Deceptive Code: Lessons Learned from Analysing 1M+ OSS Packages for Malicious Code
Session Description
Open Source package distributed with typosquatting and starjacking. Project X is compromised to deliver malware to its 100k+ user base. Sounds familiar? This talk will jump straight into open source package analysis for malicious “code” identification with real life metrics from analysing over 1 million OSS packages for malicious code.
We will share lessons learned while monitoring npm, PyPI and other package registry ecosystems for malicious packages. We will showcase real life malicious OSS packages that we have detected and eliminated from public repositories using static code analysis and dynamic analysis techniques. We will focus on unique techniques and heuristics that we used to detect them. We will end the talk with a quick demo of vet, our free and open source next-gen Software Composition Analysis tool that is integrated with malicious packages data feed to protect software development teams in near realtime.
Example malicious packages reported by us:
Key Takeaways
Malicious open source packages are real, here are the evidences & metrics
Static code analysis for malicious OSS code identification with real world examples
Dynamic analysis for malicious package identification with real world examples
How to use "SafeDep vet", our open source project, to protect against malicious packages
References
Session Categories
Which track are you applying for?
Speakers
Abhisek Datta
Reviews
Thank you for submitting your proposal for IndiaFOSS 2025. Your submission was well-received and progressed to our final review stages.
Unfortunately, due to the high volume of excellent proposals this year, we were unable to select your talk for the final program. We appreciate the effort you put into your submission and encourage you to apply again for future events.