3 ms·

How much is that automated scanning worth? Sure, we have mirrored repos, but I assume the malware authors pre test their code on a suite of detectors in CI. So

How much is that automated scanning worth? Sure, we have mirrored repos, but I assume the malware authors pre test their code on a suite of detectors in CI. So infected packages will happily be mirrored internally for consumption.

poincaredisk 2y ago
>I assume the malware authors pre test their code on a suite of detectors in CI. Maybe some do, but you give the average malware developer way too much credit.
thibaut_barrere 2y ago
It is worth a fair bit. If you control the mirroring you can ensure the malware is flagged but not deleted, so forensics can assess how much damage has been done or would have been done, for instance.
giantg2 2y ago
At least at my company, I think someone at least has to approve/verify the scan results. Of course it's still a risk, but so are external emails, vendor files, and everything else.
ohgr 2y ago
Bugger all. We had something go straight through.
delusional 2y ago
Not much. as you say, static scanning is pretty much a dead end strategy. Exploiters have long since realized that you can just run the scan yourself and jiggle the bytes around to evade the signature detection.
feross 2y ago
Totally agree. Most companies using mirrors or proxies like Artifactory aren’t getting much real protection. - They cache packages but don’t analyze what’s inside. - They scan or review the first version, then auto-approve every update after that. - They skip transitive deps — and in npm, that’s 79 on average per package. - They rely on scanners that claim to detect supply chain attacks but just check for known CVEs. The CVE system doesn’t track malware or supply chain attacks (except rarely), so it misses 99%+ of real threats. Almost everything on the market today gives a false sense of security. One exception is Socket — we analyze the actual package behavior to detect risks in real time, even in transitive deps. https://socket.dev https://socket.dev (Disclosure: I’m the founder.)

poincaredisk 2y ago

>I assume the malware authors pre test their code on a suite of detectors in CI. Maybe some do, but you give the average malware developer way too much credit.

thibaut_barrere 2y ago

It is worth a fair bit. If you control the mirroring you can ensure the malware is flagged but not deleted, so forensics can assess how much damage has been done or would have been done, for instance.

giantg2 2y ago

At least at my company, I think someone at least has to approve/verify the scan results. Of course it's still a risk, but so are external emails, vendor files, and everything else.

ohgr 2y ago

Bugger all. We had something go straight through.

delusional 2y ago

Not much. as you say, static scanning is pretty much a dead end strategy. Exploiters have long since realized that you can just run the scan yourself and jiggle the bytes around to evade the signature detection.

feross 2y ago

Totally agree. Most companies using mirrors or proxies like Artifactory aren’t getting much real protection. - They cache packages but don’t analyze what’s inside. - They scan or review the first version, then auto-approve every update after that. - They skip transitive deps — and in npm, that’s 79 on average per package. - They rely on scanners that claim to detect supply chain attacks but just check for known CVEs. The CVE system doesn’t track malware or supply chain attacks (except rarely), so it misses 99%+ of real threats. Almost everything on the market today gives a false sense of security. One exception is Socket — we analyze the actual package behavior to detect risks in real time, even in transitive deps. https://socket.dev https://socket.dev (Disclosure: I’m the founder.)