Skip to content

Commit 96d05d0

Browse files
author
github-actions
committed
Assign IDs
1 parent 6d0d53e commit 96d05d0

File tree

13 files changed

+86
-264
lines changed

13 files changed

+86
-264
lines changed

‎osv/malicious/.id-allocator‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
85c203107310a6b8e601278563523493b602d2646b052fe8d1bbbe7ae3623f15
1+
06306d25c0e7fdc3e9320ba173f022e8a646577ad8a87bf822c36cd0409fce15

osv/malicious/pypi/apply-hive-table/MAL-0000-kam193-cd10a24231fb7b68.json renamed to osv/malicious/pypi/apply-hive-table/MAL-2026-2112.json

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
"modified": "2026-03-23T14:19:12Z",
33
"published": "2026-03-23T14:19:12Z",
44
"schema_version": "1.7.4",
5-
"id": "",
5+
"id": "MAL-2026-2112",
66
"summary": "Malicious code in apply-hive-table (PyPI)",
7-
"details": "In specific environments, during installation, the package attempts to exfiltrate some basic information using DNS requests and then cover tracks by installing a similarly named package from the local private repository\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-urllib-slim\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - dependency-confusion\n\n",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (cd10a24231fb7b6830827a26ee11d450938fce94e811f0c233c6a63a8e3c98d9)\nIn specific environments, during installation, the package attempts to exfiltrate some basic information using DNS requests and then cover tracks by installing a similarly named package from the local private repository\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-02-urllib-slim\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - dependency-confusion\n",
88
"affected": [
99
{
1010
"package": {
@@ -51,11 +51,11 @@
5151
},
5252
"malicious-packages-origins": [
5353
{
54-
"source": "kam193",
55-
"sha256": "cd10a24231fb7b6830827a26ee11d450938fce94e811f0c233c6a63a8e3c98d9",
56-
"import_time": "2026-03-23T14:52:56.131890399Z",
5754
"id": "pypi/2026-02-urllib-slim/apply-hive-table",
55+
"import_time": "2026-03-23T14:52:56.131890399Z",
5856
"modified_time": "2026-03-23T14:19:12.089912Z",
57+
"sha256": "cd10a24231fb7b6830827a26ee11d450938fce94e811f0c233c6a63a8e3c98d9",
58+
"source": "kam193",
5959
"versions": [
6060
"3.1.4",
6161
"3.1.5"

‎osv/malicious/pypi/dmclc/MAL-0000-kam193-29d8ca432d1f2069.json‎

Lines changed: 0 additions & 80 deletions
This file was deleted.

‎osv/malicious/pypi/dmclc/MAL-2026-2106.json‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"modified": "2026-03-23T14:05:43Z",
2+
"modified": "2026-03-23T14:54:38Z",
33
"published": "2026-03-23T14:05:43Z",
44
"schema_version": "1.7.4",
55
"id": "MAL-2026-2106",
@@ -58,11 +58,29 @@
5858
},
5959
"malicious-packages-origins": [
6060
{
61-
"id": "pypi/2026-02-urllib-slim/dmclc",
61+
"source": "kam193",
62+
"sha256": "895439e6afba407fb85d315e2c99f0d1434905a1ee72b172e62d55abbb8c93a3",
6263
"import_time": "2026-03-23T14:29:23.854372764Z",
64+
"id": "pypi/2026-02-urllib-slim/dmclc",
6365
"modified_time": "2026-03-23T14:05:43.559439Z",
64-
"sha256": "895439e6afba407fb85d315e2c99f0d1434905a1ee72b172e62d55abbb8c93a3",
66+
"versions": [
67+
"2.1.0",
68+
"2.1.1",
69+
"2.1.2",
70+
"2.1.3",
71+
"2.1.5",
72+
"2.1.6",
73+
"2.1.7",
74+
"2.1.9",
75+
"2.1.10"
76+
]
77+
},
78+
{
6579
"source": "kam193",
80+
"sha256": "29d8ca432d1f2069462955be4a4ea77b5f7c8ee81ec568291be5b0ffce0aeebb",
81+
"import_time": "2026-03-23T14:52:56.133313105Z",
82+
"id": "pypi/2026-02-urllib-slim/dmclc",
83+
"modified_time": "2026-03-23T14:05:43.559439Z",
6684
"versions": [
6785
"2.1.0",
6886
"2.1.1",

osv/malicious/pypi/gcpipwrap/MAL-0000-kam193-af8d2f3dec668a16.json renamed to osv/malicious/pypi/gcpipwrap/MAL-2026-2113.json

