Will Large-Scale Automated Scanning Stop Malware on OSS Repositories?
Talkat Open Source Summit Europe 2023 · on Thursday, 2023-09-21· at 12:50· Room 3H (3JAUREGIA - Floor 3), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Case study of PyPI shows automated scanning fails as a preventive gate: three scanners (PyPI checks, OSS Detect Backdoor, Bandit) flag the majority of benign code, a random sample of 1,000 packages produces alerts on most good packages, and 94% of popular packages get flagged when scanning all files. With about one million package updates per year and ~10,000 removals, even tiny false‑positive rates swamp volunteer admins, so third‑party researchers run scanners and report confirmed positives instead of a full automated block.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:25Malware detection methods
- 8:09Open source repositories
- 11:38Malware scanning solution
- 13:46Pi Pi scanning project
- 19:48Repository admin constraints
- 23:22False positives impact
- 26:54Human detection in practice
- 28:22Benchmarking tools
- 36:30Conclusion
- 39:42Q&A
related talks
41mWill Large-Scale Automated Scanning Stop Malware on OSS Repositories?
25mBad actors vs our community: detecting software supply chain...
24mDetección automatizada de archivos maliciosos en el repositorio PyPI
33mYour Silent Software Saboteur: Open Source Malware
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
27mIdentifying Malicious OSS Across Ecosystems
42mHacking the OSS Supply Chain