generated from ossf/project-template
-
Notifications
You must be signed in to change notification settings - Fork 26
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into api-demo-sample-lib3
- Loading branch information
Showing
17 changed files
with
692 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| ossf-package-analysis: | ||
| confident/: confident/20241226/035053-npm-aws-iot-samples-util-1.0.0.json | ||
| confident/: confident/20250107/151756-npm-cursor-retrieval-1.0.1.json | ||
| reversing-labs: | ||
| RLMA-: RLMA-2024-11212.json | ||
| RLUA-: RLUA-2024-11114.json |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 3a813cddb668a8215fc89c57aaca200c31398154100b29d17d202d1b9c8fa888 | ||
| 63643a4cad9a0f03f82e884cfcb74e14040bad3900e4682c6f5f514edfc111d6 |
42 changes: 42 additions & 0 deletions
42
osv/malicious/npm/@patternfly-v5/patternfly/MAL-2025-26.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| { | ||
| "modified": "2025-01-07T12:33:06Z", | ||
| "published": "2025-01-07T12:33:06Z", | ||
| "schema_version": "1.5.0", | ||
| "id": "MAL-2025-26", | ||
| "summary": "Malicious code in @patternfly-v5/patternfly (npm)", | ||
| "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (b43e835ee1484fff5f40f97988af91cf9adfabcef41f9bd4970a9eee273ee7ba)\nThe OpenSSF Package Analysis project identified '@patternfly-v5/patternfly' @ 1.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "@patternfly-v5/patternfly" | ||
| }, | ||
| "versions": [ | ||
| "1.0.2" | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "name": "OpenSSF: Package Analysis", | ||
| "type": "FINDER", | ||
| "contact": [ | ||
| "https://github.com/ossf/package-analysis", | ||
| "https://openssf.slack.com/channels/package_analysis" | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "malicious-packages-origins": [ | ||
| { | ||
| "import_time": "2025-01-07T12:46:21.97193352Z", | ||
| "modified_time": "2025-01-07T12:33:06Z", | ||
| "sha256": "b43e835ee1484fff5f40f97988af91cf9adfabcef41f9bd4970a9eee273ee7ba", | ||
| "source": "ossf-package-analysis", | ||
| "versions": [ | ||
| "1.0.2" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| { | ||
| "modified": "2025-01-06T14:50:50Z", | ||
| "published": "2025-01-06T14:50:50Z", | ||
| "schema_version": "1.5.0", | ||
| "id": "MAL-2025-22", | ||
| "summary": "Malicious code in @vf-org/smapi-js-core (npm)", | ||
| "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (4d12d4e4388bdfd37673aa9e4527d481312b56703325b9cc938f22cac268f25e)\nThe OpenSSF Package Analysis project identified '@vf-org/smapi-js-core' @ 8.2.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "@vf-org/smapi-js-core" | ||
| }, | ||
| "versions": [ | ||
| "8.2.0" | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "name": "OpenSSF: Package Analysis", | ||
| "type": "FINDER", | ||
| "contact": [ | ||
| "https://github.com/ossf/package-analysis", | ||
| "https://openssf.slack.com/channels/package_analysis" | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "malicious-packages-origins": [ | ||
| { | ||
| "import_time": "2025-01-06T15:05:37.941040121Z", | ||
| "modified_time": "2025-01-06T14:50:50Z", | ||
| "sha256": "4d12d4e4388bdfd37673aa9e4527d481312b56703325b9cc938f22cac268f25e", | ||
| "source": "ossf-package-analysis", | ||
| "versions": [ | ||
| "8.2.0" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| { | ||
| "modified": "2025-01-07T15:35:45Z", | ||
| "published": "2025-01-07T15:35:45Z", | ||
| "schema_version": "1.5.0", | ||
| "id": "MAL-2025-27", | ||
| "summary": "Malicious code in cursor-always-local (npm)", | ||
| "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (614a7726e7b2899695d56d3b75f1f9179a6fcde5654913693b20e521e476840f)\nThe OpenSSF Package Analysis project identified 'cursor-always-local' @ 1.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "cursor-always-local" | ||
| }, | ||
| "versions": [ | ||
| "1.0.2" | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "name": "OpenSSF: Package Analysis", | ||
| "type": "FINDER", | ||
| "contact": [ | ||
