Skip to content

Commit 25471ee

Browse files
author
github-actions
committed
Assign IDs
1 parent c8064bc commit 25471ee

File tree

18 files changed

+151
-226
lines changed

18 files changed

+151
-226
lines changed

‎osv/malicious/.id-allocator‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
48978a1e15668b78419469ee2dc5d7cb5e8d43a92907e03c739ac77f5f907e13
1+
7f23d3c18d0764dabdbad9027334769511cd25037be2c8201b048dcc002b2c5d

osv/malicious/pypi/aristanetworks/MAL-0000-kam193-734e78214abbde69.json renamed to osv/malicious/pypi/aristanetworks/MAL-2026-2173.json

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
"modified": "2026-03-25T05:04:39Z",
33
"published": "2026-03-25T05:04:39Z",
44
"schema_version": "1.7.4",
5-
"id": "",
6-
"summary": "Pentesting or research code in aristanetworks (PyPI)",
7-
"details": "Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n",
5+
"id": "MAL-2026-2173",
6+
"summary": "Malicious code in aristanetworks (PyPI)",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (734e78214abbde694d6041663ec7e34bb9f31c9265856540de7a1c0a8ffe5e33)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n",
88
"affected": [
99
{
1010
"package": {
@@ -35,11 +35,11 @@
3535
"database_specific": {
3636
"malicious-packages-origins": [
3737
{
38-
"source": "kam193",
39-
"sha256": "734e78214abbde694d6041663ec7e34bb9f31c9265856540de7a1c0a8ffe5e33",
40-
"import_time": "2026-03-25T05:52:35.046444742Z",
4138
"id": "pypi/GENERIC-standard-pypi-install-pentest/aristanetworks",
39+
"import_time": "2026-03-25T05:52:35.046444742Z",
4240
"modified_time": "2026-03-25T05:04:39.902614Z",
41+
"sha256": "734e78214abbde694d6041663ec7e34bb9f31c9265856540de7a1c0a8ffe5e33",
42+
"source": "kam193",
4343
"versions": [
4444
"99.0.0"
4545
]

osv/malicious/pypi/batch-shipyard/MAL-0000-kam193-83ca35f9b1e5fc77.json renamed to osv/malicious/pypi/batch-shipyard/MAL-2026-2174.json

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
"modified": "2026-03-25T05:04:42Z",
33
"published": "2026-03-25T05:04:42Z",
44
"schema_version": "1.7.4",
5-
"id": "",
6-
"summary": "Pentesting or research code in batch-shipyard (PyPI)",
7-
"details": "Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n",
5+
"id": "MAL-2026-2174",
6+
"summary": "Malicious code in batch-shipyard (PyPI)",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (83ca35f9b1e5fc77913037dde16ad175609dddc219e613c9dae7f752b112568f)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n",
88
"affected": [
99
{
1010
"package": {
@@ -35,11 +35,11 @@
3535
"database_specific": {
3636
"malicious-packages-origins": [
3737
{
38-
"source": "kam193",
39-
"sha256": "83ca35f9b1e5fc77913037dde16ad175609dddc219e613c9dae7f752b112568f",
40-
"import_time": "2026-03-25T05:52:35.047920775Z",
4138
"id": "pypi/GENERIC-standard-pypi-install-pentest/batch-shipyard",
39+
"import_time": "2026-03-25T05:52:35.047920775Z",
4240
"modified_time": "2026-03-25T05:04:42.355649Z",
41+
"sha256": "83ca35f9b1e5fc77913037dde16ad175609dddc219e613c9dae7f752b112568f",
42+
"source": "kam193",
4343
"versions": [
4444
"99.0.0"
4545
]

osv/malicious/pypi/facebookresearch/MAL-0000-kam193-b2532cd269873dbd.json renamed to osv/malicious/pypi/facebookresearch/MAL-2026-2175.json

