Paper: building from source stops most npm and PyPI malware
Original title: Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain
A source check blocked 87.7 to 99.9 percent of 47,066 malicious packages, depending on how strictly the source was vetted.
A cs.CR paper tests whether skipping package registries and building directly from source reduces supply-chain malware on npm and PyPI. The authors assembled 47,066 malicious packages, indexed 3.9 million npm and 764 thousand PyPI packages, and compared malicious samples with 16,569 packages from each registry. They report that requiring an attributable source prevents most malware in their sets, while only 47.4 percent of benign packages expose a source an end user could build from. Shai-Hulud and the Axios compromise are cited as registry incidents.
Unconfirmed: Prevention rates are the authors’ measurements and vary with the source-vetting level they applied.
- Malicious data came from four academic datasets and one industry dataset.
- The benign sample totals 33,138 packages across both registries.
- Authors compare building from source with security scanners.
- They hypothesize malicious packages avoid linking a repository to limit visibility.
- Malware
- Shai-Hulud
From the original article
1 min read at arxiv.orgSoftware supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the Shai-Hulud worm and the Axios compromise demonstrate that a single malicious package can have wide reaching and devastating impacts overnight. These high profile attacks can be traced back to the same culprit: package registries.
By Derek Garcia · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.