feat(osv): mark malicious packages with skipReasons

[jamietanna]

Changes

As part of current ongoing supply chain attacks, there have been cases
where Renovate updates packages to a malicious version.

We'll be introducing a more in-depth means to surface these, including
from different API sources, as part of the Enrichment functionality,
but in the short-term we can utilise osv.dev's ingestion of OpenSSF's
Malicious Packages data.

To do this, we need to:

• look for any MAL- advisories
• match it against the current dependency's version, and if affected, mark it
  as skipReason: malicious-version-in-use (which will be unset in
  the lookup() function, so we still perform updates
• match it against the dependency's available updates, and if any are
  affected, mark the dependency
  as skipReason: malicious-update-proposed

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository: https://github.com/JamieTanna-Mend-testing/react-dom-VULNERABLE-CODE-DO-NOT-USE

DEBUG: fetchVulnerabilities() - osvVulnerabilityAlerts=true (repository=local)
(node:71346) MetadataLookupWarning: received unexpected error = All promises were rejected code = UNKNOWN
    at Object.isAvailable (/Users/jamietanna/workspaces/renovatebot/renovate/node_modules/.pnpm/gcp-metadata@8.1.2/node_modules/gcp-metadata/src/index.ts:402:17)
    at processTicksAndRejections (node:internal/process/task_queues:104:5)
    at runNextTicks (node:internal/process/task_queues:69:3)
    at listOnTimeout (node:internal/timers:567:9)
    at processTimers (node:internal/timers:541:7)
    at detect (/Users/jamietanna/workspaces/renovatebot/renovate/node_modules/.pnpm/@opentelemetry+resource-detector-gcp@0.49.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resource-detector-gcp/src/detectors/GcpDetector.ts:78:9)
    at GcpDetector._asyncAttributes (/Users/jamietanna/workspaces/renovatebot/renovate/node_modules/.pnpm/@opentelemetry+resource-detector-gcp@0.49.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resource-detector-gcp/src/detectors/GcpDetector.ts:212:22)
DEBUG: Marking axios as skipReason=malicious-version-in-use, as it is affected by MAL-2026-2307 (repository=local, packageFile=package.json)
       "depName": "axios",
       "packageName": undefined,
       "manager": "npm",
       "datasource": "npm",
       "currentVersion": "1.14.1"
DEBUG: Vulnerability MAL-2026-2307 affects axios 1.14.1 (repository=local)
DEBUG: No fixed version available for vulnerability MAL-2026-2307 in axios 1.14.1 (repository=local)
...
DEBUG: config.repoIsOnboarded=true (repository=local)
 WARN: Dependency axios is currently using a malicious version (repository=local, packageFile=package.json)
       "depName": "axios",
       "packageName": "axios",
       "manager": "npm",
       "datasource": "npm"
DEBUG: packageFiles with updates (repository=local)
       "config": {
         "npm": [
           {
             "deps": [
               {
                 "depType": "devDependencies",
                 "depName": "axios",
                 "currentValue": "1.14.1",
                 "datasource": "npm",
                 "prettyDepType": "devDependency",
                 "lockedVersion": "1.14.1",
                 "updates": [],
                 "packageName": "axios"
               }
             ],
             "extractedConstraints": {},
             "packageFileVersion": "17.0.2-fix.0",
             "managerData": {
               "packageJsonName": "@esm-bundle/react-dom",
               "hasPackageManager": false,
               "pnpmShrinkwrap": "pnpm-lock.yaml",
               "yarnZeroInstall": false,
               "npmrcFileName": null
             },
             "skipInstalls": true,
             "packageFile": "package.json",
             "lockFiles": ["pnpm-lock.yaml"]
           }
         ]
       }

[viceice]

otherwise lgtm

[Shegox]

As we had a (rather) targeted attack over the last weekend via dependency confusion on some of our internal packages I wanted to test that and noticed that while it correctly detected the malicious version correcty, it still proposed the update:

DEBUG: Marking @sap-px/pxapi's update to 99.9.1 as skipReason=malicious-update-proposed, as it is affected by MAL-2026-2545 (repository=gh-testing/osta-core-ui-local, packageFile=package.json)
       "depName": "@sap-px/pxapi",
       "packageName": "@sap-px/pxapi",
       "manager": "npm",
       "datasource": "npm",
       "currentVersion": "3.5.3",
       "newVersion": "99.9.1"
....
          {
           "branchName": "renovate/sap-px-pxapi-99.x",
           "prNo": 4,
           "prTitle": "fix(deps): update dependency @sap-px/pxapi to v99",
           "result": "pr-created",
           "upgrades": [
             {
               "datasource": "npm",
               "depName": "@sap-px/pxapi",
               "displayPending": "",
               "fixedVersion": "3.5.3",
               "currentVersion": "3.5.3",
               "currentValue": "^3.3.0",
               "newValue": "^99.0.0",
               "newVersion": "99.9.1",
               "packageFile": "package.json",
               "updateType": "major",
               "packageName": "@sap-px/pxapi"
             }
           ]
         },      
       

I'm not sure/clear if this PR already intends to block the proposal of malicious packages, or just the flagging if a malicious version is used?

