Google suspicious package software#

Sonatype had been persistently catching dependency confusion packages months before the news broke. Image: Dependency Confusions Packages above a given threshold per day

Combined with 3,600+ similar packages that flooded PyPI at the time, the total count of identified dependency confusion copycats was over 5,000. In total, Sonatype’s Release Integrity spotted 1,500+ dependency confusion npm packages posted by a vigilante actor to spread awareness about risks of supply chain attacks. Image: Example supply chain attack reminder packages on npm While most of these packages were PoC research ones by prospective bug bounty hunters, some were malicious.Īnd yet another breed of these copycats caught by Sonatype included those that spread awareness about supply-chain attacks: 5,000+ vigilante activism packages flood npm and PyPIĮarlier this year and shortly after dependency confusion news broke, entities began flooding npm and PyPI with copycat packages. Thanks to Sonatype’s timely report to npm, these packages were nuked before they caused harm to anyone.ģ. In March, we first identified malicious dependency confusion packages that were named after repositories, namespaces, or components used by companies such as Amazon, Zillow, Lyft, and Slack. Malware named after popular company repos Of note is that the package seems to be specifically designed to target individual NodeJS developers, judging from the way it acts once downloaded, as well as the choice of operating systems that it targets.Ģ. Existing in the brandjacking npm package “web-browserify,” the malware imitated the legitimate “ browserify” component that receives over 1.3 million weekly downloads on npm alone. In April of this year, Sonatype’s Release Integrity spotted a rather unique macOS and Linux malware sample published to the npm registry, targeting developers. Today we roundup popular malware that Sonatype’s Release Integrity has identified thus far, which is by no means an exhaustive list: Bug bounties and contributions by security researchers and infosec activists.Thousands of dependency hijacking copycats, malicious and otherwise.Hundreds of original dependency confusion PoCs.

Novel malware, typosquatting, and brandjacking.This figure includes packages infiltrating npm that emerged this year, including: Since then, the Sonatype Security Research Team has repeatedly added these packages to our data under multiple vulnerability identifiers (sonatype-2020-XXXX IDs), keeping our customers protected from the get-go.Īt publish date, we have identified upwards of 12,000 suspicious and malicious npm packages.

Google suspicious package software#

This vulnerability was revealed as promised, affecting more than 35 organizations, including major software companies like Microsoft, Uber, Tesla, Yelp, and Shopify. At the time, the researcher told Sonatype that this was part of ongoing research work and that a coordinated disclosure would take place in early 2021. Using automated malware detection systems, the service flagged Birsan’s packages in early 2020 as malware. With it, Sonatype was the first and only company to proactively catch the dependency or namespace confusion PoC research packages from Alex Birsan when they first sprung up in 2020. Since then, this technology has time and time again identified novel malware - including those missed by leading antivirus engines, lurking in open source components.

We knew then that the future of open source security was changing - and the past year shows just how right we were. Great question!īack in 2019, Sonatype announced the release of its new technology with early warning capabilities to find malicious releases of open source components, known as “counterfeit components.” Release Integrity is part of next-gen Sonatype Nexus Intelligence, detecting and blocking their use within modern software factories. I get asked often what Sonatype's automated malware detection system, Release Integrity, has found so far.