Ingest OSV - Cloud Storage

config/start-keys.yaml

@@ -1,5 +1,5 @@
 ossf-package-analysis:
-    confident/: confident/20241123/120636-npm-web_enhance_sap-latest-6.5.9.json
+    confident/: confident/20241123/120638-npm-webpack-support-multi-domain-plugin-8.4.10.json
 reversing-labs:
     RLMA-: RLMA-2024-09529.json
     RLUA-: RLUA-2024-10363.json

osv/malicious/npm/nylas-private-fonts/MAL-0000-ossf-package-analysis-8ab4014737a8b849.json

@@ -0,0 +1,42 @@
+{
+  "modified": "2024-11-24T18:37:11Z",
+  "published": "2024-11-24T18:37:11Z",
+  "schema_version": "1.5.0",
+  "id": "",
+  "summary": "Malicious code in nylas-private-fonts (npm)",
+  "details": "The OpenSSF Package Analysis project identified 'nylas-private-fonts' @ 1.1.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "nylas-private-fonts"
+      },
+      "versions": [
+        "1.1.0"
+      ]
+    }
+  ],
+  "credits": [
+    {
+      "name": "OpenSSF: Package Analysis",
+      "type": "FINDER",
+      "contact": [
+        "https://github.com/ossf/package-analysis",
+        "https://openssf.slack.com/channels/package_analysis"
+      ]
+    }
+  ],
+  "database_specific": {
+    "malicious-packages-origins": [
+      {
+        "source": "ossf-package-analysis",
+        "sha256": "8ab4014737a8b84952db6c28c07ced451b5823e701e1da40c22d913fe9236c7c",
+        "import_time": "2024-11-24T18:37:47.049977755Z",
+        "modified_time": "2024-11-24T18:37:11Z",
+        "versions": [
+          "1.1.0"
+        ]
+      }
+    ]
+  }
+}

osv/malicious/npm/nylas-private-sounds/MAL-0000-ossf-package-analysis-69d6d5dde68997e3.json

@@ -0,0 +1,42 @@
+{
+  "modified": "2024-11-24T18:30:53Z",
+  "published": "2024-11-24T18:30:53Z",
+  "schema_version": "1.5.0",
+  "id": "",
+  "summary": "Malicious code in nylas-private-sounds (npm)",
+  "details": "The OpenSSF Package Analysis project identified 'nylas-private-sounds' @ 1.1.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "nylas-private-sounds"
+      },
+      "versions": [
+        "1.1.0"
+      ]
+    }
+  ],
+  "credits": [
+    {
+      "name": "OpenSSF: Package Analysis",
+      "type": "FINDER",
+      "contact": [
+        "https://github.com/ossf/package-analysis",
+        "https://openssf.slack.com/channels/package_analysis"
+      ]
+    }
+  ],
+  "database_specific": {
+    "malicious-packages-origins": [
+      {
+        "source": "ossf-package-analysis",
+        "sha256": "69d6d5dde68997e3a393799153358d0d974380ca42fdea4b330f6c26b40c4892",
+        "import_time": "2024-11-24T18:37:46.936852746Z",
+        "modified_time": "2024-11-24T18:30:53Z",
+        "versions": [
+          "1.1.0"
+        ]
+      }
+    ]
+  }
+}