Skip to content

Commit 3cc5a3f

Browse files
author
github-actions
committed
Ingest OSV - Cloud Storage
1 parent c64710f commit 3cc5a3f

File tree

11 files changed

+815
-1
lines changed

11 files changed

+815
-1
lines changed

‎config/start-keys.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
amazon-inspector:
22
IN-MAL-: IN-MAL-2026-001146.json
33
kam193:
4-
pypi/packages/malicious/osv/: 1c857e3aa965de45eb2db2c4058207c7517f3a7a
4+
pypi/packages/malicious/osv/: fe1f949320bda082835e6129c3e4c1f34308da30
55
pypi/packages/pentest/osv/: 0d65fa30569acb74a4cd2f6968297f9cf794b510
66
pypi/packages/probably_pentest/osv/: dbfe89897c1972febd30846186aef4b82af004cd
77
ossf-package-analysis:

‎osv/malicious/pypi/apply-hive-table/MAL-0000-kam193-e7b05867320d1142.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"modified": "2026-03-23T14:19:12Z",
3+
"published": "2026-03-23T14:19:12Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in apply-hive-table (PyPI)",
7+
"details": "In specific environments, during installation, the package attempts to exfiltrate some basic information using DNS requests and then cover tracks by installing a similarly named package from the local private repository\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-urllib-slim\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - dependency-confusion\n\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "apply-hive-table"
13+
},
14+
"versions": [
15+
"3.1.4",
16+
"3.1.5"
17+
]
18+
}
19+
],
20+
"references": [
21+
{
22+
"type": "EVIDENCE",
23+
"url": "https://www.virustotal.com/gui/file/d6029cce705b3842042106efb737c8b14eb736fdbfb8d0d03c3dfbc8d6c207a5?nocache=1"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/loudpage5125"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://github.com/geekennedy/"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://github.com/GCLNS"
36+
},
37+
{
38+
"type": "WEB",
39+
"url": "https://bad-packages.kam193.eu/pypi/package/apply-hive-table"
40+
}
41+
],
42+
"credits": [
43+
{
44+
"name": "Kamil Mańkowski (kam193)",
45+
"type": "REPORTER",
46+
"contact": [
47+
"https://github.com/kam193",
48+
"https://bad-packages.kam193.eu/"
49+
]
50+
}
51+
],
52+
"database_specific": {
53+
"iocs": {
54+
"domains": [
55+
"1r.vc",
56+
"i.1r.vc"
57+
],
58+
"urls": [
59+
"https://storage.googleapis.com/py-pi/python_mac",
60+
"https://storage.googleapis.com/py-pi/python_rhel",
61+
"https://storage.googleapis.com/py-pi/python_win"
62+
]
63+
},
64+
"malicious-packages-origins": [
65+
{
66+
"source": "kam193",
67+
"sha256": "e7b05867320d1142c959aa2d1ce4a6cf7fcef12cdb7620cbede9b145204da4f4",
68+
"import_time": "2026-03-23T20:16:57.844311604Z",
69+
"id": "pypi/2026-02-urllib-slim/apply-hive-table",
70+
"modified_time": "2026-03-23T14:19:12.089912Z",
71+
"versions": [
72+
"3.1.4",
73+
"3.1.5"
74+
]
75+
}
76+
]
77+
}
78+
}

‎osv/malicious/pypi/dmclc/MAL-0000-kam193-98824533b2b8d261.json‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
{
2+
"modified": "2026-03-23T14:05:43Z",
3+
"published": "2026-03-23T14:05:43Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in dmclc (PyPI)",
7+
"details": "In specific environments, during installation, the package attempts to exfiltrate some basic information using DNS requests and then cover tracks by installing a similarly named package from the local private repository\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-urllib-slim\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - dependency-confusion\n\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "dmclc"
13+
},
14+
"versions": [
15+
"2.1.0",
16+
"2.1.1",
17+
"2.1.2",
18+
"2.1.3",
19+
"2.1.5",
20+
"2.1.6",
21+
"2.1.7",
22+
"2.1.9",
23+
"2.1.10"
24+
]
25+
}
26+
],
27+
"references": [
28+
{
29+
"type": "EVIDENCE",
30+
"url": "https://www.virustotal.com/gui/file/d6029cce705b3842042106efb737c8b14eb736fdbfb8d0d03c3dfbc8d6c207a5?nocache=1"
31+
},
32+
{
33+
"type": "WEB",
34+
"url": "https://github.com/loudpage5125"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://github.com/geekennedy/"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/GCLNS"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://bad-packages.kam193.eu/pypi/package/dmclc"
47+
}
48+
],
49+
"credits": [
50+
{
51+
"name": "Kamil Mańkowski (kam193)",
52+
"type": "REPORTER",
53+
"contact": [
54+
"https://github.com/kam193",
55+
"https://bad-packages.kam193.eu/"
56+
]
57+
}
58+
],
59+
"database_specific": {
60+
"iocs": {
61+
"domains": [
62+
"1r.vc",
63+
"i.1r.vc"
64+
],
65+
"urls": [
66+
"https://storage.googleapis.com/py-pi/python_mac",
67+
"https://storage.googleapis.com/py-pi/python_rhel",
68+
"https://storage.googleapis.com/py-pi/python_win"
69+
]
70+
},
71+
"malicious-packages-origins": [
72+
{
73+
"source": "kam193",
74+
"sha256": "98824533b2b8d26131cde65c6fee280bde414c4810f83d56b6b5f59fc7131df5",
75+
"import_time": "2026-03-23T20:16:57.84615076Z",
76+
"id": "pypi/2026-02-urllib-slim/dmclc",
77+
"modified_time": "2026-03-23T14:05:43.559439Z",
78+
"versions": [
79+
"2.1.0",
80+
"2.1.1",
81+
"2.1.2",
82+
"2.1.3",
83+
"2.1.5",
84+
"2.1.6",
85+
"2.1.7",
86+
"2.1.9",
87+
"2.1.10"
88+
]
89+
}
90+
]
91+
}
92+
}

