openapi-contract-diff

The fragment contains no evident malware. It has a release-control defect: the two breaking finding IDs are unrecognized and omitted, while both the script and npm command prevent a no-go or command failure from producing a failing pipeline status. As provided, the 2026-09-04 report cannot mechanically stop a release. Fix classification and exit-status enforcement, retaining the optional-header finding as advisory.