04 - Open Source Malware and Typosquatting

Detecting Malicious Packages

Attackers often attempt to compromise developer machines or CI servers by publishing malicious packages.

Typosquatting: Attackers publish packages with names very similar to popular libraries (e.g., reqeusts instead of requests, electorn instead of electron). If a developer makes a typo during npm install or pip install, they download the malware.

Dependency Confusion: Attackers publish a package to a public registry (like npm or PyPI) with the exact same name as an internal, private package used by a company. If the company's package manager is misconfigured, it might prioritize the public (malicious) package over the private one, especially if the public version number is higher.

Protection Strategies

API Integration: Socket.dev and OSV.dev

Instead of just checking for known CVEs (which require someone to first discover and report the vulnerability), modern tools look for suspicious behavior in dependencies.

• Socket.dev: Analyzes open source packages to detect malware, typosquatting, hidden code, and suspicious behaviors (e.g., trying to read /etc/shadow or opening a reverse shell upon installation).
• OSV.dev: The Open Source Vulnerability database API. It provides a distributed, queryable database of vulnerabilities across ecosystems.

You can integrate OSV scanning in your pipeline:

# Using OSV-Scanner
osv-scanner -r .

Build Script Isolation (ignore-scripts)

Many package managers allow dependencies to run arbitrary shell scripts during installation (e.g., npm postinstall scripts). This is a massive security risk, as malware often uses this vector to execute payloads the moment the package is installed, before the code is even run.

Hardening NPM: Disable install scripts globally on developer machines and in CI unless explicitly needed.

In .npmrc:

ignore-scripts=true

If a specific package must run a script (e.g., to compile a C++ extension), you can temporarily override the setting or use tools like lavamoat or allow-scripts to selectively permit specific packages while blocking all others.