4 ms·
We scan PyPI packages regularly for malware to provide a private registry of vetted packages. The tech is open-sourced: Packj [1]. It uses static+dynamic code/
by ashishbijlani 2y ago
We scan PyPI packages regularly for malware to provide a private registry of vetted packages.
The tech is open-sourced: Packj [1]. It uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect impersonating packages (typo squatting).
1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj
- amelius 2y agoIf the tech is open-sourced, then an attacker can keep trying in private until they find an exploit, and then use it. Also, you only know if your security measures work if you test them. I'd feel much safer if there was regular pen-testing by security researchers. We're talking about potential threats from nation state actors here.
- ashishbijlani 2y ago> If the tech is open-sourced, then an attacker can keep trying in private until they find an exploit, and then use it. So you'd rather assume that if something is obscure, it is secure?
- amelius 2y agoI'm just pointing out a huge downside of the approach and that more measures such as pen testing are really needed. I don't want to be right, I want a secure PyPI <3