3 ms·
Their previous release would be easily caught by static analysis. PTH is a novel technique. Run all your new dependencies through static analysis and don't ins
by f311a 7mo ago
Their previous release would be easily caught by static analysis. PTH is a novel technique.
Run all your new dependencies through static analysis and don't install the latest versions.
I implemented static analysis for Python that detects close to 90% of such injections.
https://github.com/rushter/hexora https://github.com/rushter/hexora
- samsk 7mo agoInteresting tool, will definitely try - just curious, is there a tool (hexora checker) that ensures that hexora itself and its dependencies are not compromised ? And of course if there is one, I'll need another one for the hexora checker....
- f311a 7mo agoThere is no such tool, but you can use other static analyzers. Datadog also has one, but it's not AST-based.
- hmokiguess 7mo agohttps://xkcd.com/2044/ https://xkcd.com/2044/
- ting0 7mo agoAnd easily bypassed by an attacker who knows about your static analysis tool who can iterate on their exploit until it no longer gets flagged.
- fernandotakai 7mo agothe main things are: 1. pin dependencies with sha signatures 2. mirror your dependencies 3. only update when truly necessary 4. at first, run everything in a sandbox.