ashishbijlani

9 ms·

1. 61.▲
   by ashishbijlani 4y ago

   I've been building Packj [1] to address exactly these types of supply chain attacks. It can audit PyPI/NPM/Rubygems packages and flag hidden malware or "risky” code behavior such as spawning of shell, exfiltration of dat
2. 62.▲
   by ashishbijlani 4y ago

   Great! Let’s connect. Email in my profile.
3. 63.▲
   by ashishbijlani 4y ago

   Very cool! I've built something similar, but for packages: https://github.com/ossillate-inc/packj Would love to talk.
4. 64.▲
   by ashishbijlani 4y ago

   This. Moreover, such typo-squatting attacks could easily be mitigated by using a private package registry.
5. 65.▲
   by ashishbijlani 4y ago

   We’re building a private registry based on Packj [1] that hosts vetted artifacts. Will post more about it publicly soon. 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.
6. 66.▲
   by ashishbijlani 4y ago

   I've been building Packj [1] to address exactly this problem. You can _audit_ as well as _sandbox_ installation of PyPI/NPM/Rubygems packages and flags hidden malware or "risky” code behavior such as spawning of shell, u
7. 67.▲
   by ashishbijlani 4y ago

   Thanks for highlighting this! While PTRACE introduces TOCTTOU vulnerabilities, Packj sandboxes fixes that by using read-only args for ptrace. You can find my PhD work [1] on this relevant. 1. https://lwn.net/Articles/80
8. 68.▲
   by ashishbijlani 4y ago

   I’ve created Packj sandbox [1] for “safe installation” of PyPI/NPM/Rubygems packages 1. https://github.com/ossillate-inc/packj It DOES NOT require a VM/Container; uses strace. It shows you a preview of f
9. 69.▲
   by ashishbijlani 4y ago

   I started with static/dynamic analysis in Packj [1] to vet PyPI/NPM/Rubygems packages and flags hidden malware or "risky” code behavior such as spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged
10. 70.▲
    by ashishbijlani 4y ago

    Plug: I've been building Packj [1] to address exactly this problem. You can _audit_ as well as _sandbox_ installation of PyPI/NPM/Rubygems packages and flags hidden malware or "risky” code behavior such as spawning of sh
11. 71.▲
    by ashishbijlani 4y ago

    I’ve been building Packj [1] to flag PyPI/NPM/Ruby packages that contain suspicious decode+exec and other “risky” APIs using static analysis. It also uses strace-based dynamic analysis to monitor install-time filesystem/netwo
12. 72.▲
    by ashishbijlani 4y ago

    We've an open-source project that does this: https://github.com/osssanitizer/maloss I'm working on creating a CLI/web interface for this. Happy to chat (email in profile).
13. 73.▲
    by ashishbijlani 4y ago

    Great to see a developer-friendly tool around OSV! Packj [1] uses OSV APIs to report vulnerable PyPI/NPM/Rubygems packages. Disclaimer: I built it. 1. https://github.com/ossillate-inc/packj flags malicious&#x
14. 74.▲
    by ashishbijlani 4y ago

    Good to see this project here! Have you added support for permissions already? Would love to integrate this in https://github.com/ossillate-inc/packj
15. 75.▲
    by ashishbijlani 4y ago

    Plug: I've been building Packj [1] to address exactly this problem. It offers “audit” as well as “sandboxing” of PyPI/NPM/Rubygems packages and flags hidden malware or "risky” code behavior such as spawning of shell, use
16. 76.▲
    by ashishbijlani 4y ago

    I'm building Packj [1] to flag malicious/risky open-source dependencies. It offers “audit” as well as “sandboxing” of PyPI/NPM/Rubygems packages and reports hidden malware or "risky” code behavior such as spawning o
17. 77.▲
    by ashishbijlani 4y ago

    While no automated tool can accurately catch all malware, I'm building Packj [1] to provide objective security insights into software artifacts. Auditing hundreds of direct/transitive dependencies manually is impractical, but Pack
18. 78.▲
    by ashishbijlani 4y ago

    I'm building Packj [1] to flag malicious/risky open-source dependencies. It offers “audit” as well as “sandboxing” of PyPI/NPM/Rubygems packages and reports hidden malware or "risky” code behavior such as spawning o
19. 79.▲
    by ashishbijlani 4y ago

    I like how it enables package search right in IDE. I'd be interested to integrate Packj [1]. Sent you an email. 1. https://github.com/ossillate-inc/packj
20. 80.▲
    by ashishbijlani 4y ago

    I built Packj to flag such "risky" packages: https://github.com/ossillate-inc/packj
21. 81.▲
    by ashishbijlani 4y ago

    Take a look at Nestybox's DID use case [1]. They got acquired by Docker 1. https://blog.nestybox.com/2019/11/11/docker-sandbox.html
22. 82.▲
    by ashishbijlani 4y ago

    Are you suggesting that you would rather wait for languages to provide robust sandboxing capabilities and not use available static/dynamic analysis tools (e.g., Packj [1]) to audit packages for malicious/risky indicators, particul
23. 83.▲
    by ashishbijlani 4y ago

    That’s exactly why I use strace-based to sandbox ALL dependencies: https://github.com/ossillate-inc/packj
24. 84.▲
    by ashishbijlani 4y ago

    This is exactly what Packj [1] scans packages for (30+ such risky attributes). Many packages will use base64 for benign reasons, this is why no fully-automated tool could be 100% accurate. Manual auditing is impractical, but Packj can quick
25. 85.▲
    by ashishbijlani 4y ago

    Plug: I've been building Packj [1] to address exactly this problem. It offers “audit” as well as “sandboxing” of PyPI/NPM/Rubygems packages and flags hidden malware or "risky” code behavior such as spawning of shell, use
26. 86.▲
    by ashishbijlani 4y ago

    Packj sandbox [1] offers "safe installation" of PyPI/NPM/Rubygems packages. 1. https://github.com/ossillate-inc/packj/blob/main/packj/sandb... It DOES NOT require a VM/Conta
27. 87.▲
    by ashishbijlani 4y ago

    I built Packj https://github.com/ossillate-inc/packj to scan NPM/PyPI/Ruby packages for CVEs and malicious/risky attributes.
28. 88.▲
    by ashishbijlani 4y ago

    Tools like Packj[1] that check for typosquatting and install packages under a sandbox can help in avoiding accidental installation of malicious packages. Disclaimer: I’m one of the devs. 1. https://github.com/ossillate-inc&#
29. 89.▲
    Packj runner flags risky/malicious NPM/PyPI/Ruby dependencies in your PRs(github.com)

    2 points by ashishbijlani 4y ago|0 comments
30. 90.▲
    Packj sandbox for “safe installation” of PyPI/NPM/Rubygems packages(github.com)

    6 points by ashishbijlani 4y ago|0 comments