A Packj platform, which analyzes the security of libraries, has published an open command-line toolkit that allows identifying risky constructs in packages that may be related to the implementation of malicious activity or the presence of vulnerabilities used to attack projects utilizing the specified packages (supply chain). It supports package checks for Python and JavaScript languages hosted in the PyPi and NPM directories (support for Ruby and RubyGems is also planned to be added this month). The toolkit's code is written in Python and is distributed under the AGPLv3 license.
In the analysis of 330,000 packages using the proposed toolkit in the PyPi repository, 42 malicious packages with backdoors and 2.4 thousand risky packages were identified. The examination involves static code analysis to identify API features and assess the presence of known vulnerabilities listed in the OSV database. The MalOSS package is used for API analysis. The code of the packages is analyzed for the presence of typical patterns usually found in malicious software. The patterns are prepared based on the study of 651 packages with confirmed malicious activity.
Additionally, attributes and metadata that increase the risk of unintended usage are identified, such as the execution of blocks via 'eval' or 'exec', the generation of new code during execution, the use of obfuscation techniques, manipulation of environment variables, unintended file access, and requests to network resources in setup scripts (setup.py), type-squatting (assigning names similar to popular library names), identifying outdated and abandoned projects, providing non-existent emails and websites, and the lack of a public repository with the code.
Additionally, it is worth noting that other security researchers have identified five malicious packages in the PyPi repository that sent external szerver environment variable contents aimed at stealing AWS tokens and continuous integration systems: loglib-modules (posed as modules to the legitimate library loglib), pyg-modules, pygrata, and pygrata-utils (posed as extensions to the legitimate library pyg), and hkg-sol-utils.
Forrás: opennet.ru
