How we took malware advisories beyond npm
GitHub's supply chain engineering team expanded malware advisories to eight ecosystems by building on OpenSSF's shared malicious packages data. Dependabot now flags malware in npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer dependencies.
Intelligence analysis by Llama
Dependabot's malware advisories now cover eight major package ecosystems, including PyPI, after building on OpenSSF's shared malicious packages data. This expansion enables more comprehensive security for developers.
Imagine you're building a house, and someone gives you a bad blueprint. You wouldn't want to start building with that, right? That's what malware advisories do - they help you avoid using bad or malicious code in your projects. Now, GitHub's Dependabot team has made it easier to find and fix these problems by expanding their malware advisories to more types of projects.
Analysis
The Problem of Malware in Open-Source Ecosystems
Malware in open-source ecosystems poses a significant threat to developers and users. Until recently, GitHub could only flag malware in npm. However, this limitation has been addressed by the supply chain engineering team behind Dependabot, who have expanded malware advisories to eight ecosystems by building on OpenSSF's shared malicious packages data.
The Solution: Dependabot's Malware Advisories
Dependabot's malware advisories now cover all eight major package ecosystems: npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. This expansion enables more comprehensive security for developers by providing real-time alerts and advisories for potential threats. The team achieved this by building a single importer that reads OSV records and validates the required fields, types, and format against the schema before anything touches the database.
The Importance of Resilient Ingestion Pipeline
The design assumes the upstream feed could one day carry bad data, such as false reports or compromised sources. To mitigate this risk, the team built a resilient ingestion pipeline with three layers of protection: batch caps, provenance, and deduplication. These measures ensure that the pipeline can handle unexpected data and prevent the publication of malicious advisories.
Key points
- Dependabot's malware advisories now cover eight major package ecosystems.
- The team built a single importer that reads OSV records and validates the required fields, types, and format against the schema.
- The ingestion pipeline has three layers of protection: batch caps, provenance, and deduplication.
This development has the potential to significantly improve the security of open-source projects by providing more comprehensive and real-time alerts for potential threats. As a result, developers can be more confident in the safety of their projects and users can trust the software they use.
However, there is a risk that the expansion of malware advisories could lead to false positives or over-reporting, which could cause unnecessary panic or disruption. Additionally, the team's reliance on OpenSSF's shared malicious packages data may introduce new risks if the upstream feed carries bad data.