---

Edit: I tested a few things and it seems that currently first it is checked if it malicious via

renovate/lib/workers/repository/process/extract-update.ts

Lines 249 to 293 in a945d8b

	export function reportMaliciousSkippedDependencies(
	allPackageFiles: Record<string, PackageFile<Record<string, any>>[]>,
	): void {
	if (allPackageFiles === undefined) {
	return;
	}
	for (const [manager, packageFiles] of Object.entries(allPackageFiles)) {
	for (const packageFile of packageFiles) {
	for (const dep of packageFile.deps) {
	if (dep.skipReason === 'malicious-version-in-use') {
	logger.warn(
	{
	packageFile: packageFile.packageFile,
	depName: dep.depName,
	packageName: dep.packageName,
	manager: manager,
	datasource: dep.datasource,
	},
	`Dependency ${dep.depName} is currently using a malicious version`,
	);
	// and make sure that it then gets updates proposed in the update phase
	delete dep.skipReason;
	delete dep.skipStage;
	} else if (dep.skipReason === 'malicious-update-proposed') {
	const newVersions = dep.updates
	?.map((u) => u.newVersion ?? u.newValue)
	.filter(isNotNullOrUndefined);
	logger.warn(
	{
	packageFile: packageFile.packageFile,
	depName: dep.depName,
	packageName: dep.packageName,
	manager: manager,
	datasource: dep.datasource,
	newVersions,
	},
	`Dependency ${dep.depName} has update(s) proposed which would update you to a malicious version - skipping`,
	);
	}
	}
	}
	}
	}

and then only the data is enriched with the malicious information. I think the intention would be to first enrich the extracted/looked up data and then check if there are any malicious updates?

[jamietanna]

Interesting, thanks! Will take a look, we shouldn't be proposing that update 🤔

(If you're able to share more info on Slack, that'd be appreciated)

[jamietanna]

Confirmed that this doesn't block updates - #42595 will be needed first, and then I've got some other changes I'm preparing locally

[jamietanna]

I'm not really sure I like this suggestion from Opus - but what are your thoughts?

As @shegox flags, we've got an ordering problem:

1. Fetch vulnerabilities
   • As updates need vulnerability alerts
2. Fetch updates
   • as malicious packages need updates
3. Flag malicious packages

[Shegox]

I think a good place to perform the malicious check would be within the "postprocess-release.ts". There is as well datasource specific postprocessing called which could block/reject releases if theys are yanked or so.

So blocking releases there for being malicious might be reasonable as well

[jamietanna]

If you've not seen, we've got #40048 coming, which will be a more generic means for blocking/skipping/annotating updates - for OSV alerts in particular, this is where we'll be moving to

But agreed that having Datasource specific handling for i.e. yanked packages makes sense!

[Shegox]

I tested another approach and this seems to be working. Rather than just using skip reasons, we acutally just remove the update from the list using a filter.

diff --git a/lib/workers/repository/process/extract-update.ts b/lib/workers/repository/process/extract-update.ts
index 1203acb903..e839d7044a 100644
--- a/lib/workers/repository/process/extract-update.ts
+++ b/lib/workers/repository/process/extract-update.ts
@@ -231,6 +231,8 @@ export async function lookup(
 ): Promise<ExtractResult> {
   await fetchVulnerabilities(config, packageFiles);
   await fetchUpdates(config, packageFiles);
+  await fetchVulnerabilities(config, packageFiles);
+  
   memCache.cleanDatasourceKeys();
   calculateLibYears(config, packageFiles);
   const { branches, branchList } = await branchifyUpgrades(
diff --git a/lib/workers/repository/process/vulnerabilities.ts b/lib/workers/repository/process/vulnerabilities.ts
index ec153b0ddf..0e0f9afb16 100644
--- a/lib/workers/repository/process/vulnerabilities.ts
+++ b/lib/workers/repository/process/vulnerabilities.ts
@@ -312,7 +312,7 @@ export class Vulnerabilities {
         }
 
         // or are any of the updates vulnerable?
-        for (const update of dep.updates ?? []) {
+        dep.updates = (dep.updates ?? []).filter(update => {
           const newVersion = update.newVersion ?? update.newValue!;
 
           const isUpdateVulnerable = this.isPackageVulnerable(
@@ -338,8 +338,10 @@ export class Vulnerabilities {
             );
             dep.skipReason = 'malicious-update-proposed';
             dep.skipStage = 'lookup';
+            return false;
           }
-        }
+          return true;
+        });
       }
     }
   }