‎osv/malicious/pypi/financial-crimes-general-utils/MAL-0000-kam193-0a25418866ddab42.json‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"modified": "2026-03-23T13:56:01Z",
3+
"published": "2026-03-23T13:56:01Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in financial-crimes-general-utils (PyPI)",
7+
"details": "In specific environments, during installation, the package attempts to exfiltrate some basic information using DNS requests and then cover tracks by installing a similarly named package from the local private repository\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-urllib-slim\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - dependency-confusion\n\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "financial-crimes-general-utils"
13+
},
14+
"versions": [
15+
"3.9.12"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "EVIDENCE",
22+
"url": "https://www.virustotal.com/gui/file/d6029cce705b3842042106efb737c8b14eb736fdbfb8d0d03c3dfbc8d6c207a5?nocache=1"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://github.com/loudpage5125"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://github.com/geekennedy/"
31+
},
32+
{
33+
"type": "WEB",
34+
"url": "https://github.com/GCLNS"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://bad-packages.kam193.eu/pypi/package/financial-crimes-general-utils"
39+
}
40+
],
41+
"credits": [
42+
{
43+
"name": "Kamil Mańkowski (kam193)",
44+
"type": "REPORTER",
45+
"contact": [
46+
"https://github.com/kam193",
47+
"https://bad-packages.kam193.eu/"
48+
]
49+
}
50+
],
51+
"database_specific": {
52+
"iocs": {
53+
"domains": [
54+
"1r.vc",
55+
"i.1r.vc"
56+
],
57+
"urls": [
58+
"https://storage.googleapis.com/py-pi/python_mac",
59+
"https://storage.googleapis.com/py-pi/python_rhel",
60+
"https://storage.googleapis.com/py-pi/python_win"
61+
]
62+
},
63+
"malicious-packages-origins": [
64+
{
65+
"source": "kam193",
66+
"sha256": "0a25418866ddab42755c1e981f2db0a0b6a8f49fc0635ee981ee6c36dff35b09",
67+
"import_time": "2026-03-23T20:16:57.84683842Z",
68+
"id": "pypi/2026-02-urllib-slim/financial-crimes-general-utils",
69+
"modified_time": "2026-03-23T13:56:01.921236Z",
70+
"versions": [
71+
"3.9.12"
72+
]
73+
}
74+
]
75+
}
76+
}

‎osv/malicious/pypi/modelconftranslator/MAL-0000-kam193-e1d918db23be048d.json‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"modified": "2026-03-23T14:03:21Z",
3+
"published": "2026-03-23T14:03:21Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in modelconftranslator (PyPI)",
7+
"details": "In specific environments, during installation, the package attempts to exfiltrate some basic information using DNS requests and then cover tracks by installing a similarly named package from the local private repository\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-urllib-slim\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - dependency-confusion\n\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "modelconftranslator"
13+
},
14+
"versions": [
15+
"8.13.4"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "EVIDENCE",
22+
"url": "https://www.virustotal.com/gui/file/d6029cce705b3842042106efb737c8b14eb736fdbfb8d0d03c3dfbc8d6c207a5?nocache=1"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://github.com/loudpage5125"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://github.com/geekennedy/"
31+
},
32+
{
33+
"type": "WEB",
34+
"url": "https://github.com/GCLNS"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://bad-packages.kam193.eu/pypi/package/modelconftranslator"
39+
}
40+
],
41+
"credits": [
42+
{
43+
"name": "Kamil Mańkowski (kam193)",
44+
"type": "REPORTER",
45+
"contact": [
46+
"https://github.com/kam193",
47+
"https://bad-packages.kam193.eu/"
48+
]
49+
}
50+
],
51+
"database_specific": {
52+
"iocs": {
53+
"domains": [
54+
"1r.vc",
55+
"i.1r.vc"
56+
],
57+
"urls": [
58+
"https://storage.googleapis.com/py-pi/python_mac",
59+
"https://storage.googleapis.com/py-pi/python_rhel",
60+
"https://storage.googleapis.com/py-pi/python_win"
61+
]
62+
},
63+
"malicious-packages-origins": [
64+
{
65+
"source": "kam193",
66+
"sha256": "e1d918db23be048d16eb2c61f1dd164b1e752aa80565b7a01fa31cda7cdf3115",
67+
"import_time": "2026-03-23T20:16:57.847635024Z",
68+
"id": "pypi/2026-02-urllib-slim/modelconftranslator",
69+
"modified_time": "2026-03-23T14:03:21.631203Z",
70+
"versions": [
71+
"8.13.4"
72+
]
73+
}
74+
]
75+
}
76+
}

0 commit comments

Comments
 (0)