Withdrawn Advisory by GHSA should be withdrawn by OSV too

[geynis-jfrog]

The following are false positives that GHSA withdrew:

https://osv.dev/vulnerability/MAL-2026-3655
https://osv.dev/vulnerability/MAL-2026-3654

[jess-lowe]

Hi @geynis-jfrog, thanks for the report. We ingest MAL- prefixed data from the Malicious Packages repository. Please raise this issue there to get it properly fixed :).