Threat Intelligence Exposure Catalogs

Maintained exposure catalogs for recent supply-chain campaigns, built from public threat-intelligence reporting with Perplexity Computer and updated via PRs as fresh campaigns are reported.

Pass a catalog to a scan with --exposure-catalog <path>. Review the entries against current advisories before production use.

Catalogs

Generating catalogs from OSV

tools/osvcatalog converts a local OSV snapshot into a catalog offline. Bumblebee never queries osv.dev at scan time. Only malicious-package records (MAL- ids, or records aliased to one) are emitted, with severity: "critical".

Two input shapes are supported. Pick one based on coverage.

OSSF malicious-packages repo (recommended, all ecosystems in one tree):

git clone --filter=blob:none --sparse --depth=1 \
  https://github.com/ossf/malicious-packages.git mp
git -C mp sparse-checkout set osv/malicious
go run ./tools/osvcatalog \
  -source "https://github.com/ossf/malicious-packages@$(git -C mp rev-parse HEAD)" \
  -o threat_intel/osv-malicious.json mp/osv/malicious/

OSV per-ecosystem dump (single ecosystem, zip archive):

curl -fsSLO https://osv-vulnerabilities.storage.googleapis.com/npm/all.zip
go run ./tools/osvcatalog -o threat_intel/osv-npm-malicious.json npm/all.zip

Each input path can be a directory tree, an OSV all.zip archive, or a single .json record. Supported OSV ecosystems map to Bumblebee as: npm, PyPI → pypi, Go → go, RubyGems → rubygems, Packagist → packagist, VSCode → editor-extension. Records whose ranges declare all versions affected (a single introduced: "0" event) are emitted with "versions": ["*"]; records with only bounded ranges and no enumerated are skipped. Output is deterministic, validates against the schema, and should be reviewed before use. The generated records scope, per-ecosystem counts, skip-reason breakdown, and the optional provenance label.