What are Weak Links in the npm Supply Chain?

Abstract

Modern software development frequently uses third-party packages, raising the concern of supply chain security attacks. Many attackers target popular package managers, like npm, and their users with supply chain attacks. In 2021 there was a 650% year-on-year growth in security attacks by exploiting Open Source Software's supply chain. Proactive approaches are needed to predict package vulnerability to high-risk supply chain attacks.The goal of this work is to help software developers and security specialists identify weak links in a software supply chain by empirically studying npm package metadata.In this paper, we analyzed the metadata of 1.63 million JavaScript npm packages. We propose six signals of a security weakness in a software supply chain, such as the presence of install scripts, maintainer accounts associated with an expired email domain, and inactive packages with inactive maintainers. Our analysis identified 11 malicious packages from the install scripts signal. We also found 2,818 maintainer email addresses associated with expired domains, allowing an attacker to hijack 8,494 packages by taking over the npm accounts. We obtained feedback on our weak link signals through a survey responded to by 470 npm package developers. The majority of the developers supported three out of our six proposed weak link signals. The developers also indicated that they would want to be notified about weak links signals before using third-party packages. Additionally, we discussed eight new signals suggested by package developers.

Are your dependencies code reviewed?: Measuring code review coverage in dependency updates

“…We collected the data for these three registries at the end of December 2021. For NPM, we use the dataset from [40] that was constructed in August 2021. While the download count can be inflated in different ways, including through CI/CD tooling, sampling the most downloaded packages to study a package ecosystem is an established approach [16,37] and provides an estimation of the most used packages in a registry.…”

“…Supply chain security: Recent works have focused on the secure use of open source dependencies as part of the software supply chain [24,31,40,41]. Duan et al have proposed static and dynamic analysis approaches to detect malicious packages for the interpreted languages [19], while Sejfia et al have proposed machine learning models to detect malicious npm packages [33].…”

“…Zimmermann et al [41] and Liu et al [27] have looked at the vulnerability propagation in the npm ecosystem, while Alfadel et al [14] have investigated the PyPI ecosystem. Similarly, Zahan et al [40] and Bommarito et al [16] have looked at various quality issues in the npm and PyPI ecosystems, respectively. Further, Imtiaz et al [23] have looked at how packages release security fixes with an ecosystem-wide analysis for seven package registries.…”

“…While the existence of malicious packages in different ecosystems is well-known [31], popular packages from reliable sources can also be compromised, such as through: (1) hijacking of a maintainer's account; (2) a maintainer going rogue; (3) account handover through social engineering; and (4) build system compromise. [31,40] Therefore, practitioners are now recommended to review dependency updates before merging them into the codebase [3,39], as the responsibility of security lies on the consumer when using free open-source code [38]. However, manually reviewing all the code changes in each update may not be a practical solution, as projects may have hundreds of direct and transitive dependencies [24,34].…”