Lightning Talk: Scoring Dependencies to Detect “Weak Links” in your Open-source So...
summary
An open‑source tool called PACKJ scores packages by checking specific risky attributes (abandoned maintainer, expired author email, missing public repo, excessive transitive deps) and runs static, dynamic, and metadata analysis to flag behavior like file access, code generation, spawned processes and network syscalls. Rules come from a study of 651 documented malicious packages, the system scans CI via a GitHub Action, has audited ~330,000 PyPI packages and already found 70+ malicious packages and numerous abandoned libraries.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:23Open-source software is eating the world
- 0:52Open-source software supply chain attacks
- 1:19How to defend against these attacks
- 3:03Packj flags "risky" dependencies
- 4:32Packj audit CLI example
related talks
19mCan I trust that package?
43mHow to hack and defend (your) open source
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
42mProtect Yourself from Malicious Dependencies with One Cool Trick
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You
31mChoosing Wisely - How to Pick the Right Third Party Packages for your Project
37mThe State of Open Source Security
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories