Ask HN: How do you check for malware in OSS packages?

https://news.ycombinator.com/item?id=20002881

by riyakhanna1983 • 7 years ago

7 7 7 years ago

news.ycombinator.com

What tools would you suggest to scan for malicious packages or dependencies?

riyakhanna19833• 7 years ago

What tools have you been using to scan NPM/Python/Ruby/Go packages for malicious dependencies? How do I know if one of the dependencies in my package is not going to steal my NPM credentials, for example?

shoo• 7 years ago

Maybe some ideas here: httpss://www.owasp.org/index.php/Source_Code_Analysis_Tools

At work we use a commercial tool for static analysis. From what I have seen it is rather stupid, it produces a lot of false positive security issues about things like allocating memory (potential resource exhaustion vulnerability...)

You also probably want to pin versions of all dependencies, and store them in a repository that you control access to (a good idea for reproducibility, ignoring security).

riyakhanna19833• 7 years ago

I've had the same experience with existing SAST tools.

relaunched2• 7 years ago

SAST tools take a lot of work to get up and running. If you're just running them out of the box, you're probably doing it wrong.

avichalp• 7 years ago

If you are looking for something that helps you keep your OSS packages secure, then Snyk[0] is doing an excellent job at it.

[0] https://snyk.io

riyakhanna19833• 7 years ago

Snyk only checks for known vulnerabilities, not if the package itself is malicious.

relaunched2• 7 years ago

There are open source tools for CVE checking, which is a good start, there are also commercial alternatives like Whitesource. CSP headers can help. So is only using packages that are actively updated.

Ask HN: How do you check for malware in OSS packages?

Related Stories