The OpenSSF Package Analysis team has released a Malicious Packages repository, which they describe as an open source system for collecting and publishing cross-ecosystem reports of malicious packages.

The OpenSSF says they've developed the repository in response to increasing attacks that include malicious open source packages. The hope is that a centralized repository for shared intelligence could alert the community to attacks and help clarify what threats are out there.

Malicious packages in this context are malware that is delivered as an open source package and published to a package repository, such as PyPI or NPM. The packages are then used to attack the developers or companies that unwittingly install and run them.

The Package Analysis project aims to find malicious packages as soon as possible by downloading, installing and executing packages from popular open source package repositories as they are published. As the packages are run, the software captures executed commands and analyze network traffic to work out if the package is acting maliciously. If it is, a report is generated and published to the new Malicious Packages repository.

The repository will also create a public database that aggregates reports of malicious packages with the aim of stopping malicious dependencies from moving through CI/CD pipelines, and scanning for and preventing their use. The reports in the Malicious Packages repository use the Open Source Vulnerability (OSV) JSON format. This makes it is possible to make use of existing integrations, including the osv.dev API, the osv-scanner tool, and deps.dev.

The repository already has over 15,000 reports of malicious packages, with current data being sourced from the OpenSSF Package Analysis project, Checkmarx security and exports of malicious packages tracked by GitHub.

More Information

OpenSSF Malicious Packages Repository

Related Articles

Taking Open Source Criticality Seriously

The State Of Secure Software Development - Three OpenSSF Courses

To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.

Comments

Make a Comment or View Existing Comments Using Disqus

or email your comment to: comments@i-programmer.info