Found 6 bookmarks
Custom sorting
Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages
Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages
Despite open source software’s essential role in all software built today, it’s far too easy for bad actors to circulate malicious packages that attack the systems and users running that software. Unlike mobile app stores that can scan for and reject malicious contributions, package repositories have limited resources to review the thousands of daily updates and must maintain an open model where anyone can freely contribute. As a result, malicious packages like ua-parser-js, and node-ipc are regularly uploaded to popular repositories despite their best efforts, with sometimes devastating consequences for users.
·security.googleblog.com·
Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages
Introducing Package Analysis: Scanning open source packages for malicious behavior
Introducing Package Analysis: Scanning open source packages for malicious behavior
Today we’re pleased to announce the initial prototype version of the Package Analysis project, an OpenSSF project addressing the challenge of identifying malicious packages in popular open source repositories. In just one month of analysis, the project identified more than 200 malicious packages uploaded to PyPI and npm.
·openssf.org·
Introducing Package Analysis: Scanning open source packages for malicious behavior
Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages
Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages
Despite open source software’s essential role in all software built today, it’s far too easy for bad actors to circulate malicious packages that attack the systems and users running that software. Unlike mobile app stores that can scan for and reject malicious contributions, package repositories have limited resources to review the thousands of daily updates and must maintain an open model where anyone can freely contribute. As a result, malicious packages like ua-parser-js, and node-ipc are regularly uploaded to popular repositories despite their best efforts, with sometimes devastating consequences for users.
·security.googleblog.com·
Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages
Introducing Package Analysis: Scanning open source packages for malicious behavior
Introducing Package Analysis: Scanning open source packages for malicious behavior
Today we’re pleased to announce the initial prototype version of the Package Analysis project, an OpenSSF project addressing the challenge of identifying malicious packages in popular open source repositories. In just one month of analysis, the project identified more than 200 malicious packages uploaded to PyPI and npm.
·openssf.org·
Introducing Package Analysis: Scanning open source packages for malicious behavior
Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages
Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages
Despite open source software’s essential role in all software built today, it’s far too easy for bad actors to circulate malicious packages that attack the systems and users running that software. Unlike mobile app stores that can scan for and reject malicious contributions, package repositories have limited resources to review the thousands of daily updates and must maintain an open model where anyone can freely contribute. As a result, malicious packages like ua-parser-js, and node-ipc are regularly uploaded to popular repositories despite their best efforts, with sometimes devastating consequences for users.
·security.googleblog.com·
Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages
Introducing Package Analysis: Scanning open source packages for malicious behavior
Introducing Package Analysis: Scanning open source packages for malicious behavior
Today we’re pleased to announce the initial prototype version of the Package Analysis project, an OpenSSF project addressing the challenge of identifying malicious packages in popular open source repositories. In just one month of analysis, the project identified more than 200 malicious packages uploaded to PyPI and npm.
·openssf.org·
Introducing Package Analysis: Scanning open source packages for malicious behavior