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
"modified": "2026-03-25T05:07:03Z",
33
"published": "2026-03-25T05:06:56Z",
44
"schema_version": "1.7.4",
5-
"id": "",
6-
"summary": "Pentesting or research code in facebookresearch (PyPI)",
7-
"details": "Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n",
5+
"id": "MAL-2026-2175",
6+
"summary": "Malicious code in facebookresearch (PyPI)",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (b2532cd269873dbda78f99b9e22ab736c64c48ba32fa5c27deaf173fdbf33397)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n",
88
"affected": [
99
{
1010
"package": {
@@ -35,11 +35,11 @@
3535
"database_specific": {
3636
"malicious-packages-origins": [
3737
{
38-
"source": "kam193",
39-
"sha256": "b2532cd269873dbda78f99b9e22ab736c64c48ba32fa5c27deaf173fdbf33397",
40-
"import_time": "2026-03-25T05:52:35.048743416Z",
4138
"id": "pypi/GENERIC-standard-pypi-install-pentest/facebookresearch",
39+
"import_time": "2026-03-25T05:52:35.048743416Z",
4240
"modified_time": "2026-03-25T05:07:03.335391Z",
41+
"sha256": "b2532cd269873dbda78f99b9e22ab736c64c48ba32fa5c27deaf173fdbf33397",
42+
"source": "kam193",
4343
"versions": [
4444
"99.0.0"
4545
]

‎osv/malicious/pypi/fairness-bias/MAL-0000-kam193-c76439565a70fd01.json‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎osv/malicious/pypi/fairness-bias/MAL-2026-2170.json‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
{
2-
"modified": "2026-03-25T05:05:53Z",
2+
"modified": "2026-03-25T05:54:06Z",
33
"published": "2026-03-25T05:05:53Z",
44
"schema_version": "1.7.4",
55
"id": "MAL-2026-2170",
66
"summary": "Malicious code in fairness-bias (PyPI)",
7-
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (335b61ea467900506b7c9ab231d39902730c0c23c3b48c9292fd137ddd5d107c)\nThe OpenSSF Package Analysis project identified 'fairness-bias' @ 99.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (c76439565a70fd014098388baf5dd9a679f90be992102ba689fc0b7d6d3db352)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (335b61ea467900506b7c9ab231d39902730c0c23c3b48c9292fd137ddd5d107c)\nThe OpenSSF Package Analysis project identified 'fairness-bias' @ 99.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
88
"affected": [
99
{
1010
"package": {
@@ -16,7 +16,21 @@
1616
]
1717
}
1818
],
19+
"references": [
20+
{
21+
"type": "WEB",
22+
"url": "https://bad-packages.kam193.eu/pypi/package/fairness-bias"
23+
}
24+
],
1925
"credits": [
26+
{
27+
"name": "Kamil Mańkowski (kam193)",
28+
"type": "REPORTER",
29+
"contact": [
30+
"https://github.com/kam193",
31+
"https://bad-packages.kam193.eu/"
32+
]
33+
},
2034
{
2135
"name": "OpenSSF: Package Analysis",
2236
"type": "FINDER",
@@ -29,10 +43,20 @@
2943
"database_specific": {
3044
"malicious-packages-origins": [
3145
{
46+
"source": "ossf-package-analysis",
47+
"sha256": "335b61ea467900506b7c9ab231d39902730c0c23c3b48c9292fd137ddd5d107c",
3248
"import_time": "2026-03-25T05:08:01.309908366Z",
3349
"modified_time": "2026-03-25T05:05:53Z",
34-
"sha256": "335b61ea467900506b7c9ab231d39902730c0c23c3b48c9292fd137ddd5d107c",
35-
"source": "ossf-package-analysis",
50+
"versions": [
51+
"99.0.0"
52+
]
53+
},
54+
{
55+
"source": "kam193",
56+
"sha256": "c76439565a70fd014098388baf5dd9a679f90be992102ba689fc0b7d6d3db352",
57+
"import_time": "2026-03-25T05:52:35.049677585Z",
58+
"id": "pypi/GENERIC-standard-pypi-install-pentest/fairness-bias",
59+
"modified_time": "2026-03-25T05:07:03.893401Z",
3660
"versions": [
3761
"99.0.0"
3862
]

