OSV Record With Schema Violations — Intentionally Invalid
An intentionally invalid OSV record: the JSON parses, but the required id is missing, modified is not an RFC 3339 timestamp, the SEMVER range has a fixed event with no introduced event, and severity.score is a number where the schema demands a CVSS vector string. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
{
"schema_version": "1.6.0",
"modified": "not-a-timestamp",
"published": "2026-01-05T00:00:00Z",
"aliases": [
"SAMPLE-CVE-2026-0002"
],
"summary": "SAMPLE advisory: fabricated unsafe-deserialisation issue in a fictional cache library.",
"details": "SAMPLE advisory: fabricated unsafe-deserialisation issue in a fictional cache library. This record exists only as a test fixture; the package, the advisory and the identifier are all invented.",
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "example-cache",
"purl": "pkg:npm/example-cache@0.9.2"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"fixed": "0.9.5"
}
]
}
],
"versions": [
"0.9.2"
],
"database_specific": {
"source": "NOVUS-SAMPLE",
"cwe": "CWE-502",
"vulnerable_range": ">=0.9.0 <0.9.5"
}
}
],
"severity": [
{
"type": "CVSS_V3",
"score": 9.3
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0002"
},
{
"type": "FIX",
"url": "https://git.orchard.example/cache/0.9.5"Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- OSV
- Violations
- 4
- Intentionally Invalid
- true
- Well Formed Json
- true
- Line Endings
- LF
Testing contract
Expected to fail- Scenario
- Validate an advisory record against the OSV schema rather than merely parsing it.
- Expected result
- Validator reports four distinct violations — missing id, bad timestamp, range without an introduced event, and a numeric severity score — instead of accepting the record because it is well-formed JSON.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“OSV Record With Schema Violations — Intentionally Invalid” is a deterministic Novus Examples fixture for Schema validation, Error handling, JSON parsing. JSON Schema documents describing a data shape — for testing validators and schema-aware tooling.
Documented properties for this file: seed 51200 · LF · OSV. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Code examples
import json
with open("osv-record-schema-violations.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonTrivy Clean Scan Report (Zero Findings)A clean scan report — the case dashboards get wrong. Trivy omits the Vulnerabilities key entirely rather than emitting an empty array, so a reader that assumes the key exists throws on a passing build. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonTrivy Container Image Scan Report (JSON)A Trivy-shaped image report with three result blocks — OS packages, language packages and a Dockerfile misconfiguration — so a parser must handle a Results array whose members have different keys. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonCycloneDX 1.6 Minimal SBOM (One Component)The smallest CycloneDX document that is still valid: required metadata, one fictional component, and no dependencies array — for testing that a reader handles an SBOM with nothing optional present. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonCycloneDX SBOM With Schema Violations — Intentionally InvalidAn intentionally invalid CycloneDX SBOM: the JSON parses, but bomFormat is missing, one component has no name, and a dependency references a bom-ref that no component declares. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonnpm Lockfile With Integrity Mismatch — Intentionally InvalidAn intentionally invalid npm lockfile: two fictional packages carry sha512 integrity strings that cannot match their resolved tarballs — one derived from the wrong version, one a padded placeholder. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonRekor Transparency-Log EntryA transparency-log entry keyed by its own UUID at the top level — a shape that breaks parsers expecting a fixed root key — with a base64 body that decodes to a dsse record. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.