| "https://github.com/ossf/package-analysis", | ||
| "https://openssf.slack.com/channels/package_analysis" | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "malicious-packages-origins": [ | ||
| { | ||
| "import_time": "2025-01-07T15:53:25.268217055Z", | ||
| "modified_time": "2025-01-07T15:35:45Z", | ||
| "sha256": "614a7726e7b2899695d56d3b75f1f9179a6fcde5654913693b20e521e476840f", | ||
| "source": "ossf-package-analysis", | ||
| "versions": [ | ||
| "1.0.2" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| { | ||
| "modified": "2025-01-07T15:53:51Z", | ||
| "published": "2025-01-07T15:17:56Z", | ||
| "schema_version": "1.5.0", | ||
| "id": "MAL-2025-28", | ||
| "summary": "Malicious code in cursor-retrieval (npm)", | ||
| "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (62221769774a8b1379cf87256d847c23b08155088aa7dfd78c01d78ffba5e9ba)\nThe OpenSSF Package Analysis project identified 'cursor-retrieval' @ 1.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "cursor-retrieval" | ||
| }, | ||
| "versions": [ | ||
| "1.0.1", | ||
| "1.0.2" | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "name": "OpenSSF: Package Analysis", | ||
| "type": "FINDER", | ||
| "contact": [ | ||
| "https://github.com/ossf/package-analysis", | ||
| "https://openssf.slack.com/channels/package_analysis" | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "malicious-packages-origins": [ | ||
| { | ||
| "import_time": "2025-01-07T15:53:25.198549801Z", | ||
| "modified_time": "2025-01-07T15:17:56Z", | ||
| "sha256": "62221769774a8b1379cf87256d847c23b08155088aa7dfd78c01d78ffba5e9ba", | ||
| "source": "ossf-package-analysis", | ||
| "versions": [ | ||
| "1.0.1" | ||
| ] | ||
| }, | ||
| { | ||
| "import_time": "2025-01-07T15:53:25.353489496Z", | ||
| "modified_time": "2025-01-07T15:35:45Z", | ||
| "sha256": "80696b814c9a20ed7aa8c27772abf60d9b33ea85a24eb5699b90c75f802f2fe2", | ||
| "source": "ossf-package-analysis", | ||
| "versions": [ | ||
| "1.0.2" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } |
52 changes: 52 additions & 0 deletions
52
osv/malicious/npm/cursor-shadow-workspace/MAL-2025-29.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| { | ||
| "modified": "2025-01-07T16:19:02Z", | ||
| "published": "2025-01-07T15:36:08Z", | ||
| "schema_version": "1.5.0", | ||
| "id": "MAL-2025-29", | ||
| "summary": "Malicious code in cursor-shadow-workspace (npm)", | ||
| "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (1c0d7191f53edcbd6d8459f64259fb12d6390bc73fffef3e045a073875f0f91f)\nThe OpenSSF Package Analysis project identified 'cursor-shadow-workspace' @ 1.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "cursor-shadow-workspace" | ||
| }, | ||
| "versions": [ | ||
| "1.0.2", | ||
| "1.0.3" | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "name": "OpenSSF: Package Analysis", | ||
| "type": "FINDER", | ||
| "contact": [ | ||
| "https://github.com/ossf/package-analysis", | ||
| "https://openssf.slack.com/channels/package_analysis" | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "malicious-packages-origins": [ | ||
| { | ||
| "source": "ossf-package-analysis", | ||
| "sha256": "1c0d7191f53edcbd6d8459f64259fb12d6390bc73fffef3e045a073875f0f91f", | ||
| "import_time": "2025-01-07T15:53:25.399169375Z", | ||
| "modified_time": "2025-01-07T15:36:08Z", | ||
| "versions": [ | ||
| "1.0.2" | ||
| ] | ||
| }, | ||
| { | ||
| "source": "ossf-package-analysis", | ||
| "sha256": "a31b5e92c54e600697bfe041fe85ea104f7de0c4f1f2151542a6980aa48890bd", | ||
| "import_time": "2025-01-07T16:18:30.343177305Z", | ||
| "modified_time": "2025-01-07T16:17:48Z", | ||
| "versions": [ | ||
| "1.0.3" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } |
42 changes: 42 additions & 0 deletions
42
osv/malicious/npm/ecpfs-react-jest-helpers/MAL-2025-25.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| { | ||
| "modified": "2025-01-07T12:05:55Z", | ||
| "published": "2025-01-07T12:05:55Z", | ||
| "schema_version": "1.5.0", | ||
| "id": "MAL-2025-25", | ||
| "summary": "Malicious code in ecpfs-react-jest-helpers (npm)", | ||
