3 ms·
I've been building Packj [1] to address exactly these types of supply chain attacks. It can audit PyPI/NPM/Rubygems packages and flag hidden malware or "risky”
by ashishbijlani 4y ago
I've been building Packj [1] to address exactly these types of supply chain attacks. It can audit PyPI/NPM/Rubygems packages and flag hidden malware or "risky” code behavior such as spawning of shell, exfiltration of data, mismatching repo code vs packaged code (provenance).
1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj