OpenSSF Releases Malicious Packages Repository
Written by Alex Denham   
Thursday, 26 October 2023

The OpenSSF Package Analysis team has released a Malicious Packages repository, which they describe as an open source system for collecting and publishing cross-ecosystem reports of malicious packages.

The OpenSSF says they've developed the repository in response to increasing attacks that include malicious open source packages. The hope is that a centralized repository for shared intelligence could alert the community to attacks and help clarify what threats are out there.

openssf

 

Malicious packages in this context are malware that is delivered as an open source package and published to a package repository, such as PyPI or NPM. The packages are then used to attack the developers or companies that unwittingly install and run them.

The Package Analysis project aims to find malicious packages as soon as possible by downloading, installing and executing packages from popular open source package repositories as they are published. As the packages are run, the software captures executed commands and analyze network traffic to work out if the package is acting maliciously. If it is, a report is generated and published to the new Malicious Packages repository.

The repository will also create a public database that aggregates reports of malicious packages with the aim of stopping malicious dependencies from moving through CI/CD pipelines, and scanning for and preventing their use. The reports in the Malicious Packages repository use the Open Source Vulnerability (OSV) JSON format. This makes it is possible to make use of existing integrations, including the osv.dev API, the osv-scanner tool, and deps.dev.

The repository already has over 15,000 reports of malicious packages, with current data being sourced from the OpenSSF Package Analysis project, Checkmarx security and exports of malicious packages tracked by GitHub.

openssf

 

More Information

OpenSSF Malicious Packages Repository

Related Articles

Taking Open Source Criticality Seriously

The State Of Secure Software Development - Three OpenSSF Courses

 

To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.

Banner


Swift 6 Improves Linux Support
23/09/2024

Apple has released Swift 6, with improvements to support for writing concurrent code, specifically a new, optional language mode that analyzes your code at compile-time and diagnoses possible data rac [ ... ]



Apache Iceberg Rust Released
09/09/2024

Apache has released version 0.3 of Iceberg-rust, an official Rust implementation of the Iceberg high-performance format for huge analytic tables.


More News

kotlin book

 

Comments




or email your comment to: comments@i-programmer.info