abhisek

13 ms·

121.
by abhisek 1y ago
IMHO there is neither baseline nor “enough” when it comes to learning any programming language for any reasonably complex domain. As you already know, C/C++ helps with low level software layers that interface with or manage hardware re
122.
Verizon 2025 Data Breach Investigations Report [pdf](verizon.com)
2 points by abhisek 1y ago|0 comments
123.
LLMs with the Model Context Protocol Allow Major Security Exploits(arxiv.org)
2 points by abhisek 1y ago|0 comments
124.
by abhisek 1y ago
I am not sure how this is any different from open source code being embedded in commercial applications. It’s really like a self-accelerating loop. At least for OSS, usage defines value. When an OSS project is popular, enterprises notices i
125.
by abhisek 1y ago
There is a need for a funding base especially when a project grows beyond a single person and needs a team to be maintained. Either this “somehow” comes from the community or it comes from the investors. If it’s the latter then eventually t
126.
by abhisek 1y ago
We found a malicious npm package express-cookie-parser impersonating the popular Express cookie-parser package. The README.md file for express-cookie-parser is a copy from the cookie-parser package. The malicious payload is in cookie-loader
127.
by abhisek 1y ago
I think it’s much more of a problem than just finding the beta testers. It’s about ensuring quality of service, scope and trustworthiness. Otherwise this system will be games to mine fake usage metrics.
128.
Detecting Malicious Source Code in PyPI Packages with LLMs(arxiv.org)
2 points by abhisek 1y ago|1 comments
129.
by abhisek 1y ago
Can LLMs Detect Malicious PyPI Packages Better with RAG? Over 1,200 malicious Python packages were evaluated using three approaches: – Zero-shot LLM prompts (no prior examples) – Retrieval-Augmented Generation (RAG) with threat intelligence
130.
by abhisek 1y ago
We run similar npm package monitors. The use of exotic tld domains such as 0x9c.xyz kind of gave it away because YARA Forge rules have native signatures to detect such domains. It will be interesting t explore how the project got compromise
131.
by abhisek 1y ago
As an open source tool developer that relies on vulnerability database, I have moved to using OSV - https://osv.dev/ Not just the standardised and evolving schema, active participation by ecosystem maintainers (eg. Go) make
132.
by abhisek 1y ago
Today we identified two malicious package with similar payload - slf4j-api-js and concurrent-hashmap. Both are named to impersonate popular Java libraries. Likely the goal is to target Java developers looking for similar package names whil
133.
by abhisek 2y ago
May be try out vet as well: https://github.com/safedep/vet vet is backed by a code analysis engine that performs malicious package (npm, pypi etc.) scanning. We recently extended it to support GitHub repository scannin
134.
by abhisek 2y ago
We built a GitLab CI/CD Component to integrate vet, our OSS tool with GitLab. This supports dependency scanning for vulnerable and malicious packages in all versions of GitLab. Demo and documentation published in this blog post: https
135.
by abhisek 2y ago
Yes. Very much. My brain refuses to focus on harder problem by default. Seems to rely more on AI first before accepting the fact that some problems require deep thinking even to frame to the AI
136.
by abhisek 2y ago
We leverage static code analysis to scan open source packages for malicious code. We do this at scale by monitoring npm and pypi registries. But there are false positives that require us to manually triage flagged packages. After triaging m
137.
Show HN: MCP Server Built in Go for Pinning GitHub Actions(github.com)
2 points by abhisek 2y ago|0 comments
138.
by abhisek 2y ago
I have contributed to multiple OSS projects including those run by big techs. In my experience they require you to sign a CLA but other than that I have not faced any other barrier. Keeping PRs small and iteratively contributing a larger fe
139.
Show HN: Scan GitHub Actions for Malicious Code(github.com)
1 points by abhisek 2y ago|0 comments
140.
Typosquatt alert Malicious NPM Package: NYC-config(safedep.io)
1 points by abhisek 2y ago|1 comments
141.
by abhisek 2y ago
We discovered a malicious npm package nyc-config using our malicious OSS package monitor. It involved sending user system data to external domains. Initially we assumed it to be a possible dependency confusion attack against @istanbuljs&#x2
142.
by abhisek 2y ago
I think the conventional approach of checking for vulnerabilities in 3rd party dependencies by querying CVE or some other database has set the current behaviour i.e. if its not vulnerable it must be safe. This implicit trust on vulnerabilit
143.
Show HN: Eliminating Vulnerability False Positives Through Code Analysis(docs.safedep.io)
1 points by abhisek 2y ago|0 comments
144.
Show HN: Vetpkg.dev – open-source Package Security Dashboard(vetpkg.dev)
1 points by abhisek 2y ago|0 comments
145.
What Is Next Generation Software Composition Analysis?(safedep.io)
1 points by abhisek 2y ago|0 comments
146.
Show HN: vet – Adding Support for Open Source Package Malware Scanning(github.com)
2 points by abhisek 2y ago|0 comments
147.
Malicious NPM Packages Using Burp Collaborator for Dependency Confusion Attack(safedep.io)
1 points by abhisek 2y ago|0 comments
148.
Show HN: Vet – Open-Source Software Supply Chain Security Tool(github.com)
3 points by abhisek 2y ago|0 comments
149.
Why Open Source Risks Are Larger Than Only Software Composition Analysis(safedep.io)
2 points by abhisek 2y ago|0 comments
150.
by abhisek 3y ago
Lockfile Poisoning is an attack technique using which a developer with malicious intent can introduce malware in a project’s source code in a way which is almost invisible to code reviewers. This is an especially challenging and risky probl

More ›