Skip to content

feat: Malicious Packages (OSV) Reporter for Inspect Command #518

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 4 commits into from
Jun 24, 2025
Merged

feat: Malicious Packages (OSV) Reporter for Inspect Command #518

merged 4 commits into from
Jun 24, 2025

Conversation

abhisek
Copy link
Member

@abhisek abhisek commented Jun 16, 2025 •
edited by KunalSin9h
Loading

Example usage:

./vet inspect malware --purl pkg:/npm/x@y \
--report-osv ~/Work/dev/oss/malicious-packages/

The path for --report-osv should be the root of cloned https://github.com/ossf/malicious-packages

@abhisek abhisek requested a review from a team June 16, 2025 09:58
@abhisek abhisek changed the title feat/malware inspect osv reporter feat: Malicious Packages (OSV) Reporter for Inspect Command Jun 16, 2025
@github-actions GitHub Actions
Copy link

vet Summary Report

This report is generated by vet

Policy Checks

  • ✅ Vulnerability
  • ✅ Malware
  • ✅ License
  • ✅ Popularity
  • ✅ Maintenance
  • ✅ Security Posture
  • ✅ Threats

Malicious Package Analysis

Malicious package analysis was performed using SafeDep Cloud API

Malicious Package Analysis Report
Ecosystem Package Version Status Report
ECOSYSTEM_GO github.com/ossf/osv-schema/bindings/go 0.0.0-20250210065807-ab8a4f6e6389 ✅ 🔗
  • ℹ️ 1 packages have been actively analyzed for malicious behaviour.
  • ✅ No malicious packages found.
Changed Packages

Changed Packages

  • ✅ [Go] github.com/ossf/osv-schema/bindings/go@0.0.0-20250210065807-ab8a4f6e6389

@codecov Codecov
Copy link

codecov bot commented Jun 16, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 60.11561% with 69 lines in your changes missing coverage. Please review.

Project coverage is 17.89%. Comparing base (4f989c5) to head (e7e75d6).
Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
cmd/inspect/malware.go 0.00% 43 Missing ⚠️
pkg/malysis/ossf.go 80.00% 18 Missing and 8 partials ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main     #518      +/-   ##
==========================================
+ Coverage   17.43%   17.89%   +0.45%     
==========================================
  Files         176      177       +1     
  Lines       16821    16987     +166     
==========================================
+ Hits         2933     3039     +106     
- Misses      13663    13715      +52     
- Partials      225      233       +8

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@abhisek
Copy link
Member Author

abhisek commented Jun 24, 2025

@OmkarPh Looks like the dependency usage evidence related E2E are failing. Can you have a look and see how we can avoid the flakiness of the tests?

https://github.com/safedep/vet/actions/runs/15844105054/job/44662226198?pr=518#step:5:383

@abhisek abhisek requested a review from OmkarPh June 24, 2025 09:09
@abhisek abhisek enabled auto-merge (squash) June 24, 2025 09:09
@abhisek abhisek merged commit 78e2bad into main Jun 24, 2025
11 checks passed
@abhisek abhisek deleted the feat/malware-inspect-osv-reporter branch June 24, 2025 09:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@OmkarPh OmkarPh Awaiting requested review from OmkarPh

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@abhisek @OmkarPh @KunalSin9h