4 ms·

Full disclosure, I am a co-founder at Phylum. We are actively working on a solution that will fully sandbox package installations for npm, yarn, poetry and oth

Full disclosure, I am a co-founder at Phylum. We are actively working on a solution that will fully sandbox package installations for npm, yarn, poetry and others. It's rolled up as part of our core CLI [1], but is totally open source [2]: [1] https://github.com/phylum-dev/cli https://github.com/phylum-dev/cli [2] https://github.com/phylum-dev/birdcage https://github.com/phylum-dev/birdcage

comboy 4y ago
Why is there so much discussion about sandboxing? Why wouldn't I put some malicious code in the package itself limiting myself to installation only?
- louislang 4y ago
  A lot of the malware targeting developers is leveraging the installation hooks as the execution mechanism. So sandboxing the install helps stop this particular attack vector - which is why it gets talked about so much. If you put code in the package itself, this would side step the "installation" sandbox. However we're also doing analysis of all packages introduced to the ecosystem to uncover things that are hiding in the packages themselves. So you're right, we need a defense in depth approach here.
coffeeblack 4y ago
Sounds awesome. Though I’m not sure of the solution really is / should be increased sandboxing. The alternative may be a rethinking of the increasingly smaller packages. Maybe it’s better to have few large packages maintained by reputable organisations or personalities?
- louislang 4y ago
  The problem is large, sprawling and complex. In an ideal case, we'd have high quality packages maintained by reputable people/organizations. But today this just isn't true. Open source takes contributions from a large number of unknown authors/contributors with motivations that may or might night align with your own. We really need a defense in depth approach here. Sandbox where it makes sense, perform analysis of code being published, consider author reputation, etc.
jasfi 4y ago
I think this is a very good idea. It should actually be built into the OS. I know of BSD jails, but not sure what else there is for Linux/Windows/MacOS.

comboy 4y ago

Why is there so much discussion about sandboxing? Why wouldn't I put some malicious code in the package itself limiting myself to installation only?

louislang 4y ago
A lot of the malware targeting developers is leveraging the installation hooks as the execution mechanism. So sandboxing the install helps stop this particular attack vector - which is why it gets talked about so much. If you put code in the package itself, this would side step the "installation" sandbox. However we're also doing analysis of all packages introduced to the ecosystem to uncover things that are hiding in the packages themselves. So you're right, we need a defense in depth approach here.

coffeeblack 4y ago

Sounds awesome. Though I’m not sure of the solution really is / should be increased sandboxing. The alternative may be a rethinking of the increasingly smaller packages. Maybe it’s better to have few large packages maintained by reputable organisations or personalities?

louislang 4y ago
The problem is large, sprawling and complex. In an ideal case, we'd have high quality packages maintained by reputable people/organizations. But today this just isn't true. Open source takes contributions from a large number of unknown authors/contributors with motivations that may or might night align with your own. We really need a defense in depth approach here. Sandbox where it makes sense, perform analysis of code being published, consider author reputation, etc.

jasfi 4y ago

I think this is a very good idea. It should actually be built into the OS. I know of BSD jails, but not sure what else there is for Linux/Windows/MacOS.