Ingest OSV - Cloud Storage

Author: github-actions

config/start-keys.yaml

@@ -5,7 +5,7 @@ kam193:
     pypi/packages/pentest/osv/: 27cbe31837ebfb9ccc169b6c60ebc77b8545845e
     pypi/packages/probably_pentest/osv/: 6e2e28ddfbf31587ff2703390cb0540befe42677
 ossf-package-analysis:
-    confident/: confident/20251208/130627-npm-volume-viz-5.5.5.json
+    confident/: confident/20251208/130628-npm-sd-notexsit-999.0.41.json
 reversing-labs:
     RLMA-: RLMA-2025-05986.json
     RLUA-: RLUA-2025-05995.json

osv/malicious/pypi/sketchfab-spinner/MAL-0000-ossf-package-analysis-a5f1a58740e3b28c.json

@@ -0,0 +1,42 @@
+{
+  "modified": "2025-12-09T04:01:32Z",
+  "published": "2025-12-09T04:01:32Z",
+  "schema_version": "1.7.4",
+  "id": "",
+  "summary": "Malicious code in sketchfab-spinner (PyPI)",
+  "details": "The OpenSSF Package Analysis project identified 'sketchfab-spinner' @ 99.9.10 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "sketchfab-spinner"
+      },
+      "versions": [
+        "99.9.10"
+      ]
+    }
+  ],
+  "credits": [
+    {
+      "name": "OpenSSF: Package Analysis",
+      "type": "FINDER",
+      "contact": [
+        "https://github.com/ossf/package-analysis",
+        "https://openssf.slack.com/channels/package_analysis"
+      ]
+    }
+  ],
+  "database_specific": {
+    "malicious-packages-origins": [
+      {
+        "source": "ossf-package-analysis",
+        "sha256": "a5f1a58740e3b28c503561dafa4697816bdb7eaa5aa04498d325e79f38ccaedc",
+        "import_time": "2025-12-09T04:12:37.295157172Z",
+        "modified_time": "2025-12-09T04:01:32Z",
+        "versions": [
+          "99.9.10"
+        ]
+      }
+    ]
+  }
+}