Skip to content

Commit ff4f580

Browse files
author
github-actions
committed
Ingest OSV - Cloud Storage
1 parent a85b631 commit ff4f580

8 files changed

+325
-2
lines changed

‎config/start-keys.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
amazon-inspector:
22
IN-MAL-: IN-MAL-2026-000461.json
33
kam193:
4-
pypi/packages/malicious/osv/: 9e3a2a5b085a3cac6a1e2c878da256e2ae8ee20f
4+
pypi/packages/malicious/osv/: bb41a4f73ad0342574c255a4f4509acf5176e023
55
pypi/packages/pentest/osv/: 0d65fa30569acb74a4cd2f6968297f9cf794b510
66
pypi/packages/probably_pentest/osv/: d85355ff7c5f46aa548621c0248747e10eee650a
77
ossf-package-analysis:
8-
confident/: confident/20260321/225755-npm-@modals/layout-99999.0.1.json
8+
confident/: confident/20260322/072042-npm-remitly-blog-99999.0.0.json
99
reversing-labs:
1010
RLMA-: RLMA-2026-01666.json
1111
RLUA-: RLUA-2026-01611.json

‎osv/malicious/npm/@thiagoemmanuell/unhandledrejection/MAL-0000-ossf-package-analysis-5ac41fed5a1a3457.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2026-03-22T19:19:54Z",
3+
"published": "2026-03-22T19:19:54Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in @thiagoemmanuell/unhandledrejection (npm)",
7+
"details": "The OpenSSF Package Analysis project identified '@thiagoemmanuell/unhandledrejection' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@thiagoemmanuell/unhandledrejection"
13+
},
14+
"versions": [
15+
"1.0.0"
16+
]
17+
}
18+
],
19+
"credits": [
20+
{
21+
"name": "OpenSSF: Package Analysis",
22+
"type": "FINDER",
23+
"contact": [
24+
"https://github.com/ossf/package-analysis",
25+
"https://openssf.slack.com/channels/package_analysis"
26+
]
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "ossf-package-analysis",
33+
"sha256": "5ac41fed5a1a3457deca490f1b90216ef63d1263f041fcee111c14eddb777efd",
34+
"import_time": "2026-03-22T23:10:11.31130859Z",
35+
"modified_time": "2026-03-22T19:19:54Z",
36+
"versions": [
37+
"1.0.0"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/cms-catalogue/MAL-0000-ossf-package-analysis-e2b6e877ee3e0be9.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2026-03-21T10:40:18Z",
3+
"published": "2026-03-21T10:40:18Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in cms-catalogue (npm)",
7+
"details": "The OpenSSF Package Analysis project identified 'cms-catalogue' @ 99.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "cms-catalogue"
13+
},
14+
"versions": [
15+
"99.0.1"
16+
]
17+
}
18+
],
19+
"credits": [
20+
{
21+
"name": "OpenSSF: Package Analysis",
22+
"type": "FINDER",
23+
"contact": [
24+
"https://github.com/ossf/package-analysis",
25+
"https://openssf.slack.com/channels/package_analysis"
26+
]
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "ossf-package-analysis",
33+
"sha256": "e2b6e877ee3e0be9b6fa0c5ca347f01ce90381e62e9c5ad293879cb0173b6742",
34+
"import_time": "2026-03-22T23:10:11.028567254Z",
35+
"modified_time": "2026-03-21T10:40:18Z",
36+
"versions": [
37+
"99.0.1"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/native_dep/MAL-0000-ossf-package-analysis-62fe85371a2100e5.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2026-03-20T09:46:03Z",
3+
"published": "2026-03-20T09:46:03Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in native_dep (npm)",
7+
"details": "The OpenSSF Package Analysis project identified 'native_dep' @ 2.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "native_dep"
13+
},
14+
"versions": [
15+
"2.0.2"
16+
]
17+
}
18+
],
19+
"credits": [
20+
{
21+
"name": "OpenSSF: Package Analysis",
22+
"type": "FINDER",
23+
"contact": [
24+
"https://github.com/ossf/package-analysis",
25+
"https://openssf.slack.com/channels/package_analysis"
26+
]
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "ossf-package-analysis",
33+
"sha256": "62fe85371a2100e5ef011320b6359b52313ad88ec2d96d7ad1eed181d13143ec",
34+
"import_time": "2026-03-22T23:10:10.928572666Z",
35+
"modified_time": "2026-03-20T09:46:03Z",
36+
"versions": [
37+
"2.0.2"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/unhandledrejection1/MAL-0000-ossf-package-analysis-77e22c910e188d93.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2026-03-22T19:55:35Z",
3+
"published": "2026-03-22T19:55:35Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in unhandledrejection1 (npm)",
7+
"details": "The OpenSSF Package Analysis project identified 'unhandledrejection1' @ 1.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "unhandledrejection1"
13+
},
14+
"versions": [
15+
"1.0.2"
16+
]
17+
