3 ms·

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and given we are still tiny dealing with a large amount of false positive (that was the case with snyk) is a pain. Just curious how others are dealing with this.

chha 3y ago
We tend to avoid using github repos, but go for published packages from the usual sites; Nuget, Pypi, Npm etc, using Repository and Firewall from Sonatype to act as a proxy between us and the package repos. All packages are analyzed and tagged with various metadata by Sonatype. Firewall lets us define policies for what we can use, and will filter out everything else. This only works for published dependencies, but based on a couple years experience it works really well. No issues with malware (so far), we don't let packages with known vulns into our codebases and we are notified if a vuln is discovered in something we use.
alentred 3y ago
You may look into Trivy [0] , works very well for me so far. [0] https://trivy.dev/ https://trivy.dev/
- richbell 3y ago
  As far as I know, Trivy only flags known vulnerabilities and would not protect against supply-chain attacks like this.
- prmoustache 3y ago
  Trivy only do a CVE / package version mapping. It will not tell you you are using a malicious package from an unknown repo because of typosquatting or bad practices.
Pepe1vo 3y ago
We use Semgrep Supply Chain at work and are reasonably satisfied with it. It splits the supply chain vulnerabilities it found into the categories: reachable, unreachable and undetermined. This makes triaging much easier and it has reduced the time we spent on assessing new vulnerabilities by quite a lot.
deleted 3y ago
[deleted]
mgii 3y ago
There seems to be a lot of confusion between malware and vulnerabilities. None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities. Good as they'll be in detecting vulnerabilities, you are still unprotected from malicious code planted in your code bases.
- richbell 3y ago
  > None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities Sonatype does if you pay $$$ for Firewall, but that only catches things installed via a package manager.
FuriouslyAdrift 3y ago
Self-hosted GitLab.
ashishbijlani 3y ago
I’ve been building an open-source tool Packj [1] to detect publicly malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as spawning of shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj
davidmurdoch 3y ago
LavaMoat and @lavamoat/allowscripts (which does the opposite of it's name).

chha 3y ago

We tend to avoid using github repos, but go for published packages from the usual sites; Nuget, Pypi, Npm etc, using Repository and Firewall from Sonatype to act as a proxy between us and the package repos. All packages are analyzed and tagged with various metadata by Sonatype. Firewall lets us define policies for what we can use, and will filter out everything else. This only works for published dependencies, but based on a couple years experience it works really well. No issues with malware (so far), we don't let packages with known vulns into our codebases and we are notified if a vuln is discovered in something we use.

alentred 3y ago

You may look into Trivy [0] , works very well for me so far. [0] https://trivy.dev/ https://trivy.dev/

richbell 3y ago
As far as I know, Trivy only flags known vulnerabilities and would not protect against supply-chain attacks like this.
prmoustache 3y ago
Trivy only do a CVE / package version mapping. It will not tell you you are using a malicious package from an unknown repo because of typosquatting or bad practices.

Pepe1vo 3y ago

We use Semgrep Supply Chain at work and are reasonably satisfied with it. It splits the supply chain vulnerabilities it found into the categories: reachable, unreachable and undetermined. This makes triaging much easier and it has reduced the time we spent on assessing new vulnerabilities by quite a lot.

deleted 3y ago

[deleted]

mgii 3y ago

There seems to be a lot of confusion between malware and vulnerabilities. None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities. Good as they'll be in detecting vulnerabilities, you are still unprotected from malicious code planted in your code bases.

richbell 3y ago
> None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities Sonatype does if you pay $$$ for Firewall, but that only catches things installed via a package manager.

FuriouslyAdrift 3y ago

Self-hosted GitLab.

ashishbijlani 3y ago

I’ve been building an open-source tool Packj [1] to detect publicly malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as spawning of shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj

davidmurdoch 3y ago

LavaMoat and @lavamoat/allowscripts (which does the opposite of it's name).