Security News > 2022 > May > Here's a New Tool That Scans Open-Source Repositories for Malicious Packages

The Open Source Security Foundation has announced the initial prototype release of a new tool that's capable of carrying out dynamic analysis of all packages uploaded to popular open source repositories.

Called the Package Analysis project, the initiative aims to secure open-source packages by detecting and alerting users to any malicious behavior with the goal of bolstering the security of the software supply chain and increasing trust in open-source software.

"The Package Analysis project seeks to understand the behavior and capabilities of packages available on open source repositories: what files do they access, what addresses do they connect to, and what commands do they run?," the OpenSSF said.

In a test run that lasted a month, the tool identified more than 200 malicious packages uploaded to PyPI and NPM, with a majority of the rogue libraries leveraging dependency confusion and typosquatting attacks.

Google, which is a member of OpenSSF, has also rallied its support behind the Package Analysis project, while emphasizing the need for "Vetting packages being published in order to keep users safe."

The tech giant's Open Source Security Team, last year, put forth a new frame called Supply chain Levels for Software Artifacts to ensure the integrity of software packages and prevent unauthorized modifications.

News URL

https://thehackernews.com/2022/05/heres-new-tool-that-scans-for-malicious.html