}
18+
],
19+
"credits": [
20+
{
21+
"name": "OpenSSF: Package Analysis",
22+
"type": "FINDER",
23+
"contact": [
24+
"https://github.com/ossf/package-analysis",
25+
"https://openssf.slack.com/channels/package_analysis"
26+
]
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "ossf-package-analysis",
33+
"sha256": "77e22c910e188d936e242af099f6bf026ceace104d9c1da3e772ba7faad05595",
34+
"import_time": "2026-03-22T23:10:11.409338138Z",
35+
"modified_time": "2026-03-22T19:55:35Z",
36+
"versions": [
37+
"1.0.2"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/pypi/thisismytest/MAL-0000-ossf-package-analysis-19f3b6e447fea825.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2026-03-21T18:24:07Z",
3+
"published": "2026-03-21T18:24:07Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in thisismytest (PyPI)",
7+
"details": "The OpenSSF Package Analysis project identified 'thisismytest' @ 4.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "thisismytest"
13+
},
14+
"versions": [
15+
"4.0.0"
16+
]
17+
}
18+
],
19+
"credits": [
20+
{
21+
"name": "OpenSSF: Package Analysis",
22+
"type": "FINDER",
23+
"contact": [
24+
"https://github.com/ossf/package-analysis",
25+
"https://openssf.slack.com/channels/package_analysis"
26+
]
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "ossf-package-analysis",
33+
"sha256": "19f3b6e447fea825bca111985cb5f707015439b58f5d4982bb33b91a8f37a1c0",
34+
"import_time": "2026-03-22T23:10:11.119892579Z",
35+
"modified_time": "2026-03-21T18:24:07Z",
36+
"versions": [
37+
"4.0.0"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/pypi/thisismytest/MAL-0000-ossf-package-analysis-421d783dd1f7d99f.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2026-03-21T18:25:55Z",
3+
"published": "2026-03-21T18:25:55Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in thisismytest (PyPI)",
7+
"details": "The OpenSSF Package Analysis project identified 'thisismytest' @ 5.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "thisismytest"
13+
},
14+
"versions": [
15+
"5.0.0"
16+
]
17+
}
18+
],
19+
"credits": [
20+
{
21+
"name": "OpenSSF: Package Analysis",
22+
"type": "FINDER",
23+
"contact": [
24+
"https://github.com/ossf/package-analysis",
25+
"https://openssf.slack.com/channels/package_analysis"
26+
]
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "ossf-package-analysis",
33+
"sha256": "421d783dd1f7d99fd582b5a07e9f691a9c568faa36be4595a167fc98a6c3334e",
34+
"import_time": "2026-03-22T23:10:11.212004356Z",
35+
"modified_time": "2026-03-21T18:25:55Z",
36+
"versions": [
37+
"5.0.0"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/pypi/utf-cleaner/MAL-0000-kam193-8382837e2b442062.json‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"modified": "2026-03-22T22:57:59Z",
3+
"published": "2026-03-22T22:57:59Z",
4+
"schema_version": "1.7.4",
5+
"id": "",
6+
"summary": "Malicious code in utf-cleaner (PyPI)",
7+
"details": "During import, the package silently downloads and executes remote code. This code starts a web server in the separate process and listens for commands to execute from a C2 server, as well as periodically sends a beacon to C2 allowing discovery and finishing execution.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-03-old-utf-cleaner\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "PyPI",
12+
"name": "utf-cleaner"
13+
},
14+
"versions": [
15+
"3.3.7",
16+
"3.3.8",
17+
"3.3.9",
18+
"3.4.0",
19+
"3.4.1",
20+
"3.4.2"
21+
]
22+
}
23+
],
24+
"references": [
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/xcummins/gits/blob/main/gits/__init__.py#L24-L32"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://bad-packages.kam193.eu/pypi/package/utf-cleaner"
32+
}
33+
],
34+
"credits": [
35+
{
36+
"name": "Kamil Mańkowski (kam193)",
37+
"type": "REPORTER",
38+
"contact": [
39+
"https://github.com/kam193",
40+
"https://bad-packages.kam193.eu/"
41+
]
42+
}
43+
],
44+
"database_specific": {
45+
"iocs": {
46+
"ips": [
47+
"90.156.226.65"
48+
],
49+
"urls": [
50+
"https://github.com/xcummins/gits"
51+
]
52+
},
53+
"malicious-packages-origins": [
54+
{
55+
"source": "kam193",
56+
"sha256": "8382837e2b4420621b1ac738092bf8d584dde848e0f8cd6bbf73b0fbc6f74fcb",
57+
"import_time": "2026-03-22T23:10:44.29819505Z",
58+
"id": "pypi/2026-03-old-utf-cleaner/utf-cleaner",
59+
"modified_time": "2026-03-22T22:57:59.555318Z",
60+
"versions": [
61+
"3.3.7",
62+
"3.3.8",
63+
"3.3.9",
64+
"3.4.0",
65+
"3.4.1",
66+
"3.4.2"
67+
]
68+
}
69+
]
70+
}
71+
}

0 commit comments

Comments
 (0)