5 ms·
anyone using AI/deep learning to vet software supply chains yet? seems like a higher priority task than generating artificial art. let's turn the GPT's toward
by barkingcat 4y ago
anyone using AI/deep learning to vet software supply chains yet?
seems like a higher priority task than generating artificial art.
let's turn the GPT's toward something like a softwaresupplyGPT that can be trained on all the software on all the individual package/dependency managers that are in existence.
- ashishbijlani 4y agoI started with static/dynamic analysis in Packj [1] to vet PyPI/NPM/Rubygems packages and flags hidden malware or "risky” code behavior such as spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj flags malicious/risky packages.