Identifying Malicious OSS Across Ecosystems
summary
Microsoft builds a pipeline called osimilation that pulls neutral metadata from libraries.io, enriches it with registry-specific fields (npm install scripts), runs rule-based alerts, and routes candidates for human review. The system finds exfiltrators, droppers, typo-squatters and spam, including a campaign tied to the T protocol that led to 47,000+ packages removed; static/dynamic analysis alone doesn’t scale, so metadata heuristics plus manual triage prove effective.
AI-written summary · about
chapters (15)
- 0:00Malicious OSS introduction
- 1:05Malicious OSS threat growth
- 3:10Traditional malware detection
- 4:13Metadata analysis importance
- 5:17Game identifying malicious packages
- 8:11Osimilation research project
- 10:59Metadata sources per manager
- 12:23Automated rules and review
- 13:47Detected malware trends
- 16:14Spam in open source packages
- 19:03Impersonation and dependency alerts
- 21:59Attack techniques lessons
- 22:41Recap and call to action
- 23:44Further reading
- 24:04Q&A
related talks
33mYour Silent Software Saboteur: Open Source Malware
42mHacking the OSS Supply Chain
25mBad actors vs our community: detecting software supply chain...
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
41mWill Large-Scale Automated Scanning Stop Malware on OSS Repositories?
46mThe Rise of Malware Within the Software Supply Chain
25mTrusting Your Open-Source Software Supplier
32mHacking the OSS Supply Chain