Hacker News Reader

Comment by dgellow | Hacker News Reader

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup?

We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and given we are still tiny dealing with a large amount of false positive (that was the case with snyk) is a pain. Just curious how others are dealing with this.

View on HN

We tend to avoid using github repos, but go for published packages from the usual sites; Nuget, Pypi, Npm etc, using Repository and Firewall from Sonatype to act as a proxy between us and the package repos. All packages are analyzed and tagged with various metadata by Sonatype. Firewall lets us define policies for what we can use, and will filter out everything else.

This only works for published dependencies, but based on a couple years experience it works really well. No issues with malware (so far), we don't let packages with known vulns into our codebases and we are notified if a vuln is discovered in something we use.

We use Semgrep Supply Chain at work and are reasonably satisfied with it. It splits the supply chain vulnerabilities it found into the categories: reachable, unreachable and undetermined. This makes triaging much easier and it has reduced the time we spent on assessing new vulnerabilities by quite a lot.

There seems to be a lot of confusion between malware and vulnerabilities. None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities.

Good as they'll be in detecting vulnerabilities, you are still unprotected from malicious code planted in your code bases.

> None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities

Sonatype does if you pay $$$ for Firewall, but that only catches things installed via a package manager.

I’ve been building an open-source tool Packj [1] to detect publicly malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as spawning of shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages.

1. https://github.com/ossillate-inc/packj

You may look into Trivy [0] , works very well for me so far.

[0] https://trivy.dev/

As far as I know, Trivy only flags known vulnerabilities and would not protect against supply-chain attacks like this.

Trivy only do a CVE / package version mapping. It will not tell you you are using a malicious package from an unknown repo because of typosquatting or bad practices.

LavaMoat and @lavamoat/allowscripts (which does the opposite of it's name).

Self-hosted GitLab.

Reply on news.ycombinator.com