Open source 'Package Analysis' tool finds malicious npm, PyPI packages
By Ax Sharma, Bleeping Computer The Open Source Security Foundation (OpenSSF), a Linux Foundation-backed initiative has released its first prototype version of the 'Package Analysis' tool that aims to catch and counter malicious attacks on open source registries. In a pilot run that lasted less than a month, the open source project released on GitHub, was able to identify over 200 malicious npm and PyPI packages. Project aims to combat malware in open source registries This week, OpenSSF released its initial prototype version of the 'Package Analysis' project on GitHub. The project repository contains tools that analyze open source packages, particularly, to hunt for malicious npm and PyPI packages. "The Package Analysis project seeks to understand the behavior and capabilities of packages available on open source repositories: what files do they access, what addresses do they connect to, and what commands do they run?" explain Caleb Brown and David A. Wheeler...