Detection of malicious open source packages

Cyberwatch detects open source packages identified as malicious (backdoors, credential theft, malicious code, typosquats of legitimate packages, etc.) using the “malicious-packages” database from the OSSF (Open Source Security Foundation).

This data is integrated into Cyberwatch’s central vulnerabilities database and is therefore available as soon as it is synchronized, with no additional configuration required.

Covered ecosystems

• npm (Node.js)
• pip (Python)
• gem (Ruby)
• Maven (Java)
• Go modules

These are packages published on these registries (for example, axios), and not the npm, pip, etc. applications themselves.

How detection works

Cyberwatch compares the packages inventoried on an asset with the OSSF database, based on the package name and type. The security issue is only raised when the installed version of the package matches a version identified as compromised in the OSSF database.

Result produced

The detection of a malicious package generates a security issue titled “Malicious package (OSSF)”, with critical severity. This issue is visible:

• in the “Security issues” tab of the relevant asset
• in the security issues encyclopedia

It includes the following information: package name, installed version, package type, advisory code, details, and a link to the original advisory.

This issue follows the standard Cyberwatch security issues lifecycle: it automatically moves to the “resolved” status when the package is no longer detected on the asset, and is reactivated if it is detected again.

Prerequisites

For this detection to work, the asset must inventory its application packages:

• on Linux, by enabling the optional scan “Linux application packages scan” via a scanning policy
• on Docker images, this prerequisite is automatically covered by the image scan, with no further action required

Remediation

Remediation consists of removing the identified malicious package, or replacing it with a clean version or the expected official package.