Ask HN: How do you check for malware in OSS packages?

Posted by riyakhanna1983 on Friday May 24, 2019 @12:01PM
from the ask-hn dept.

What tools would you suggest to scan for malicious packages or dependencies?

( 7 comments | 7 points | on HN )

Re:Ask HN: How do you check for malware in OSS packages? by shoo on Friday May 24, 2019 @08:07PM (#20006314)

Maybe some ideas here: httpss://www.owasp.org/index.php/Source_Code_Analysis_Tools

At work we use a commercial tool for static analysis. From what I have seen it is rather stupid, it produces a lot of false positive security issues about things like allocating memory (potential resource exhaustion vulnerability...)

You also probably want to pin versions of all dependencies, and store them in a repository that you control access to (a good idea for reproducibility, ignoring security).

[ Parent | on HN ]

Re:Ask HN: How do you check for malware in OSS packages? by relaunched on Sunday May 26, 2019 @05:14PM (#20017562)

SAST tools take a lot of work to get up and running. If you're just running them out of the box, you're probably doing it wrong.

[ Parent | on HN ]

Re:Ask HN: How do you check for malware in OSS packages? by riyakhanna1983 on Saturday May 25, 2019 @04:36PM (#20011244)

I've had the same experience with existing SAST tools.

[ Parent | on HN ]

Re:Ask HN: How do you check for malware in OSS packages? by relaunched on Sunday May 26, 2019 @05:17PM (#20017581)

There are open source tools for CVE checking, which is a good start, there are also commercial alternatives like Whitesource. CSP headers can help. So is only using packages that are actively updated.

[ Parent | on HN ]

Re:Ask HN: How do you check for malware in OSS packages? by riyakhanna1983 on Friday May 24, 2019 @07:04PM (#20006054)

What tools have you been using to scan NPM/Python/Ruby/Go packages for malicious dependencies? How do I know if one of the dependencies in my package is not going to steal my NPM credentials, for example?

[ Parent | on HN ]

Re:Ask HN: How do you check for malware in OSS packages? by avichalp on Saturday May 25, 2019 @03:46AM (#20007645)

If you are looking for something that helps you keep your OSS packages secure, then Snyk[0] is doing an excellent job at it.

[0] https://snyk.io

[ Parent | on HN ]

Re:Ask HN: How do you check for malware in OSS packages? by riyakhanna1983 on Saturday May 25, 2019 @04:35PM (#20011231)

Snyk only checks for known vulnerabilities, not if the package itself is malicious.

[ Parent | on HN ]