News for hackers. Stuff that matters.

A comment on A Study of Malicious Code in PyPI Ecosystem. Parent comment

Re:A Study of Malicious Code in PyPI Ecosystem by thenerdhead on Sunday September 10, 2023 @05:50PM (#37460435)
Cool project. How do you feel about projects like OpenSSF scorecards or even the checks that socket.dev do today on these packages to help determine risk?

https://github.com/ossillate-inc/packj/blob/main/.packj.yaml

Secondly, what about impersonation where attackers imitate a popular package and its respective metadata?

[ Parent | on HN ]
Re:A Study of Malicious Code in PyPI Ecosystem by ashishbijlani on Sunday September 10, 2023 @09:19PM (#37461747)
Thanks! We need more such efforts to improve supply-chain security of open-source software.

Packj detects typo-squatting (impersonation) as well.

[ Parent | on HN ]