Ask HN: How do you check for malware in OSS packages?

Re:Ask HN: How do you check for malware in OSS packages? by shoo on Friday May 24, 2019 @08:07PM (#20006314)

Maybe some ideas here: httpss://www.owasp.org/index.php/Source_Code_Analysis_Tools

At work we use a commercial tool for static analysis. From what I have seen it is rather stupid, it produces a lot of false positive security issues about things like allocating memory (potential resource exhaustion vulnerability...)

You also probably want to pin versions of all dependencies, and store them in a repository that you control access to (a good idea for reproducibility, ignoring security).

[ Parent | on HN ]

Re:Ask HN: How do you check for malware in OSS packages? by relaunched on Sunday May 26, 2019 @05:14PM (#20017562)

SAST tools take a lot of work to get up and running. If you're just running them out of the box, you're probably doing it wrong.

[ Parent | on HN ]

Re:Ask HN: How do you check for malware in OSS packages? by riyakhanna1983 on Saturday May 25, 2019 @04:36PM (#20011244)

I've had the same experience with existing SAST tools.

[ Parent | on HN ]