Ingest OSV - Cloud Storage

config/start-keys.yaml

@@ -1,5 +1,5 @@
 ossf-package-analysis:
-    confident/: confident/20241220/114211-npm-bs-auto-dark-mode-1.0.2.json
+    confident/: confident/20241220/125611-npm-mindmeld-ui-1.0.0.json
 reversing-labs:
     RLMA-: RLMA-2024-11212.json
     RLUA-: RLUA-2024-11114.json

osv/malicious/npm/@rrvis/code-mapper/MAL-0000-ossf-package-analysis-19a43a84b4d9f910.json

@@ -0,0 +1,42 @@
+{
+  "modified": "2024-12-20T16:08:33Z",
+  "published": "2024-12-20T16:08:33Z",
+  "schema_version": "1.5.0",
+  "id": "",
+  "summary": "Malicious code in @rrvis/code-mapper (npm)",
+  "details": "The OpenSSF Package Analysis project identified '@rrvis/code-mapper' @ 99.99.3 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@rrvis/code-mapper"
+      },
+      "versions": [
+        "99.99.3"
+      ]
+    }
+  ],
+  "credits": [
+    {
+      "name": "OpenSSF: Package Analysis",
+      "type": "FINDER",
+      "contact": [
+        "https://github.com/ossf/package-analysis",
+        "https://openssf.slack.com/channels/package_analysis"
+      ]
+    }
+  ],
+  "database_specific": {
+    "malicious-packages-origins": [
+      {
+        "source": "ossf-package-analysis",
+        "sha256": "19a43a84b4d9f910d4a656a44cae41f44115366eb59777c6b6be77fd66de9fc8",
+        "import_time": "2024-12-20T16:37:49.699070841Z",
+        "modified_time": "2024-12-20T16:08:33Z",
+        "versions": [
+          "99.99.3"
+        ]
+      }
+    ]
+  }
+}

osv/malicious/npm/blz-internal-pkg_update/MAL-0000-ossf-package-analysis-22b7ba0d1c3b8e5b.json

@@ -0,0 +1,42 @@
+{
+  "modified": "2024-12-20T16:31:03Z",
+  "published": "2024-12-20T16:31:03Z",
+  "schema_version": "1.5.0",
+  "id": "",
+  "summary": "Malicious code in blz-internal-pkg_update (npm)",
+  "details": "The OpenSSF Package Analysis project identified 'blz-internal-pkg_update' @ 7.7.14 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "blz-internal-pkg_update"
+      },
+      "versions": [
+        "7.7.14"
+      ]
+    }
+  ],
+  "credits": [
+    {
+      "name": "OpenSSF: Package Analysis",
+      "type": "FINDER",
+      "contact": [
+        "https://github.com/ossf/package-analysis",
+        "https://openssf.slack.com/channels/package_analysis"
+      ]
+    }
+  ],
+  "database_specific": {
+    "malicious-packages-origins": [
+      {
+        "source": "ossf-package-analysis",
+        "sha256": "22b7ba0d1c3b8e5b5dd1164d61508d7d0bf9932f8fd52521ac672c50cb822bdd",
+        "import_time": "2024-12-20T16:37:49.789561661Z",
+        "modified_time": "2024-12-20T16:31:03Z",
+        "versions": [
+          "7.7.14"
+        ]
+      }
+    ]
+  }
+}