{"id":103932,"date":"2022-05-02T15:37:01","date_gmt":"2022-05-02T13:37:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi"},"modified":"2022-05-02T15:37:01","modified_gmt":"2022-05-02T13:37:01","slug":"opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/opublikovan-analizator-vyyavivshij-200-vredonosnyh-paketov-v-npm-i-pypi","title":{"rendered":"An analyzer has been released that identified 200 malicious packages in NPM and PyPI.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The OpenSSF (Open Source Security Foundation), established by the Linux Foundation and aimed at enhancing the security of open source software, has introduced the open project Package Analysis, which develops a system for analyzing the presence of malicious code in packages. The project\u2019s code is written in Go and is distributed under the Apache 2.0 license. Preliminary scans of NPM and PyPI repositories using the proposed tooling have identified over 200 previously unnoticed malicious packages. <\/p>\n

Most of the identified problematic packages manipulate name intersections with internal, non-public project dependencies (dependency confusion attack) or use typosquatting techniques (assigning names similar to popular libraries), as well as invoke installation scripts that reach out to external hosts. According to the developers of Package Analysis, most of the detected problematic packages were likely created by security researchers participating in bug bounty programs, as the reported data is limited to user and system names, with actions being executed explicitly without attempts to conceal their behavior. <\/p>\n

The following packages exhibit malicious activity: <\/p>\n