What is the SHA-256 hash associated with malicious Python packages

[kmbyr23]

For example, the SHA-256 hashes listed here: https://osv.dev/vulnerability/MAL-2025-3016 and here: https://osv.dev/vulnerability/MAL-2025-47749

What is the file that is being hashed here? Is it the .whl for the package?

[jess-lowe]

Data in the database_specific field comes from upstream data providers in most cases. For the MAL- namespace it comes from https://github.com/ossf/malicious-packages. You should be able to get a better answer there :)

[calebbrown]

Hi @kmbyr23, the sha256 hashes in objects in the malicious-packages-origins array are hashes of the source reports these reports are generated from.

The details of this structure are described in https://github.com/ossf/malicious-packages/blob/main/docs/schema_additions.md.

These are not hashes of the artifacts themselves (whl, zip, tgz, etc).