Open Source Summit Europe 2022

From a benign left-pad beginning to recent protestware, software supply chain attacks on open-source package managers such as NPM and PyPI have grown manifold. Bad actors today leverage highly sophisticated techniques such as typo-squatting, repo-jacking, and social engineering to "supply" malicious dependencies. Yet, there is no robust way to measure such risks.

This talk will present PACKJ, an open-source data-driven tool to score dependencies and measure the level of potential supply chain risks. It checks for several risky code/metadata attributes that indicate malware or make a package vulnerable to typo-squatting, account hijacking attacks. These attributes are empirically identified in our study of 651 publicly documented malicious packages. Risk scores can be customized to match the threat model. Using PACKJ, we have already identified several abandoned and malicious packages. This presentation will include a brief demo and highlight our findings.