OSM Malicious Package Processor — Design

Overview

Fetches malicious package threat intelligence from the OpenSourceMalware.com API (https://api.opensourcemalware.com/functions/v1/query-latest) and creates CVEMetadata rows (source=osm) with minted OSM-YYYY-N identifiers.

Every OSM record is malicious — all threats are tagged as malicious packages (isMaliciousPackage=true) with CWE-506 (Embedded Malicious Code) and CVSS v3.1 scores derived from the severity level. OSM is one of the five advisory-aggregation sources that feed the shared Threat-Actor Attribution engine — and in addition to those aggregators, 16 registry scanners detect malware first-hand; see the dedicated section below.

API

Parsing

ID Generation

Each threat is assigned an OSM-{year}-{seq} identifier. The GCVE form uses Vulnetix’s numeric GCVE Numbering Authority (GNA) id 110:

1. On startup, query MAX(sequenceNumber) from GcveIssuance where gcveId LIKE 'GCVE-110-OSM-{year}-%'
2. For each new threat, increment the sequence counter for the threat’s publication year
3. Store OSM-YYYY-N as CVEMetadata.cveId and GCVE-110-OSM-YYYY-N as GcveIssuance.gcveId
4. Link extracted MAL-IDs and threat UUIDs as GcveAlias records

CVSS Scoring

Supply chain context — malicious package installed via registry:

Storage

Advisory rows

OSM retention tables

The OSM processor retains the full upstream API response and parsed IOCs in two OSM-only tables (camelCase columns, BigInt millisecond timestamps):

The actorAttributionStatus and claimedRepo* columns on OsmThreat carry the result of the attribution pass (see below): claimedRepo* captures a dependency-confusion/typosquat target a package merely declares but is never attributed to as the actor, and actorAttributionStatus records outcomes such as hijack-victim-excluded.

Threat-actor tables (shared)

OSM attribution writes to the generic, cross-source threat-actor tables. Because OSM is an OSV-shaped malware source it uses the OsmThreatActor edge — not MalwareThreatActor (a (cveId, source) is attributed via exactly one of the two; there is no double-write).

Threat-Actor Attribution

After each threat is committed, an inline first-time-only pass resolves the malware author from package/repo identity plus upstream registry, GitHub, and Docker Hub lookups, via the shared internal/actorintel engine. A threat that already carries an OsmThreat attribution row is never re-enriched. The full model, schema, and cross-source backfill are documented in Threat-Actor Attribution; the OSM-relevant points:

Impersonation trap. For non-Go packages, the repository a package declares is frequently the dependency-confusion / typosquat target — a legitimate org’s repo (e.g. microsoft). That repo is captured on OsmThreat as claimedRepo* and is never attributed as the actor.

Key harvesting. When the resolved actor is a GitHub identity, the engine harvests its public SSH-auth, SSH-signing, and GPG keys into ThreatActorKey (OpenSSH SHA256 fingerprint for SSH keys, key id for GPG). A fingerprint reused across multiple accounts links operators behind otherwise distinct identities.

OSM attribution is written through the OsmThreatActor edge only; it never double-writes to MalwareThreatActor.

Incremental Strategy

On startup, load all sourceAdvisoryRef values from CVEMetadata where source='osm' into a map[string]bool. Per threat: if the UUID is in the map, skip. Otherwise process as new.

Schedule

Runs daily at 09:00 UTC (cron(0 9 * * ? *)).

Frequency check: 86400 seconds via BulkDataDumpTracker.

S3 Persistence

• Archive path: osm/files/{sha256}/{filename} ✓
• Quarantine path: failed-feeds/osm-processor/{YYYY-MM-DD}/{reason}/{filename} ✓
• Failure reasons emitted: parse-error, store-error

Uses s3client.Uploader from internal/s3client/uploader.go. Skipped when S3_BUCKET_NAME is unset (local dev).

See the S3 Persistence Contract for the full reason taxonomy.