What are Weak Links in the npm Supply Chain? · HackerPapers discussions

What are Weak Links in the npm Supply Chain? — mentioned by lrvick

Mon, 19 Sep 2022 23:34:18 GMT

FWIIW I advocated for external review of security critical dependencies and hired external firms for this long before I started my own firm. The ROI is not having your company ended by someone malicious that reviewed that code before someone acting in your interest does. That said, I normally work with companies that -really- need users to trust their security practices so this can become a sales and marketing win. When competitors are forced to admit they do not review the code that handles customer data or money, and you do because it is obviously the responsible thing to do... it helps…

Paper and discussion history. A mention is not an endorsement.

What are Weak Links in the npm Supply Chain? — mentioned by feross

Mon, 11 Apr 2022 19:55:15 GMT

This is a fair question. The answer is that most malware behaves in ways that are deterministically detectable. For example, 93% of malware uses install scripts, which must be declared in the package.json file and are not possible to hide from our analysis. From recent research: > We found 93.9% (3,412) of malicious packages had at least one install scripts, indicating that malicious attackers use install scripts frequently [1] When malware authors adapt and start doing fancy dynamic stuff, we might not be able to figure out exactly what they're doing, but we can detect the usage of…

Paper and discussion history. A mention is not an endorsement.

What are Weak Links in the npm Supply Chain? — HN submission

Sun, 27 Mar 2022 05:50:03 GMT

What are Weak Links in the NPM Supply Chain? [pdf]

1 point; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.