2025 Q1 Securing Critical Projecgs WG update

TI-reports/2025/2025-Q1-SCP-WG.md

@@ -0,0 +1,106 @@
+# 2025 Q1 Securing Critical Projects WG
+
+## Overview
+
+Sub projects continue to run and make progress. Little to no progress on main
+initiative of enhancing Critical Project Set with more information. Attendance
+is low.
+
+[2024-Q3 Update](../2024-Q3-SCP-WG.md)
+
+## Identifying Critical Projects
+
+### Purpose
+
+Open Source Software has long suffered from a "tragedy of the commons"
+problem. Organizations large and small make use of OSS every day, but many
+projects are struggling for the time, resources and attention they need.
+
+This is a resource allocation problem - and we can help solve it together. We
+need ways to connect critical projects we all rely on with organizations that
+can provide them with support.
+
+[MVSR Link](https://github.com/ossf/wg-securing-critical-projects/blob/main/MVSR.md)
+
+### Current Status
+
+Discussions on:
+- Metadata side: what to add to list
+- Ideal north star of next iteration
+- Front end / publishing list
+
+### Up Next
+
+TBD, no concrete plans
+
+### Questions/Issues for the TAC
+
+None
+
+## Criticality Score
+
+### Purpose
+
+1. Generate a criticality score for every open source project.
+
+1. Create a list of critical projects that the open source community depends
+   on.
+
+1. Use this data to proactively improve the security posture of these critical
+   projects.
+
+### Current Status
+
+- Continues to run and recalculate scores
+- Updates 1 to 2 times a month
+- Tracking 500,000 projects
+
+### Up Next
+
+Continue running
+
+### Questions/Issues for the TAC
+
+None
+
+
+## Package Analysis / Malicious Packages
+
+### Purpose
+
+The Package Analysis project analyses the capabilities of packages available on
+open source repositories. The project looks for behaviors that indicate
+malicious software:
+
+- What files do they access?
+- What addresses do they connect to?
+- What commands do they run?
+
+The project also tracks changes in how packages behave over time, to identify
+when previously safe software begins acting suspiciously.
+
+This effort is meant to improve the security of open source software by
+detecting malicious behavior, informing consumers selecting packages, and
+providing researchers with data about the ecosystem.
+
+Malicious Packages is a collection of reports of malicious packages identified in
+Open Source package repositories, consumable via the Open Source Vulnerability
+(OSV) format.
+
+### Current Status
+
+- Formal definition of "Malicious Package" merged
+- Malicious Package counts (Pull numbers from annual update) (current as 2025-01-17)
+    - 2 crates-io
+    - 18158 npm
+    - 740 nuget
+    - 8778 pypi
+    - 807 rubygems
+
+### Up Next
+
+Interested in PyPi data
+
+### Questions/Issues for the TAC
+
+None