Will Large-Scale Automated Scanning Stop Malware on OSS Repositories?
summary
Large-scale automated scanning fails as a primary defense because even a very sensitive detector produces a false positive avalanche against PyPI’s million updates per year, overwhelming a small volunteer admin team. A PyPI case study shows compute and latency constraints are manageable but admin time and noisy alerts are not, so an ecosystem equilibrium emerges with third-party researchers running scanners and reporting vetted findings, while priorities like 2FA and better reviewer tooling reduce risk.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:25Malware detection methods
- 8:09Open source repositories
- 11:38Malware scanning solution
- 13:46Pi Pi scanning project
- 19:48Repository admin constraints
- 23:22False positives impact
- 26:54Human detection in practice
- 28:22Benchmarking tools
- 36:30Conclusion
- 39:42Q&A
related talks
41mWill Large-Scale Automated Scanning Stop Malware on OSS Repositories?
25mBad actors vs our community: detecting software supply chain...
24mDetección automatizada de archivos maliciosos en el repositorio PyPI
20mMalicious Needle in a Haystack - PyPi Security Pitfalls
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
18mMalicious Needle in a Haystack – PyPi Security Pitfalls
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
19mFlipping the script on application security