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
"modified": "2026-03-20T15:31:01Z",
33
"published": "2026-03-20T15:31:01Z",
44
"schema_version": "1.7.4",
5-
"id": "",
5+
"id": "MAL-2026-2113",
66
"summary": "Malicious code in gcpipwrap (PyPI)",
7-
"details": "These packages are used as build dependencies of malicious packages in newer waves of the campaign 2026-02-urllib-slim. They are used to split the malicious action between dependencies and are not malicious alone, but are used together to: exfiltrate information through DNS, collect information about the processes and covering tracks by installing packages from local private repositories.\n\nPackage nspack additionally notifies upon importing a domain known for malicious activity with the package and hostname.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-geekennedy\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (af8d2f3dec668a16adf691aa26e16be82e62c2cdf993da1f4ff4afaceac30e92)\nThese packages are used as build dependencies of malicious packages in newer waves of the campaign 2026-02-urllib-slim. They are used to split the malicious action between dependencies and are not malicious alone, but are used together to: exfiltrate information through DNS, collect information about the processes and covering tracks by installing packages from local private repositories.\n\nPackage nspack additionally notifies upon importing a domain known for malicious activity with the package and hostname.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-geekennedy\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The malicious code is intentionally included in a dependency of the package\n",
88
"affected": [
99
{
1010
"package": {
@@ -47,11 +47,11 @@
4747
},
4848
"malicious-packages-origins": [
4949
{
50-
"source": "kam193",
51-
"sha256": "af8d2f3dec668a16adf691aa26e16be82e62c2cdf993da1f4ff4afaceac30e92",
52-
"import_time": "2026-03-23T14:52:56.133889791Z",
5350
"id": "pypi/2026-03-geekennedy/gcpipwrap",
51+
"import_time": "2026-03-23T14:52:56.133889791Z",
5452
"modified_time": "2026-03-20T15:31:01.824679Z",
53+
"sha256": "af8d2f3dec668a16adf691aa26e16be82e62c2cdf993da1f4ff4afaceac30e92",
54+
"source": "kam193",
5555
"versions": [
5656
"0.1.2",
5757
"0.1.3",

osv/malicious/pypi/indpack/MAL-0000-kam193-85f1ca1d5abdcf21.json renamed to osv/malicious/pypi/indpack/MAL-2026-2114.json

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
"modified": "2026-03-20T15:31:24Z",
33
"published": "2026-03-20T15:31:24Z",
44
"schema_version": "1.7.4",
5-
"id": "",
5+
"id": "MAL-2026-2114",
66
"summary": "Malicious code in indpack (PyPI)",
7-
"details": "These packages are used as build dependencies of malicious packages in newer waves of the campaign 2026-02-urllib-slim. They are used to split the malicious action between dependencies and are not malicious alone, but are used together to: exfiltrate information through DNS, collect information about the processes and covering tracks by installing packages from local private repositories.\n\nPackage nspack additionally notifies upon importing a domain known for malicious activity with the package and hostname.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-geekennedy\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (85f1ca1d5abdcf2139039fc5e8a08068a8c2cacca8a31fed38fbde74f7b8c04d)\nThese packages are used as build dependencies of malicious packages in newer waves of the campaign 2026-02-urllib-slim. They are used to split the malicious action between dependencies and are not malicious alone, but are used together to: exfiltrate information through DNS, collect information about the processes and covering tracks by installing packages from local private repositories.\n\nPackage nspack additionally notifies upon importing a domain known for malicious activity with the package and hostname.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-geekennedy\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The malicious code is intentionally included in a dependency of the package\n",
88
"affected": [
99
{
1010
"package": {
@@ -41,11 +41,11 @@
4141
},
4242
"malicious-packages-origins": [
4343
{
44-
"source": "kam193",
45-
"sha256": "85f1ca1d5abdcf2139039fc5e8a08068a8c2cacca8a31fed38fbde74f7b8c04d",
46-
"import_time": "2026-03-23T14:52:56.134454113Z",
4744
"id": "pypi/2026-03-geekennedy/indpack",
45+
"import_time": "2026-03-23T14:52:56.134454113Z",
4846
"modified_time": "2026-03-20T15:31:24.031125Z",
47+
"sha256": "85f1ca1d5abdcf2139039fc5e8a08068a8c2cacca8a31fed38fbde74f7b8c04d",
48+
"source": "kam193",
4949
"versions": [
5050
"0.1.0"
5151
]

‎osv/malicious/pypi/modelconftranslator/MAL-0000-kam193-3e044e5a77e116a3.json‎

Lines changed: 0 additions & 64 deletions
This file was deleted.

‎osv/malicious/pypi/modelconftranslator/MAL-2026-2108.json‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"modified": "2026-03-23T14:03:21Z",
2+
"modified": "2026-03-23T14:54:39Z",
33
"published": "2026-03-23T14:03:21Z",
44
"schema_version": "1.7.4",
55
"id": "MAL-2026-2108",
@@ -50,11 +50,21 @@
5050
},
5151
"malicious-packages-origins": [
5252
{
53-
"id": "pypi/2026-02-urllib-slim/modelconftranslator",
53+
"source": "kam193",
54+
"sha256": "6f61fcbf30122cbf577490fab3968c6b41f95d4d23f6916a7211066bd735ff6e",
5455
"import_time": "2026-03-23T14:29:23.859056307Z",
56+
"id": "pypi/2026-02-urllib-slim/modelconftranslator",
5557
"modified_time": "2026-03-23T14:03:21.631203Z",
56-
"sha256": "6f61fcbf30122cbf577490fab3968c6b41f95d4d23f6916a7211066bd735ff6e",
58+
"versions": [
59+
"8.13.4"
60+
]
61+
},
62+
{
5763
"source": "kam193",
64+
"sha256": "3e044e5a77e116a3c892a4190bf3671c28005c9687da613b83969372b7fe02f2",
65+
"import_time": "2026-03-23T14:52:56.135175112Z",
66+
"id": "pypi/2026-02-urllib-slim/modelconftranslator",
67+
"modified_time": "2026-03-23T14:03:21.631203Z",
5868
"versions": [
5969
"8.13.4"
6070
]

osv/malicious/pypi/nspack/MAL-0000-kam193-7741f090145e1e4b.json renamed to osv/malicious/pypi/nspack/MAL-2026-2115.json

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
"modified": "2026-03-20T15:28:57Z",
33
"published": "2026-03-20T15:28:57Z",
44
"schema_version": "1.7.4",
5-
"id": "",
5+
"id": "MAL-2026-2115",
66
"summary": "Malicious code in nspack (PyPI)",
7-
"details": "These packages are used as build dependencies of malicious packages in newer waves of the campaign 2026-02-urllib-slim. They are used to split the malicious action between dependencies and are not malicious alone, but are used together to: exfiltrate information through DNS, collect information about the processes and covering tracks by installing packages from local private repositories.\n\nPackage nspack additionally notifies upon importing a domain known for malicious activity with the package and hostname.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-geekennedy\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n",
7+
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (7741f090145e1e4bbd7998edba9c8151bd5dd3380adaa430e8f05cb2c814396f)\nThese packages are used as build dependencies of malicious packages in newer waves of the campaign 2026-02-urllib-slim. They are used to split the malicious action between dependencies and are not malicious alone, but are used together to: exfiltrate information through DNS, collect information about the processes and covering tracks by installing packages from local private repositories.\n\nPackage nspack additionally notifies upon importing a domain known for malicious activity with the package and hostname.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-geekennedy\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The malicious code is intentionally included in a dependency of the package\n",
88
"affected": [
99
{
1010
"package": {
@@ -48,11 +48,11 @@
4848
},
4949
"malicious-packages-origins": [
5050
{
51-
"source": "kam193",
52-
"sha256": "7741f090145e1e4bbd7998edba9c8151bd5dd3380adaa430e8f05cb2c814396f",
53-
"import_time": "2026-03-23T14:52:56.135771589Z",
5451
"id": "pypi/2026-03-geekennedy/nspack",
52+
"import_time": "2026-03-23T14:52:56.135771589Z",
5553
"modified_time": "2026-03-20T15:28:57.429852Z",
54+
"sha256": "7741f090145e1e4bbd7998edba9c8151bd5dd3380adaa430e8f05cb2c814396f",
55+
"source": "kam193",
5656
"versions": [
5757
"0.1.0",
5858
"0.1.2",

0 commit comments

Comments
 (0)