ashishbijlani
Joined 11 years ago
Karma
220
Submissions
129
Member since
Jul 9
Recent submissions
Comment · 3 months ago
I've been building an OSS tool to detect software supply-chain attacks: https://github.com/ossillate-inc/packj
Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect impersonating packages (typo squatting).
Comment · 5 months ago
Built Packj [1] to audit dependencies easily from CLI.
1. Packj (https://github.com/ossillate-inc/packj) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).
Comment · 6 months ago
Built Packj [1] to do exactly this.
1. Packj (https://github.com/ossillate-inc/packj) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).
Comment · 9 months ago
This is a great initiative. Thanks for sharing! I will use it to create my personal cache of package registries (beyond obvious advantages of caching, it can also mitigate typo-squatting attacks).
BTW, if there's an interest, I'd love to collaborate and integrate Packj [1] audit for malware scans.
1. Packj (https://github.com/ossillate-inc/packj) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).
Comment · 1 year ago
I’m extending Packj sandbox for agentic code execution [1]. You can specify allowlist for network/fs.
1. https://github.com/ossillate-inc/packj/blob/main/packj/sandb...
Comment · 1 year ago
Plug: I've been building a tool to detect software supply-chain cyberattacks: https://github.com/ossillate-inc/packj
Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect impersonating packages (typo squatting).
Comment · 1 year ago
Packj [1] detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).
Comment · 1 year ago
Plug: I've been building a similar tool: https://github.com/ossillate-inc/packj
Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect impersonating packages (typo squatting).
Comment · 1 year ago
Hi Abhishek, the backtracking feature looks super useful. Congrats on launching!
Comment · 1 year ago
Not for contributions only, but developing ExtFUSE [1] got me a lot of offers and consulting work.
1. https://github.com/extfuse/extfuse optimizes FUSE with eBPF
Comment · 1 year ago
> If the tech is open-sourced, then an attacker can keep trying in private until they find an exploit, and then use it.
So you'd rather assume that if something is obscure, it is secure?
Comment · 1 year ago
We scan PyPI packages regularly for malware to provide a private registry of vetted packages.
The tech is open-sourced: Packj [1]. It uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect impersonating packages (typo squatting).
Comment · 1 year ago
This is exactly why I'm building Packj audit [1]. It detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).
Comment · 1 year ago
Good to see Packj[1] as one of the malware scanners used.
1. https://github.com/ossillate-inc/packj
Packj detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).
Building https://packj.dev - a security firewall for your open-source dependencies to protect against typo-squatting, dependency confusion, and Solarwinds-like supply-chain attacks: https://github.com/ossillate-inc/packj
Creator of ExtFUSE (eBPF + FUSE) and SandFS [available for consulting]: https://github.com/extfuse/extfuse https://github.com/sandfs/sandfs.github.io
https://twitter.com/ashishbijlani https://www.linkedin.com/in/ashishbijlani/
first.last@<popular-google-service.com>