious-packages#1482, updating the same reference in MAL-2024-1745.json.

Per How we took malware advisories beyond npm, the importer for OpenSSF malicious-packages "walk[s] the source repository's file tree, pick[s] up files changed since the last run, and process[es] each one," so once that PR merges this advisory should pick up the corrected URL automatically without further action here.