Malicious PyPI packages stealing credit cards and injecting code

Re:Malicious PyPI packages stealing credit cards and injecti... by wiremine on Tuesday August 03, 2021 @11:01AM (#28050011)

Feels like this is a business opportunity for someone.

Use case:

1. Upload a pre-reviewed package.json file. 2. The service monitors changes, and recommends updates. Recommendations might include security, bug, features, etc. It would check downstream dependencies, too. For production systems, the team might only care about security features. 3. Developer team can review recommendations, and download the new package.json.

(There are lots of opportunities to improve this: direct integration with git, etc.)

Anybody know if this sort of service exists? I know npm has _some_ of this. Maybe I'm just ignorant of how much of a solved problem this is?

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by rank0 on Tuesday August 03, 2021 @11:05AM (#28050075)

What you’re looking for is called SCA (software composition analysis).

Best tool I’ve used so far in this domain is snyk.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by goodpoint on Tuesday August 03, 2021 @11:23AM (#28050263)

> Feels like this is a business opportunity for someone.

This is what some Linux distributions do. Quality review, legal review, security backports.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by cilefen on Tuesday August 03, 2021 @06:42PM (#28055143)

We use Renovate for this.

[ Parent | on HN ]