3 ms·

Any reasonable company already knows this and sets up a proxy repo of scanned/approved versions (this is important for licensing too).

0cf8612b2e1e 2y ago
How much is that automated scanning worth? Sure, we have mirrored repos, but I assume the malware authors pre test their code on a suite of detectors in CI. So infected packages will happily be mirrored internally for consumption.
- poincaredisk 2y ago
  >I assume the malware authors pre test their code on a suite of detectors in CI. Maybe some do, but you give the average malware developer way too much credit.
- thibaut_barrere 2y ago
  It is worth a fair bit. If you control the mirroring you can ensure the malware is flagged but not deleted, so forensics can assess how much damage has been done or would have been done, for instance.
- giantg2 2y ago
  At least at my company, I think someone at least has to approve/verify the scan results. Of course it's still a risk, but so are external emails, vendor files, and everything else.
- ohgr 2y ago
  Bugger all. We had something go straight through.
- delusional 2y ago
  Not much. as you say, static scanning is pretty much a dead end strategy. Exploiters have long since realized that you can just run the scan yourself and jiggle the bytes around to evade the signature detection.
- feross 2y ago
  Totally agree. Most companies using mirrors or proxies like Artifactory aren’t getting much real protection. - They cache packages but don’t analyze what’s inside. - They scan or review the first version, then auto-approve every update after that. - They skip transitive deps — and in npm, that’s 79 on average per package. - They rely on scanners that claim to detect supply chain attacks but just check for known CVEs. The CVE system doesn’t track malware or supply chain attacks (except rarely), so it misses 99%+ of real threats. Almost everything on the market today gives a false sense of security. One exception is Socket — we analyze the actual package behavior to detect risks in real time, even in transitive deps. https://socket.dev https://socket.dev (Disclosure: I’m the founder.)
pletnes 2y ago
Not from what I’ve seen. What are the relevant products in this space? Can’t expect every random company to set up package scanning from scratch.
- tsm 2y ago
  I worked for an IBM acquiree 13 years ago and as part of the "Blue-washing" process to get our software up to IBM spec we had to use their proprietary tools for verifying our dependencies were okay.
- chrisweekly 2y ago
  JFrog / Artifactory is one very common provider of private npm registries. There are a ton of security-scan vendors out there (mend/whitesource, socket, black duck...)
- deleted 2y ago
  [deleted]
- giantg2 2y ago
  Well then I wouldn't expect to do business with every random company. TPRM is a big issue today, so I wouldn't expect any company not performing basic due diligence to service.
swatcoder 2y ago
You're absolutely right, but you've just asserted that almost all companies making software are unreasonable. Distressingly, doing what you suggest remains the exception by orders of magnitude. Very few people have internalized why it's necessary and few of those have the political influence in their organizations to make it happen.
- nukem222 2y ago
  [flagged]

0cf8612b2e1e 2y ago

How much is that automated scanning worth? Sure, we have mirrored repos, but I assume the malware authors pre test their code on a suite of detectors in CI. So infected packages will happily be mirrored internally for consumption.

poincaredisk 2y ago
>I assume the malware authors pre test their code on a suite of detectors in CI. Maybe some do, but you give the average malware developer way too much credit.
thibaut_barrere 2y ago
It is worth a fair bit. If you control the mirroring you can ensure the malware is flagged but not deleted, so forensics can assess how much damage has been done or would have been done, for instance.
giantg2 2y ago
At least at my company, I think someone at least has to approve/verify the scan results. Of course it's still a risk, but so are external emails, vendor files, and everything else.
ohgr 2y ago
Bugger all. We had something go straight through.
delusional 2y ago
Not much. as you say, static scanning is pretty much a dead end strategy. Exploiters have long since realized that you can just run the scan yourself and jiggle the bytes around to evade the signature detection.
feross 2y ago
Totally agree. Most companies using mirrors or proxies like Artifactory aren’t getting much real protection. - They cache packages but don’t analyze what’s inside. - They scan or review the first version, then auto-approve every update after that. - They skip transitive deps — and in npm, that’s 79 on average per package. - They rely on scanners that claim to detect supply chain attacks but just check for known CVEs. The CVE system doesn’t track malware or supply chain attacks (except rarely), so it misses 99%+ of real threats. Almost everything on the market today gives a false sense of security. One exception is Socket — we analyze the actual package behavior to detect risks in real time, even in transitive deps. https://socket.dev https://socket.dev (Disclosure: I’m the founder.)

pletnes 2y ago

Not from what I’ve seen. What are the relevant products in this space? Can’t expect every random company to set up package scanning from scratch.

tsm 2y ago
I worked for an IBM acquiree 13 years ago and as part of the "Blue-washing" process to get our software up to IBM spec we had to use their proprietary tools for verifying our dependencies were okay.
chrisweekly 2y ago
JFrog / Artifactory is one very common provider of private npm registries. There are a ton of security-scan vendors out there (mend/whitesource, socket, black duck...)
deleted 2y ago
[deleted]
giantg2 2y ago
Well then I wouldn't expect to do business with every random company. TPRM is a big issue today, so I wouldn't expect any company not performing basic due diligence to service.

swatcoder 2y ago

You're absolutely right, but you've just asserted that almost all companies making software are unreasonable. Distressingly, doing what you suggest remains the exception by orders of magnitude. Very few people have internalized why it's necessary and few of those have the political influence in their organizations to make it happen.

nukem222 2y ago
[flagged]