From c925ae0aed6848e6ae837832ea9532f17ce8259a Mon Sep 17 00:00:00 2001 From: Omkar Phansopkar Date: Fri, 28 Mar 2025 19:17:18 +0530 Subject: [PATCH 1/2] Report ok-script pypi package Signed-off-by: Omkar Phansopkar --- .../pypi/ok-script/MAL-0000-okscript.json | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 osv/malicious/pypi/ok-script/MAL-0000-okscript.json diff --git a/osv/malicious/pypi/ok-script/MAL-0000-okscript.json b/osv/malicious/pypi/ok-script/MAL-0000-okscript.json new file mode 100644 index 00000000000..91f4e7188bb --- /dev/null +++ b/osv/malicious/pypi/ok-script/MAL-0000-okscript.json @@ -0,0 +1,34 @@ +{ + "modified": "2025-03-28T14:19:12.788Z", + "published": "2025-03-28T14:19:12.788Z", + "schema_version": "1.5.0", + "summary": "Malicious code in ok-script package (pypi)", + "details": "This package ok-script contains obfuscated code, dangerous auto-update mechanism running downloaded code as new processes and empty source code without any relation to the packaged binaries", + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ok-script" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ] + } + ], + "credits": [ + { + "name": "Safedep", + "type": "FINDER", + "contact": [ + "https://safedep.io/" + ] + } + ] +} \ No newline at end of file From 5c7e8192e67a600bc6e08afeb0093c7bf54d3cfb Mon Sep 17 00:00:00 2001 From: Omkar Phansopkar Date: Fri, 28 Mar 2025 19:42:48 +0530 Subject: [PATCH 2/2] Fix ranges type Signed-off-by: Omkar Phansopkar --- .../pypi/ok-script/MAL-0000-okscript.json | 41 +++++++++---------- 1 file changed, 20 insertions(+), 21 deletions(-) diff --git a/osv/malicious/pypi/ok-script/MAL-0000-okscript.json b/osv/malicious/pypi/ok-script/MAL-0000-okscript.json index 91f4e7188bb..71bf41c79b2 100644 --- a/osv/malicious/pypi/ok-script/MAL-0000-okscript.json +++ b/osv/malicious/pypi/ok-script/MAL-0000-okscript.json @@ -5,30 +5,29 @@ "summary": "Malicious code in ok-script package (pypi)", "details": "This package ok-script contains obfuscated code, dangerous auto-update mechanism running downloaded code as new processes and empty source code without any relation to the packaged binaries", "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "ok-script" - }, - "ranges": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ok-script", + "purl": "pkg:pypi/ok-script" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ { - "type": "SEMVER", - "events": [ - { - "introduced": "0" - } - ] + "introduced": "0" } ] - } + } + ] + } ], "credits": [ - { - "name": "Safedep", - "type": "FINDER", - "contact": [ - "https://safedep.io/" - ] - } + { + "name": "Safedep", + "type": "FINDER", + "contact": ["https://safedep.io/"] + } ] -} \ No newline at end of file +}