Static Code Analysis
Look up a package coordinate for malware advisories
osv-malicious is a Trickest node that reads JSONL package coordinates from the connected folder and queries the OSV database for known-malicious advisories, emitting rows that name the registry, package, version, and advisory ID for each hit.
Python
overview
What osv-malicious does
OSV Malicious reads JSONL package coordinates from the connected folder and queries OSV for known-malicious advisories.
A Managed-fleet smoke on npm flatmap-stream 0.1.1 included MAL-2025-20690. The sample shows that row.
Each row names the registry, package, version, and the advisory id.
source github.com/trickest/workflows/blob/master/tools/osv-malicious/run.sh
use cases
Where osv-malicious fits
Check one npm coordinate
Write a JSONL line with registry, name, and version, then read the MAL id.
Separate malware from CVEs
Keep this lookup for malicious package ids. Use OSV-Scanner for lockfile vulnerabilities.
Record the advisory id
The signal id in the row is the value to store or alert on.
reference
osv-malicious inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FOLDER | --input | Folder of package coordinate JSONL files. |
Showing key inputs. osv-malicious exposes 1 inputs in total.
example
Run osv-malicious
osv-malicious --input ./packages{"registry": "npm", "name": "flatmap-stream", "version": "0.1.1", "signal_id": "MAL-2025-20690", "category": "malware", "severity": "critical"}guidance
Choosing osv-malicious
Use OSV Malicious for a known-malware lookup on a package coordinate. Use OSV-Scanner to scan a lockfile for vulnerability advisories.
osv-scanner
Scans lockfiles for known vulnerability advisories.
guarddog
Checks the same style of coordinate for malware indicators.
malcontent-scan
Looks for risky behavior on a package coordinate.
faq
osv-malicious questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
guarddog
A package coordinate in, indicator hits out.
malcontent-scan
A package coordinate in, behavior findings out.
osv-scanner
A lockfile in, advisory rows out.
Run osv-malicious yourself
The npm coordinate flatmap-stream 0.1.1 returned MAL-2025-20690.
Facts on this page come from the live Trickest tool library.