A Survey on Common Threats in npm and PyPi Registries

Taxonomy of Attacks on Open-Source Software Supply Chains

“…A comparable feature is not present in most compiled languages, like Java, C/C++ or Ruby. In such cases, Integrity check of dependencies through cryptographic hashes [9], [36], [83], [109], [131], [135], [138] 3.3 3.0 2.5 2.0 1.32 Y N 2.3 2.0 Maintain detailed SBOM [5], [8], [53], [183], [184] and perform SCA [8], [31], [43], [48], [51], [53], [55] [42], [123], [185] Code signing [47], [83], [109], [135], [138], [141] Application Security Testing [34], [39], [41], [46], [55], [56], [58], [66], [80], [122], [134], [187] 4 execution is achieved either at runtime, e.g., by embedding the payload in a specific function or initializer, or by poisoning test routines [19]. Differences also exist in regards to code obfuscation and malware detection.…”

“…They provide an overview of stakeholders (and their relationships) in those package manager ecosystems, but do not specifically cover VCS and build systems. Also Kaplan et al [66] present the state of the art of threats in package repositories and describe -also experimental -countermeasures from the scientific literature.…”

“…(AV-000) Conduct Open-Source Supply Chain Attack SL: [18], [19], [31]- [56] (AV-100) Develop and Advertise Distinct Malicious Package from Scratch SL: [16], [19], [57], [58] GL: [59]- [65] (AV-200) Create Name Confusion with Legitimate Package SL: [16], [58], [66], [67] GL: [68]- [70] (AV-201) Combosquatting SL: [71] GL: [72], [73] (AV-202) Altering Word Order SL: [74] (AV-203) Manipulating Word Separators SL: [74] (AV-204) Typosquatting SL: [15], [71], [74]- [76] GL: [77], [78] (AV-205) Built-In Package SL: [74] GL: [79] (AV-206) Brandjacking SL: [74] (AV-207) Similarity Attack SL: [71] (AV-001) Subvert Legitimate Package (AV-300) Inject into Sources of Legitimate Package SL: [19], [80]- [85] (AV-301) Introduce Malicious Code through Hypocrite Merge Request SL: [11], [85]- [87] GL: [88] (AV-304) Make Immature Vulnerability Exploitable SL: [11], [89] GL: [88] (AV-305) Exploit Rendering Weakness SL: [10] (AV-306) Exploit Unicode Bidirectional Algorithm SL: [10] GL:…”

Challenges of mapping Vulnerabilities and Exposures to Open-Source Packages

“…5 Besides the ID and the summary of the vulnerability, a CVE entry provides relevant references (e.g., Github documentation as in Figure 2), an assessment of the severity of the vulnerability using the Common Vulnerability Scoring System (CVSS), 6 and the Common Weakness Enumeration (CWE) taxonomy of weakness types. 7 Additionally, the CVE entry provides Common Platform Enumerations (CPE) [3] version 2.3 string, which is a standard for identifying classes of applications, operating systems/platforms, as well as hardware information. The CPE string consists of various fields providing information such as the software name, vendor as well as the target software, which contains the software computing environment (e.g.…”

What the Fork? Finding and Analyzing Malware in GitHub Forks

“…Our work falls into the area of supply chain attacks, where threat actors introduce malware backdoors into software components that are used by developers. Kaplan et al [7] examined the attack vectors that can be carried out against package dependency registries, such as typosquatting package names and exploiting outdated dependencies. Duan et al [8] take this further by implementing an analysis pipeline that found 278 malicious dependencies across three registries.…”