OpenSSF Launches Malicious Packages Repository

The repository has already amassed over 15,000 reports of malicious packages, drawing data from various sources, including the OpenSSF Package Analysis project, Checkmarx security, and exports of malicious packages tracked by GitHub.

In a bid to counter the increasing threat of malicious open source packages, the Open Source Security Foundation (OpenSSF) has introduced a new initiative called the Malicious Packages Repository. This repository could turn out to be a major player in the fight against malicious code and is aimed at enhancing the security and integrity of open source software ecosystems.

****A Response to Growing Threats****

The launch of the Malicious Packages Repository comes at a time when cyberattacks, leveraging malicious open source packages, are on the rise. For instance, the Lazarus Group, a notorious North Korean state-backed hacking entity, recently targeted the blockchain and cryptocurrency sectors, employing cunning tactics that included deceptive npm packages to infiltrate various software supply chains.

According to crypto security experts at Immunefi, the crypto industry lost $685 million in Q3 2023, with 30% of those funds being stolen by the Lazarus Group. In such a scenario, a centralized repository for shared intelligence could have acted as an early warning system, allowing the global community to thwart such attacks more swiftly.

****Decoding the Menace: What Is a Malicious Package?****

Malicious packages are a form of malware that poses as open source packages and are subsequently published to popular package repositories like PyPI and NPM. While vulnerable code possesses unintentional weaknesses that can be exploited, malicious code is sophisticatedly crafted with the intent to harm or compromise its targets.

These malicious packages are used to attack unsuspecting developers or organizations that install and run them. The repercussions can range from unauthorized access and data leaks to excessive resource consumption and data destruction, with most endpoint antivirus software ill-equipped to detect these intricate attack vectors.

****A Look at Recent Attacks****

In a span of recent months, developers have been targeted by a string of malicious attacks. On October 5th, an NPM Typosquatting attack deployed the r77 rootkit via legitimate packages. Just a few days earlier, on October 2, FortiGuard Labs uncovered a series of malicious NPM packages specifically designed to steal data.

In late August, the developer community was shaken when the Luna Grabber malware exploited vulnerabilities through npm packages, particularly affecting those working on Roblox. On August 6th, the VMCONNECT malicious PyPI package was added to the growing list of threats, expertly mimicking common Python tools.

These incidents underscore the growing risks encountered by developers, emphasizing the necessity for robust security measures within the software development ecosystem. This further underscores the importance of having OpenSSF’s Malicious Packages Repository.

****The Package Analysis Project: Vigilance in Action****

OpenSSF’s Package Analysis project was conceived to detect malicious packages as soon as they emerge. This proactive approach involves downloading, installing, and executing packages from widely-used open source package repositories as they are released. During this process, executed commands and network traffic are thoroughly monitored.

Additionally, a set of stringent rules is then applied to scrutinize the package’s behaviour, distinguishing between legitimate and malicious actions. In cases where a package exhibits malicious intent, a detailed report is generated and subsequently published in the new Malicious Packages Repository.

****Unifying the Response****

The handling of malicious packages currently varies from one open source package repository to another. Typically, when a community member reports a malicious package, the repository’s security team removes the package and its related metadata.

Unfortunately, these actions are often executed without any public record, making it challenging to discover the extent of malicious packages in circulation. The Malicious Packages Repository fills this information void by establishing a comprehensive public database that aggregates reports of malicious packages discovered across open source repositories.

This invaluable resource has the potential to intercept malicious dependencies in their tracks, enhance detection mechanisms, scan for and prevent usage in various environments, and expedite incident response.

****Leveraging the OSV Format****

In a blog post published by OpenSSF on October 12th, 2023, reports in the Malicious Packages Repository are formatted using the Open Source Vulnerability (OSV) format, which is employed for specifying vulnerabilities in open source projects.

By utilizing the OSV format for malicious packages, it becomes feasible to integrate existing tools and services, including the osv.dev API, the osv-scanner tool, and deps.dev. This format is also customizable, allowing for the inclusion of additional data such as indicators of compromise or classification details.

Henrik Plate, a security researcher at application security startup, Endor Labs says it is great to see an open source project address this problem for a larger variety of ecosystems. This supports all the existing efforts of academic and corporate security researchers to secure the open source ecosystem.

“For academic researchers, in particular, it offers a nice opportunity to explore and test new approaches to malware detection without being required to redo the basic plumbing over and over again, e.g. the monitoring of new package publications on various package registries like PyPI or npm,” he added. “Thankfully, this part is covered by the associated OpenSSF package-feeds project, which goes hand in hand with the OpenSSF package–analysis project to populate the database mentioned in the blog post.

****15,000 Reports Already****

Remarkably, the repository has already amassed over 15,000 reports of malicious packages, drawing data from various sources, including the OpenSSF Package Analysis project, Checkmarx security, and exports of malicious packages tracked by GitHub.

Nonetheless, the Malicious Packages Repository by OpenSSF serves as a stronghold of collective protection, arming the open source community with the necessary tools and know-how to shield against harmful intrusions, safeguard software integrity, and fortify the core of open source development.