The OpenSSF (Open Source Security Foundation), formed by the Linux Foundation and aimed at enhancing the security of open source software, has published a new edition of the Census II study, focused on identifying open projects that require priority security audits. The study targets the analysis of shared open code, implicitly used in various corporate projects as dependencies downloaded from external repositories.
As a result, lists of the 500 most commonly used packages have been prepared, whose security and maintenance quality require special attention, as vulnerabilities and compromises of third-party component developers involved in application operations (supply chain) can undermine all efforts to improve the security of the core product. In total, 8 variations of lists are proposed, with content ranked according to various criteria, such as supply from the NPM repository and the availability of version information when determining dependencies.
10 most commonly used JavaScript packages from the NPM repository, downloaded by applications without version binding:
- lodash
- react
- axios
- debug
- @babel/core
- express
- semver
- uuid
- react-dom
- jquery
10 most commonly used Python packages in dependencies, distributed via the pypi repository:
- six
- pyyaml
- requests
- urllib3
- jinja2
- python-dateutil
- click
- idna
- chardet
- markupsafe
10 most commonly used Ruby packages in dependencies, distributed via the RubyGems repository:
- bouncy-castle-java
- awssdk
- rally-jasmine-core
- aws-sdk
- nunit
- cscsl
- highcharts-js-rails
- antlr3
- rspec
- asmine
10 most commonly used Java packages in dependencies, distributed via the Maven repository:
- org.slf4j:slf4j-api
- com.fasterxml.jackson.core:jackson-databind
- com.google.guava:guava
- com.fasterxml.jackson.core:jackson-core
- org.springframework:spring-framework-bom
- com.fasterxml.jackson.core:jackson-annotations
- commons-io:commons-io
- junit:junit
- org.apache.commons:commons-lang3
- commons-codec:commons-codec
10 most commonly used .NET packages in dependencies, distributed via the nuget repository:
- json.net
- modernizr
- newtonsoft.json
- castle.core-log4net
- newtonsoft.json
- castle.core-log4net
- freqsystemdependencies
- microsoft.extensions.caching.memory
- microsoft.extensions.dependencyinjection.abstractions
10 most commonly used packages in dependencies for the Go language:
- grpc/grpc-go
- kubernetes/client-go
- kubernetes/apimachinery
- kubernetes/api
- stretchr/testify
- kubernetes/klog
- pkg/errors
- spf13/cobra
- x/net
- prometheus/client_golang
Source: opennet.ru
