What the Fork? Finding and Analyzing Malware in GitHub Forks

Cao, Alan; Dolan-Gavitt, Brendan

doi:10.14722/madweb.2022.23001

Cited by 9 publications

(1 citation statement)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…b) Software repository malware detection: In the literature, many approaches attempt to identify malicious packages in package repositories such as npm or PyPI [8], [53]- [55] or in the source code repositories such as GitHub [56], [57]. Most such approaches analyze different aspects of a package using metadata [10], [29], static [14], [58]- [60], or dynamic [8], [47], [61] analysis.…”

Section: B Malware Detection In Pypi and Other Repositoriesmentioning

confidence: 99%

Bad Snakes: Understanding and Improving Python Package Index Malware Scanning

Newman

Meyers

2023

2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

Open-source, community-driven package repositories see thousands of malware packages each year, but do not currently run automated malware detection systems. In this work, we explore the security goals of the repository administrators and the requirements for deploying such malware scanners via a case study of the Python ecosystem and PyPI repository, including interviews with administrators and maintainers. Further, we evaluate existing malware detection techniques for deployment in this setting by creating a benchmark dataset and comparing several existing tools: the malware checks implemented in PyPI, Bandit4Mal, and OSSGadget's OSS Detect Backdoor.We find that repository administrators have exacting requirements for such malware detection tools. Specifically, they consider a false positive rate of even 0.1% to be unacceptably high, given the large number of package releases that might trigger false alerts. Measured tools have false positive rates between 15% and 97%; increasing thresholds for detection rules to reduce this rate renders the true positive rate useless.While automated tools are far from reaching these demands, we find that a socio-technical malware detection system has emerged to meet these needs: external security researchers perform repository malware scans, filter for useful results, and report the results to repository administrators. These parties face different incentives and constraints on their time and tooling. We conclude with recommendations for improving detection capabilities and strengthening the collaboration between security researchers and software repository administrators.

show abstract