Bad actors vs our community: detecting software supply chain...
summary
Claims a large scale vetting system that analyzes millions of PyPI package versions for malware and risky attributes and reports that it finds real incidents and 35 malicious packages in January. Uses static API analysis plus metadata checks (email validity, source repo, abandoned status), name-similarity scoring, a CLI/CI plugin and a hosted service called package.dev. Offers a PyPI tool OSSIE to audit dependencies; reports lead to takedowns and working CI integration.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:48Open-source software is eating the world
- 1:14Package managers
- 1:45Bad actors exploit this trust
- 2:08Software supply chain attack
- 2:59Attack Technique: Typosquatting
- 3:40Case study: mitmpraxy2
- 4:27Technique: Social Engineering
- 5:18Technique: Dependency Confusion
- 6:09Technique: Account Hijacking
- 7:14How to defend against these attacks
- 7:58Manual vetting is infeasible
- 8:33Existing tools report KNOWN CVES
- 9:16Vanity stats are not enough
- 10:14Packj: a dev-friendly vetting tool
- 11:52API Analysis
- 12:43Metadata Analysis
- 18:34Enabling package vetting at scale
related talks
41mWill Large-Scale Automated Scanning Stop Malware on OSS Repositories?- 41mWill Large-Scale Automated Scanning Stop Malware on OSS Repositories?
20mMalicious Needle in a Haystack - PyPi Security Pitfalls
24mDetección automatizada de archivos maliciosos en el repositorio PyPI
42mHacking the OSS Supply Chain
35mSecuring Python projects Supply Chain
43mHow to hack and defend (your) open source
18mMalicious Needle in a Haystack – PyPi Security Pitfalls