| "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (32b1e08557df6041c33ac4eaf0ebb0a3cdbc1bebeeb27b97321516cd0772898a)\nThe OpenSSF Package Analysis project identified 'ecpfs-react-jest-helpers' @ 2.0.1-v1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "ecpfs-react-jest-helpers" | ||
| }, | ||
| "versions": [ | ||
| "2.0.1-v1" | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "name": "OpenSSF: Package Analysis", | ||
| "type": "FINDER", | ||
| "contact": [ | ||
| "https://github.com/ossf/package-analysis", | ||
| "https://openssf.slack.com/channels/package_analysis" | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "malicious-packages-origins": [ | ||
| { | ||
| "import_time": "2025-01-07T12:08:35.785016631Z", | ||
| "modified_time": "2025-01-07T12:05:55Z", | ||
| "sha256": "32b1e08557df6041c33ac4eaf0ebb0a3cdbc1bebeeb27b97321516cd0772898a", | ||
| "source": "ossf-package-analysis", | ||
| "versions": [ | ||
| "2.0.1-v1" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| { | ||
| "modified": "2025-01-07T10:38:35Z", | ||
| "published": "2025-01-07T09:40:14Z", | ||
| "schema_version": "1.5.0", | ||
| "id": "MAL-2025-24", | ||
| "summary": "Malicious code in electron-builder-13 (npm)", | ||
| "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (b87ca459f5fbe7d970a7053fdea799abf8736f04fa8ee97b743587d996bae11c)\nThe OpenSSF Package Analysis project identified 'electron-builder-13' @ 13.4.5 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "electron-builder-13" | ||
| }, | ||
| "versions": [ | ||
| "13.4.5", | ||
| "13.6.5", | ||
| "13.7.5" | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "name": "OpenSSF: Package Analysis", | ||
| "type": "FINDER", | ||
| "contact": [ | ||
| "https://github.com/ossf/package-analysis", | ||
| "https://openssf.slack.com/channels/package_analysis" | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "malicious-packages-origins": [ | ||
| { | ||
| "source": "ossf-package-analysis", | ||
| "sha256": "b87ca459f5fbe7d970a7053fdea799abf8736f04fa8ee97b743587d996bae11c", | ||
| "import_time": "2025-01-07T10:06:12.377786698Z", | ||
| "modified_time": "2025-01-07T09:40:14Z", | ||
| "versions": [ | ||
| "13.4.5" | ||
| ] | ||
| }, | ||
| { | ||
| "source": "ossf-package-analysis", | ||
| "sha256": "645431e0b1ecc29f59ec3f6e140926f2fe46d6e01218e48371d5773eac867d3b", | ||
| "import_time": "2025-01-07T10:38:05.451478588Z", | ||
| "modified_time": "2025-01-07T10:24:45Z", | ||
| "versions": [ | ||
| "13.6.5" | ||
| ] | ||
| }, | ||
| { | ||
| "source": "ossf-package-analysis", | ||
| "sha256": "9f18233f79ecd2fd906456f4f55ddc2250380aa687cd98259d78a84cd89f40f8", | ||
| "import_time": "2025-01-07T10:38:05.505845058Z", | ||
| "modified_time": "2025-01-07T10:27:53Z", | ||
| "versions": [ | ||
| "13.7.5" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| { | ||
| "modified": "2025-01-06T09:42:07Z", | ||
| "published": "2025-01-06T09:42:07Z", | ||
| "schema_version": "1.5.0", | ||
| "id": "MAL-2025-20", | ||
| "summary": "Malicious code in hd-base (npm)", | ||
| "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (f6980bf596e4c3ffe8165b1ba8ef8d26bbadf784e90336c7620dc22131f23e58)\nThe OpenSSF Package Analysis project identified 'hd-base' @ 99.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "hd-base" | ||
| }, | ||
| "versions": [ | ||
| "99.0.2" | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "name": "OpenSSF: Package Analysis", | ||
| "type": "FINDER", | ||
| "contact": [ | ||
| "https://github.com/ossf/package-analysis", | ||
| "https://openssf.slack.com/channels/package_analysis" | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "malicious-packages-origins": [ | ||
| { | ||
| "import_time": "2025-01-06T10:06:17.642423864Z", | ||
| "modified_time": "2025-01-06T09:42:07Z", | ||
| "sha256": "f6980bf596e4c3ffe8165b1ba8ef8d26bbadf784e90336c7620dc22131f23e58", | ||
| "source": "ossf-package-analysis", | ||
| "versions": [ | ||
| "99.0.2" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } |
Oops, something went wrong.