4 ms·
I've been building Packj [1] to detect dummy, malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out stat
by ashishbijlani 3y ago
I've been building Packj [1] to detect dummy, malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as num funcs/files, spawning of shell, use of SSH keys, network communication, use of decode+eval, mismatch of GitHub code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages.
1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj
- siddheshgunjal 3y agoThis is interesting! Implementing it today itself for my open source package development pipeline!
- thenerdhead 3y agoCool project. How do you feel about projects like OpenSSF scorecards or even the checks that socket.dev do today on these packages to help determine risk? https://github.com/ossillate-inc/packj/blob/main/.packj.yaml https://github.com/ossillate-inc/packj/blob/main/.packj.yaml Secondly, what about impersonation where attackers imitate a popular package and its respective metadata?
- ashishbijlani 3y agoThanks! We need more such efforts to improve supply-chain security of open-source software. Packj detects typo-squatting (impersonation) as well.