3 ms·
I'm building Packj [1] to flag malicious/risky open-source dependencies. It offers “audit” as well as “sandboxing” of PyPI/NPM/Rubygems packages and reports hid
by ashishbijlani 4y ago
I'm building Packj [1] to flag malicious/risky open-source dependencies. It offers “audit” as well as “sandboxing” of PyPI/NPM/Rubygems packages and reports hidden malware or "risky” code behavior such as spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). Found a bunch of malicious packages on PyPI/RubyGems using the tool, which have now been taken down.
1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj