codecov-io: # [Codecov](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=h1) Report
> Merging [#369](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=desc) into [master](https://codecov.io/gh/oasis-open/cti-python-stix2/commit/3803e4bdd7877af8e11211f42261f324b2c92255?src=pr&el=desc) will **increase** coverage by `<.01%`.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369/graphs/tree.svg?width=650&token=vzHZ2LBVZq&height=150&src=pr)](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master     #369      +/-   ##
==========================================
+ Coverage   98.18%   98.18%   +<.01%     
==========================================
  Files         124      124              
  Lines       14230    14234       +4     
==========================================
+ Hits        13972    13976       +4     
  Misses        258      258
```


| [Impacted Files](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [stix2/v21/sdo.py](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369/diff?src=pr&el=tree#diff-c3RpeDIvdjIxL3Nkby5weQ==) | `94.53% <ø> (ø)` | :arrow_up: |
| [stix2/test/v21/test\_malware.py](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369/diff?src=pr&el=tree#diff-c3RpeDIvdGVzdC92MjEvdGVzdF9tYWx3YXJlLnB5) | `100% <100%> (ø)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=footer). Last update [3803e4b...6494470](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

diff --git a/stix2/v21/sdo.py b/stix2/v21/sdo.py
index 1d97261..5c87515 100644
--- a/stix2/v21/sdo.py
+++ b/stix2/v21/sdo.py
@@ -460,7 +460,7 @@ class Malware(STIXDomainObject):
         ('kill_chain_phases', ListProperty(KillChainPhase)),
         ('first_seen', TimestampProperty()),
         ('last_seen', TimestampProperty()),
-        ('os_execution_envs', ListProperty(StringProperty)),
+        ('operating_system_refs', ListProperty(ReferenceProperty(valid_types='software', spec_version='2.1'))),
         ('architecture_execution_envs', ListProperty(StringProperty)),
         ('implementation_languages', ListProperty(StringProperty)),
         ('capabilities', ListProperty(StringProperty)),

Malware os_execution_envs changes
This property was renamed to operating_system_refs, is now list of Software SCO identifiers instead of strings, and no longer SHOULD be a CPE entry.
diff --git a/stix2/test/v21/test_malware.py b/stix2/test/v21/test_malware.py
index 53838c9..412d740 100644
--- a/stix2/test/v21/test_malware.py
+++ b/stix2/test/v21/test_malware.py
@@ -197,3 +197,22 @@ def test_malware_non_family_no_name():
         "is_family": False,
         "malware_types": ["something"],
     })
+
+
+def test_malware_with_os_refs():
+    software = stix2.parse({
+        "type": "software",
+        "name": "SuperOS",
+        "spec_version": "2.1",
+    })
+
+    malware = stix2.parse({
+        "type": "malware",
+        "id": MALWARE_ID,
+        "spec_version": "2.1",
+        "is_family": False,
+        "malware_types": ["something"],
+        "operating_system_refs": [software],
+    })
+
+    assert malware["operating_system_refs"][0] == software["id"]

pip install -e .[dev]
parse_log_pytest
requirements.txt
taxii2-client fuzzywuzzy haversine python-Levenshtein medallion
3.6
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
alabaster==0.7.13
antlr4-python3-runtime==4.9.3
async-generator==1.10
attrs==22.2.0
Babel==2.11.0
backcall==0.2.0
bleach==4.1.0
bump2version==1.0.1
bumpversion==0.6.0
certifi==2021.5.30
cfgv==3.3.1
charset-normalizer==2.0.12
click==8.0.4
coverage==6.2
dataclasses==0.8
decorator==5.1.1
defusedxml==0.7.1
distlib==0.3.9
docutils==0.17.1
entrypoints==0.4
filelock==3.4.1
Flask==2.0.3
Flask-HTTPAuth==4.8.0
fuzzywuzzy==0.18.0
haversine==2.9.0
identify==2.4.4
idna==3.10
imagesize==1.4.1
importlib-metadata==4.8.3
importlib-resources==5.2.3
iniconfig==1.1.1
ipython==7.16.3
ipython-genutils==0.2.0
itsdangerous==2.0.1
jedi==0.17.2
Jinja2==3.0.3
jsonschema==3.2.0
jupyter-client==7.1.2
jupyter-core==4.9.2
jupyterlab-pygments==0.1.2
Levenshtein==0.21.1
MarkupSafe==2.0.1
medallion==3.0.0
mistune==0.8.4
nbclient==0.5.9
nbconvert==6.0.7
nbformat==5.1.3
nbsphinx==0.4.3
nest-asyncio==1.6.0
nodeenv==1.6.0
packaging==21.3
pandocfilters==1.5.1
parso==0.7.1
pexpect==4.9.0
pickleshare==0.7.5
platformdirs==2.4.0
pluggy==1.0.0
pre-commit==2.17.0
prompt-toolkit==3.0.36
ptyprocess==0.7.0
py==1.11.0
Pygments==2.14.0
pyparsing==3.1.4
pyrsistent==0.18.0
pytest==7.0.1
pytest-cov==4.0.0
python-dateutil==2.9.0.post0
python-Levenshtein==0.21.1
pytz==2025.2
PyYAML==6.0.1
pyzmq==25.1.2
rapidfuzz==2.11.1
requests==2.27.1
simplejson==3.20.1
six==1.17.0
snowballstemmer==2.2.0
Sphinx==1.8.6
sphinx-prompt==1.5.0
sphinxcontrib-serializinghtml==1.1.5
sphinxcontrib-websupport==1.2.4
-e git+https://github.com/oasis-open/cti-python-stix2.git@380926cff59f9e0d70914c2de933e4651f13259d#egg=stix2
stix2-patterns==2.0.0
taxii2-client==2.3.0
testpath==0.6.0
toml==0.10.2
tomli==1.2.3
tornado==6.1
tox==3.28.0
traitlets==4.3.3
typing_extensions==4.1.1
urllib3==1.26.20
virtualenv==20.16.2
wcwidth==0.2.13
webencodings==0.5.1
Werkzeug==2.0.3
zipp==3.6.0

name: cti-python-stix2
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=21.2.2=py36h06a4308_0
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - setuptools=58.0.4=py36h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - alabaster==0.7.13
      - antlr4-python3-runtime==4.9.3
      - async-generator==1.10
      - attrs==22.2.0
      - babel==2.11.0
      - backcall==0.2.0
      - bleach==4.1.0
      - bump2version==1.0.1
      - bumpversion==0.6.0
      - cfgv==3.3.1
      - charset-normalizer==2.0.12
      - click==8.0.4
      - coverage==6.2
      - dataclasses==0.8
      - decorator==5.1.1
      - defusedxml==0.7.1
      - distlib==0.3.9
      - docutils==0.17.1
      - entrypoints==0.4
      - filelock==3.4.1
      - flask==2.0.3
      - flask-httpauth==4.8.0
      - fuzzywuzzy==0.18.0
      - haversine==2.9.0
      - identify==2.4.4
      - idna==3.10
      - imagesize==1.4.1
      - importlib-metadata==4.8.3
      - importlib-resources==5.2.3
      - iniconfig==1.1.1
      - ipython==7.16.3
      - ipython-genutils==0.2.0
      - itsdangerous==2.0.1
      - jedi==0.17.2
      - jinja2==3.0.3
      - jsonschema==3.2.0
      - jupyter-client==7.1.2
      - jupyter-core==4.9.2
      - jupyterlab-pygments==0.1.2
      - levenshtein==0.21.1
      - markupsafe==2.0.1
      - medallion==3.0.0
      - mistune==0.8.4
      - nbclient==0.5.9
      - nbconvert==6.0.7
      - nbformat==5.1.3
      - nbsphinx==0.4.3
      - nest-asyncio==1.6.0
      - nodeenv==1.6.0
      - packaging==21.3
      - pandocfilters==1.5.1
      - parso==0.7.1
      - pexpect==4.9.0
      - pickleshare==0.7.5
      - platformdirs==2.4.0
      - pluggy==1.0.0
      - pre-commit==2.17.0
      - prompt-toolkit==3.0.36
      - ptyprocess==0.7.0
      - py==1.11.0
      - pygments==2.14.0
      - pyparsing==3.1.4
      - pyrsistent==0.18.0
      - pytest==7.0.1
      - pytest-cov==4.0.0
      - python-dateutil==2.9.0.post0
      - python-levenshtein==0.21.1
      - pytz==2025.2
      - pyyaml==6.0.1
      - pyzmq==25.1.2
      - rapidfuzz==2.11.1
      - requests==2.27.1
      - simplejson==3.20.1
      - six==1.17.0
      - snowballstemmer==2.2.0
      - sphinx==1.8.6
      - sphinx-prompt==1.5.0
      - sphinxcontrib-serializinghtml==1.1.5
      - sphinxcontrib-websupport==1.2.4
      - stix2-patterns==2.0.0
      - taxii2-client==2.3.0
      - testpath==0.6.0
      - toml==0.10.2
      - tomli==1.2.3
      - tornado==6.1
      - tox==3.28.0
      - traitlets==4.3.3
      - typing-extensions==4.1.1
      - urllib3==1.26.20
      - virtualenv==20.16.2
      - wcwidth==0.2.13
      - webencodings==0.5.1
      - werkzeug==2.0.3
      - zipp==3.6.0
prefix: /opt/conda/envs/cti-python-stix2

stix2/test/v21/test_malware.py::test_malware_with_os_refs
stix2/test/v21/test_malware.py::test_malware_with_all_required_properties stix2/test/v21/test_malware.py::test_malware_autogenerated_properties stix2/test/v21/test_malware.py::test_malware_type_must_be_malware stix2/test/v21/test_malware.py::test_malware_id_must_start_with_malware stix2/test/v21/test_malware.py::test_malware_required_properties stix2/test/v21/test_malware.py::test_malware_required_property_name stix2/test/v21/test_malware.py::test_cannot_assign_to_malware_attributes stix2/test/v21/test_malware.py::test_invalid_kwarg_to_malware stix2/test/v21/test_malware.py::test_parse_malware[{\n stix2/test/v21/test_malware.py::test_parse_malware[data1] stix2/test/v21/test_malware.py::test_parse_malware_invalid_labels stix2/test/v21/test_malware.py::test_parse_malware_kill_chain_phases stix2/test/v21/test_malware.py::test_parse_malware_clean_kill_chain_phases stix2/test/v21/test_malware.py::test_malware_invalid_last_before_first stix2/test/v21/test_malware.py::test_malware_family_no_name stix2/test/v21/test_malware.py::test_malware_non_family_no_name
stix2/v21/sdo.py
stix2/v21/sdo.py