3 ms·
Package Hunter: A tool for detecting malicious code in your dependencies
- dnsmichi 5y agoInteresting thought from https://twitter.com/d_scho/status/1419752750351540231 https://twitter.com/d_scho/status/1419752750351540231 > Isn‘t dependabot doing the same, basically? with a response in the thread at https://twitter.com/solidnerd/status/1420307219745230850 https://twitter.com/solidnerd/status/1420307219745230850 > Dependabot / renovate only checking for version updates of your programm deps. Package Hunter analyze a program's deps for unexpected behavior (mal code) by installing the dependencies in a sandbox env and monitors system calls executed during the installation. Package Hunter requires Falco, Docker and NodeJS to run, following the instructions at https://gitlab.com/gitlab-org/security-products/package-hunter/-/blob/main/README.md#installation https://gitlab.com/gitlab-org/security-products/package-hunt... - give it a try :)