‎osv/malicious/pypi/globally/MAL-0000-kam193-1f2d16dd9f9dc8f8.json‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎osv/malicious/pypi/globally/MAL-2026-2171.json‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
{
2-
"modified": "2026-03-25T05:05:53Z",
2+
"modified": "2026-03-25T05:54:06Z",
33
"published": "2026-03-25T05:05:53Z",
44
"schema_version": "1.7.4",
55
"id": "MAL-2026-2171",
66
"summary": "Malicious code in globally (PyPI)",
7-
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (1444bc708fc8eb7cf1d9fafa94e92cb898e12dd7d7e51696c77784d52e8c90a0)\nThe OpenSSF Package Analysis project identified 'globally' @ 99.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (1f2d16dd9f9dc8f8c54504946e96b931fab9f6c893012e17b0c03dd531c49f5b)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (1444bc708fc8eb7cf1d9fafa94e92cb898e12dd7d7e51696c77784d52e8c90a0)\nThe OpenSSF Package Analysis project identified 'globally' @ 99.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
88
"affected": [
99
{
1010
"package": {
@@ -16,7 +16,21 @@
1616
]
1717
}
1818
],
19+
"references": [
20+
{
21+
"type": "WEB",
22+
"url": "https://bad-packages.kam193.eu/pypi/package/globally"
23+
}
24+
],
1925
"credits": [
26+
{
27+
"name": "Kamil Mańkowski (kam193)",
28+
"type": "REPORTER",
29+
"contact": [
30+
"https://github.com/kam193",
31+
"https://bad-packages.kam193.eu/"
32+
]
33+
},
2034
{
2135
"name": "OpenSSF: Package Analysis",
2236
"type": "FINDER",
@@ -29,10 +43,20 @@
2943
"database_specific": {
3044
"malicious-packages-origins": [
3145
{
46+
"source": "ossf-package-analysis",
47+
"sha256": "1444bc708fc8eb7cf1d9fafa94e92cb898e12dd7d7e51696c77784d52e8c90a0",
3248
"import_time": "2026-03-25T05:08:01.429036984Z",
3349
"modified_time": "2026-03-25T05:05:53Z",
34-
"sha256": "1444bc708fc8eb7cf1d9fafa94e92cb898e12dd7d7e51696c77784d52e8c90a0",
35-
"source": "ossf-package-analysis",
50+
"versions": [
51+
"99.0.0"
52+
]
53+
},
54+
{
55+
"source": "kam193",
56+
"sha256": "1f2d16dd9f9dc8f8c54504946e96b931fab9f6c893012e17b0c03dd531c49f5b",
57+
"import_time": "2026-03-25T05:52:35.05048674Z",
58+
"id": "pypi/GENERIC-standard-pypi-install-pentest/globally",
59+
"modified_time": "2026-03-25T05:09:10.186904Z",
3660
"versions": [
3761
"99.0.0"
3862
]

osv/malicious/pypi/kusto/MAL-0000-kam193-0bdb202529b567cd.json renamed to osv/malicious/pypi/kusto/MAL-2026-2176.json

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
"modified": "2026-03-25T05:04:47Z",
33
"published": "2026-03-25T05:04:47Z",
44
"schema_version": "1.7.4",
5-
"id": "",
6-
"summary": "Pentesting or research code in kusto (PyPI)",
7-
"details": "Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n",
5+
"id": "MAL-2026-2176",
6+
"summary": "Malicious code in kusto (PyPI)",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (0bdb202529b567cdcf3b62e44352186db2cb5defbfbfec0e7646a684838e08d7)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research \u0026 co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n",
88
"affected": [
99
{
1010
"package": {
@@ -35,11 +35,11 @@
3535
"database_specific": {
3636
"malicious-packages-origins": [
3737
{
38-
"source": "kam193",
39-
"sha256": "0bdb202529b567cdcf3b62e44352186db2cb5defbfbfec0e7646a684838e08d7",
40-
"import_time": "2026-03-25T05:52:35.051211961Z",
4138
"id": "pypi/GENERIC-standard-pypi-install-pentest/kusto",
39+
"import_time": "2026-03-25T05:52:35.051211961Z",
4240
"modified_time": "2026-03-25T05:04:47.699686Z",
41+
"sha256": "0bdb202529b567cdcf3b62e44352186db2cb5defbfbfec0e7646a684838e08d7",
42+
"source": "kam193",
4343
"versions": [
4444
"99.0.0"
4545
]

0 commit comments

Comments
 (0)