Ingest OSV - Cloud Storage

config/start-keys.yaml

@@ -1,5 +1,5 @@
 ossf-package-analysis:
-    confident/: confident/20241122/231554-npm-security-alert-watcher-0.0.1.json
+    confident/: confident/20241123/002536-npm-ens-app-v2-6.0.1.json
 reversing-labs:
     RLMA-: RLMA-2024-09529.json
     RLUA-: RLUA-2024-10363.json

osv/malicious/npm/@framgia/test/MAL-0000-ossf-package-analysis-70cddd12622aea2b.json

@@ -0,0 +1,42 @@
+{
+  "modified": "2024-11-23T01:57:27Z",
+  "published": "2024-11-23T01:57:27Z",
+  "schema_version": "1.5.0",
+  "id": "",
+  "summary": "Malicious code in @framgia/test (npm)",
+  "details": "The OpenSSF Package Analysis project identified '@framgia/test' @ 9.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@framgia/test"
+      },
+      "versions": [
+        "9.0.1"
+      ]
+    }
+  ],
+  "credits": [
+    {
+      "name": "OpenSSF: Package Analysis",
+      "type": "FINDER",
+      "contact": [
+        "https://github.com/ossf/package-analysis",
+        "https://openssf.slack.com/channels/package_analysis"
+      ]
+    }
+  ],
+  "database_specific": {
+    "malicious-packages-origins": [
+      {
+        "source": "ossf-package-analysis",
+        "sha256": "70cddd12622aea2b5c57f80ba61117d1a219928606b160c970c27d94a83b0ce3",
+        "import_time": "2024-11-23T02:29:26.541110883Z",
+        "modified_time": "2024-11-23T01:57:27Z",
+        "versions": [
+          "9.0.1"
+        ]
+      }
+    ]
+  }
+}

osv/malicious/npm/graph-studio-billing-contracts/MAL-0000-ossf-package-analysis-0cb3663cb890c51c.json

@@ -0,0 +1,42 @@
+{
+  "modified": "2024-11-23T01:54:55Z",
+  "published": "2024-11-23T01:54:55Z",
+  "schema_version": "1.5.0",
+  "id": "",
+  "summary": "Malicious code in graph-studio-billing-contracts (npm)",
+  "details": "The OpenSSF Package Analysis project identified 'graph-studio-billing-contracts' @ 0.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "graph-studio-billing-contracts"
+      },
+      "versions": [
+        "0.0.1"
+      ]
+    }
+  ],
+  "credits": [
+    {
+      "name": "OpenSSF: Package Analysis",
+      "type": "FINDER",
+      "contact": [
+        "https://github.com/ossf/package-analysis",
+        "https://openssf.slack.com/channels/package_analysis"
+      ]
+    }
+  ],
+  "database_specific": {
+    "malicious-packages-origins": [
+      {
+        "source": "ossf-package-analysis",
+        "sha256": "0cb3663cb890c51c325b0a2ec9752cb3adf11842fd52d1e99eb2f3182c7336b0",
+        "import_time": "2024-11-23T02:29:26.459578117Z",
+        "modified_time": "2024-11-23T01:54:55Z",
+        "versions": [
+          "0.0.1"
+        ]
+      }
+    ]
+  }
+}