Carding 4 Carders
Professional
The OpenSSF proxy will track malicious development packages.
In response to the growing number of malicious open source packages, the Open Source Security Foundation (OpenSSF) has launched an initiative called the Malicious Packages Repository. Since its launch, the repository has already accumulated more than 15,000 malicious package reports, using data from package analysis systems from OpenSSF, Checkmarx, and GitHub.
Malicious packages are a type of malware that is passed off as open packages and published in popular repositories such as PyPI and NPM. Packages are used to attack developers or organizations that install and run them. Infection can also affect the software supply chain. Consequences can include unauthorized access, data leakage, and even data destruction.
In recent months, developers have faced a number of cyber attacks using packages. For example, in early October, researchers from ReversingLabs discovered a malicious package in the NPM repository containing a Trojan for Discord with rootkit functionality. The malware, called DiscordRAT 2.0, is a ready-made hacking tool that is ideal for novice hackers.
Also, Checkmarx researchers in June revealed a campaign in which cybercriminals found a way to inject their malicious code into npm packages without changing the source code . Hackers used AWS S3 buckets, which were abandoned by their owners, and replaced them with binary files necessary for the packages to work.
The OpenSSF package Analysis project was created to detect malicious packages as soon as they appear. The approach is to download, install, and execute packages from widely used open source repositories when they are released. During the process, commands and network traffic are carefully monitored. Malicious Packages Repository eliminates the problem of a variety of approaches to handling malicious packages in different repositories by providing a combined public resource.
Reports in the Malicious Packages Repository are issued in the Open Source Vulnerability (OSV) format, which is used to indicate vulnerabilities in open source projects.
OpenSSF's Malicious Packages Repository is designed to strengthen supply chain security by providing the community with the necessary tools to protect against malicious packages and ensure software security.
In response to the growing number of malicious open source packages, the Open Source Security Foundation (OpenSSF) has launched an initiative called the Malicious Packages Repository. Since its launch, the repository has already accumulated more than 15,000 malicious package reports, using data from package analysis systems from OpenSSF, Checkmarx, and GitHub.
Malicious packages are a type of malware that is passed off as open packages and published in popular repositories such as PyPI and NPM. Packages are used to attack developers or organizations that install and run them. Infection can also affect the software supply chain. Consequences can include unauthorized access, data leakage, and even data destruction.
In recent months, developers have faced a number of cyber attacks using packages. For example, in early October, researchers from ReversingLabs discovered a malicious package in the NPM repository containing a Trojan for Discord with rootkit functionality. The malware, called DiscordRAT 2.0, is a ready-made hacking tool that is ideal for novice hackers.
Also, Checkmarx researchers in June revealed a campaign in which cybercriminals found a way to inject their malicious code into npm packages without changing the source code . Hackers used AWS S3 buckets, which were abandoned by their owners, and replaced them with binary files necessary for the packages to work.
The OpenSSF package Analysis project was created to detect malicious packages as soon as they appear. The approach is to download, install, and execute packages from widely used open source repositories when they are released. During the process, commands and network traffic are carefully monitored. Malicious Packages Repository eliminates the problem of a variety of approaches to handling malicious packages in different repositories by providing a combined public resource.
Reports in the Malicious Packages Repository are issued in the Open Source Vulnerability (OSV) format, which is used to indicate vulnerabilities in open source projects.
OpenSSF's Malicious Packages Repository is designed to strengthen supply chain security by providing the community with the necessary tools to protect against malicious packages and ensure software security.
