Skip to content

Add malicious package entries #929

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 100 commits into from
Jun 18, 2025
Merged

Add malicious package entries #929

merged 100 commits into from
Jun 18, 2025

Conversation

awsactran
Copy link
Contributor

This PR aggregates OSV entries for newly discovered malicious NPM packages.

awsactran added 30 commits June 10, 2025 10:43
@awsactran
Add malicious package entry: hello-gator
355c940 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: truth-loop-server
09fe53d 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: lichess-db
0958a85 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: error-ux-components
aa121ad 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: izat
c294d12 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: mtrtestinglalalal
6f60d4e 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: sendgrid-bloodhound
cdf5cff 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: @dm3-org/dm3-lib-crypto
5e59aa0 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: ccip-resolver
ead658f 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: uniswap-v4-scratchpad-poc
917f5fd 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: cmp-spid-login
b4bdae6 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: zora-utils-core
e3c03f4 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: 0vulns-dependency-confusion-poc
7189985 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: cycle-a
29c8e10 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: asf-core
b6f2cd9 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: dep_test_for_mal
47eed4a 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: @jito-lab/provider
7cf6bc8 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: @biovia/amd-loader
7b3e485 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: express-ottot0
d03268e 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: edumendesz1
71f0285 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: cim-validation-form
b04b30b 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: bottyclient
a2fc5fa 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: console-color-nodejs
c5643be 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: cosmy-wasmy
d29cbb8 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: mypocmaliciouspackage-cursorpt1
2e75f72 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: krosten2345
fecc88b 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: mi-permission
5651225 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: michael0x44hackone
89e55ec 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: sitewidesearch-client
36dc375 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: recoil-handler
12768c5 
Signed-off-by: Chi Tran <actran@amazon.com>
awsactran added 8 commits June 15, 2025 15:01
@awsactran
Add malicious package entry: buck2_explain
eb7bde0 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: composer-bin-plugin
acc1ae2 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: raise-http-server
2eb87bc 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: vscode-spring-initializr
f989af3 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: calculator-sse
9866af4 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: azure-pipeline-filter
0d9942f 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: kenzup-react-native-rsa-native
009cf34 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: pxsceneui-example-02
60352c1 
Signed-off-by: Chi Tran <actran@amazon.com>
calebbrown
calebbrown requested changes Jun 17, 2025
View reviewed changes
@awsactran
Remove benign npm packages
0a01c81 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Copy link
Contributor Author

@calebbrown all called-out benign packages are now removed. Requesting another review

@awsactran awsactran requested a review from calebbrown June 17, 2025 15:00
awsactran and others added 15 commits June 17, 2025 10:01
@awsactran
Add malicious package entry: cascading-picklists-extenstion
2d6df3e 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: odyssee_teams_api
f323710 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: vscode-azurestaticwebapps
545df75 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: @ftapi/secuauth
7be90ad 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: @ftapi/components
d820fe9 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: vscode-websearchforcopilot
1c2e35a 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: vscode-azurecontainerapps
4bb5262 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: reoregistration
6d377df 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: remitly-icon-font
f9dba79 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: mafid-dev-fe
0afb7b0 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: @openapi-platform/git-util
9db7a10 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Add malicious package entry: vas_extension
5f56d5a 
Signed-off-by: Chi Tran <actran@amazon.com>
@awsactran
Merge branch 'main' into add-malicious-entries
78a6911
@awsactran
Add malicious package entry: voicebuilder_ui
6e74c91 
Signed-off-by: Chi Tran <actran@amazon.com>
@calebbrown
Merge branch 'main' into add-malicious-entries
0e9f764
@calebbrown calebbrown merged commit ca49bdb into ossf:main Jun 18, 2025
9 checks passed
@awsactran awsactran deleted the add-malicious-entries branch June 18, 2025 01:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@calebbrown calebbrown calebbrown approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@awsactran @calebbrown