openssf malicious packages integration #175

kendrickcurtis · 2025-08-11T11:34:40Z

OpenSSF publishes a regularly updated list of 3rd party packages that contain malware. This PR adds a new Trivy rule "Malicious packages detection" at the highest severity level.

The OpenSSF DB is 227mb which is about 1/3rd the size of Trivy's vuln DB (734mb) -- I would hope this would not add a vast extra burden on processing times. Probably we would want/need to run malicious package detection both on commit and in the nightly SCA process, since packages can be retroactively designated as malicious.

Copilot

Pull Request Overview

This PR integrates OpenSSF's malicious packages database into Trivy to detect known malicious packages. This adds a new "Malicious packages detection" rule at the highest severity level to identify packages containing malware, typosquatting attacks, and dependency confusion attacks.

Implements OpenSSF scanner with OSV format parsing for malicious package detection
Adds new malicious_packages rule with critical severity level
Integrates scanning into the main tool execution flow

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
internal/tool/tool.go	Integrates OpenSSF scanner into main execution flow and adds new rule pattern
internal/tool/openssf_scanner.go	Core implementation of OpenSSF malicious packages scanner with OSV parsing
internal/docgen/rule.go	Adds rule definition for malicious packages detection
docs/patterns.json	Adds pattern configuration for malicious packages rule
docs/multiple-tests/pattern-malicious/*	Test files demonstrating malicious package detection
docs/description/*	Documentation files for the new pattern
Dockerfile	Copies OpenSSF cache data into container
.circleci/config.yml	Downloads OpenSSF database during CI build

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

internal/tool/openssf_scanner.go

…s to accelerate scanning.

… package-lock.json also

… reporting in openssf scanner

afsmeira

There are still more fixes and improvements but I think I've left enough comments for a first pass.

We'll move to those fixes after that. And obviously there are still tests to write.

afsmeira · 2025-08-26T10:50:54Z

.codacy/cli.sh

Delete and add a line to .gitignore.

You did not delete the file.

afsmeira · 2025-08-26T10:51:01Z

.codacy/codacy.yaml

Delete and add a line to .gitignore.

You did not delete the file.

docs/description/description.json

docs/multiple-tests/pattern-malicious/src/javascript/package.json

docs/multiple-tests/pattern-vulnerability-high/results.xml

afsmeira · 2025-08-26T13:56:22Z

internal/tool/openssf_scanner.go

+	if s.shouldAnalyzeFile(toolExecution.Files, target) {
+		return []codacy.Result{issue}
+	}


There is already logic to filter out results from files that should not be analyzed in tool.go. We should rely on that for consistency.

Or we want to filter when OSSF scanning, do it way earlier.

afsmeira · 2025-08-26T13:56:58Z

internal/tool/openssf_scanner.go

+func (s *OpenSSFScanner) isPatternEnabled(patterns *[]codacy.Pattern, patternID string) bool {
+	if patterns == nil {
+		return false
+	}
+	for _, pattern := range *patterns {
+		if pattern.ID == patternID {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *OpenSSFScanner) shouldAnalyzeFile(knownFiles *[]string, fileName string) bool {
+	if knownFiles == nil {
+		return true
+	}
+	for _, file := range *knownFiles {
+		if file == fileName {
+			return true
+		}
+	}
+	return false
+}


Given my suggestion above you can delete these.

afsmeira · 2025-08-26T14:00:13Z

internal/tool/openssf_scanner.go

+}
+
+func (s *OpenSSFScanner) findPackageLineNumber(sourceDir, fileName, pkgName string) int {
+	return fallbackSearchForLineNumber(sourceDir, fileName, pkgName)


This simply uses the fallback. Please use the same logic in tool.go get the line number.

afsmeira · 2025-08-26T14:04:40Z

internal/tool/openssf_scanner.go

+	for _, affectedVersion := range affectedVersions {
+		if version == affectedVersion {
+			return true
+		}
+	}


Suggested change

for _, affectedVersion := range affectedVersions {

if version == affectedVersion {

return true

}

}

if slices.Contains(affectedVersions, version) {

return true

}

afsmeira · 2025-08-26T14:05:16Z

internal/tool/openssf_scanner.go

+		if versionRange.Type == "SEMVER" || versionRange.Type == "ECOSYSTEM" {
+			if s.checkSingleVersionRange(version, versionRange.Events) {


Suggested change

if versionRange.Type == "SEMVER" || versionRange.Type == "ECOSYSTEM" {

if s.checkSingleVersionRange(version, versionRange.Events) {

if (versionRange.Type == "SEMVER" || versionRange.Type == "ECOSYSTEM") && s.checkSingleVersionRange(version, versionRange.Events) {

afsmeira

There are still comments to address. And unit tests to add.

afsmeira · 2025-10-09T10:27:57Z

docs/multiple-tests/pattern-malicious/src/javascript/package-lock.json

+
+
+
+


Nitpick: delete empty lines.

afsmeira · 2025-10-09T10:37:48Z

.codacy/cli.sh

You did not delete the file.

afsmeira · 2025-10-09T10:38:03Z

.codacy/codacy.yaml

You did not delete the file.

afsmeira · 2025-10-09T10:40:42Z

docs/patterns.json

You did not delete the file.

afsmeira · 2025-10-09T10:54:49Z

scripts/build_openssf_index.py

+BASE = os.environ.get('OPENSSF_OSV_DIR', 'openssf-cache/osv')
+OUT = os.environ.get('OPENSSF_INDEX_OUT', 'openssf-index.json.gz')


Since the environment variables are not used right now, I would remove them and just use the hardcoded values.

afsmeira · 2025-10-09T10:56:14Z

Dockerfile

+# Generate the OpenSSF index during build
+COPY scripts/ scripts/
+COPY openssf-cache/osv/ openssf-cache/osv/
+RUN apk add --no-cache python3 && \


Actually, I was thinking that we should probably run this in the CI and just copy the resulting file to the image.

This avoids adding python3 to the image and I'm pretty sure our CI already has python available.

afsmeira · 2025-10-09T11:06:15Z

scripts/build_openssf_index.py

+with gzip.open(OUT, 'wt', encoding='utf-8') as gz:
+    json.dump(index, gz)
+
+print(f"Wrote index: {OUT} (ecosystems={len(index)})")


I'm not sure if print adds a new line, but if it doesn't please add one manually.

afsmeira · 2025-10-09T11:13:18Z

internal/tool/tool.go

+	if toolExecution.Files == nil {
+		return mapIssuesWithoutLineNumber(issues), nil
+	}


Was this generated by AI? Do you actually know if this description is true?

afsmeira · 2025-10-09T13:09:00Z

internal/tool/openssf_scanner.go

+	if err := s.ensureIndexLoaded(); err != nil {
+		log.Printf("Warning: Failed to load OpenSSF malicious packages database: %v", err)
+		return results
+	}


If this pattern is selected but we can't load the file, the should fail instead of returning empty results.

openssf malicious packages integration

d4fefc0

kendrickcurtis requested a review from a team as a code owner August 11, 2025 11:34

kendrickcurtis added 2 commits August 11, 2025 15:31

merged master in

e2dd8a2

updated test to match new live CVE

c4fda7f

alerizzo requested a review from Copilot August 13, 2025 14:09

Copilot AI reviewed Aug 13, 2025

View reviewed changes

kendrickcurtis and others added 15 commits August 13, 2025 18:20

revised malicious package detection to prebuild an index nightly so a…

f2d93e8

…s to accelerate scanning.

fixed build - tool wasn't scanning for package.json -- added test for…

380c908

… package-lock.json also

merged main, added Dockerfile

983ab2d

Merge branch 'master' into kpc-malware-scanner

60251de

resolved codacy warnings

47a579d

codacy cli version bumps

3558295

fixed codacy cyclo issue

5f67c48

fixed AI nonsense

0a7563b

fixed CICD -- necessary file wasn't being copied

67618e9

fixed another CICD issue

35932d7

bugfix in tool.go to live with nil PURLs and fixed absent line number…

2a1f702

… reporting in openssf scanner

stopped copying unnecessary files

fb07336

fixed test data

cf6da27

test fixes

4998520

still fixing test data

eaeb811

afsmeira reviewed Aug 26, 2025

View reviewed changes

kendrickcurtis added 5 commits September 9, 2025 14:10

ignored codacy config

072879b

review comments tackled

92d088e

fixed stupid ai shit - npm ref in gradle file

5ec4193

merged main

ace20b1

fixed missing vuln

dab0d58

afsmeira reviewed Oct 9, 2025

View reviewed changes

		if versionRange.Type == "SEMVER" \|\| versionRange.Type == "ECOSYSTEM" {
		if s.checkSingleVersionRange(version, versionRange.Events) {

	if versionRange.Type == "SEMVER" \|\| versionRange.Type == "ECOSYSTEM" {
	if s.checkSingleVersionRange(version, versionRange.Events) {
	if (versionRange.Type == "SEMVER" \|\| versionRange.Type == "ECOSYSTEM") && s.checkSingleVersionRange(version, versionRange.Events) {

		BASE = os.environ.get('OPENSSF_OSV_DIR', 'openssf-cache/osv')
		OUT = os.environ.get('OPENSSF_INDEX_OUT', 'openssf-index.json.gz')

openssf malicious packages integration #175

Are you sure you want to change the base?

openssf malicious packages integration #175

Uh oh!

Conversation

kendrickcurtis commented Aug 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

afsmeira left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

afsmeira left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

afsmeira Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

afsmeira left a comment •

edited

Loading

afsmeira Oct 9, 2025 •

edited

Loading