Abstract:Software engineers regularly use JavaScript and Python for both front-end and back-end automation tasks. On top of JavaScript and Python, there are several frameworks to facilitate automation tasks further. Some of these frameworks are Node Manager Package (npm) and Python Package Index (PyPi), which are open source (OS) package libraries. The public registries npm and PyPi use to host packages allow any user with a verified email to publish code. The lack of a comprehensive scanning tool when publishing to the registry creates security concerns. Users can report malicious code on the registry; however, attackers can still cause damage until they remove their tool from the platform. Furthermore, several packages depend on each other, making them more vulnerable to a bad package in the dependency tree. The heavy code reuse creates security artifacts developers have to consider, such as the package reach. This project will illustrate a high-level overview of common risks associated with OS registries and the package dependency structure. There are several attack types, such as typosquatting and combosquatting, in the OS package registries. Outdated packages pose a security risk, and we will examine the extent of technical lag present in the npm environment. In this paper, our main contribution consists of a survey of common threats in OS registries. Afterward, we will offer countermeasures to mitigate the risks presented. These remedies will heavily focus on the applications of Machine Learning (ML) to detect suspicious activities. To the best of our knowledge, the ML-focused countermeasures are the first proposed possible solutions to the security problems listed. In addition, this project is the first survey of threats in npm and PyPi, although several studies focus on a subset of threats.

A Review of Attacks Against Language-Based Package Managers

A Large-Scale Empirical Study of Open Source License Usage: Practices and Challenges

Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks

Software supply chain: review of attacks, risk assessment strategies and security controls

A Survey on Common Threats in npm and PyPi Registries

What are Weak Links in the npm Supply Chain?

We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs

Taxonomy of Attacks on Open-Source Software Supply Chains

Investigating Package Related Security Threats in Software Registries

Towards Using Source Code Repositories to Identify Software Supply Chain Attacks

Containing Malicious Package Updates in npm with a Lightweight Permission System

Attacks on Third-Party APIs of Large Language Models

Software Supply Chain Attacks, a Threat to Global Cybersecurity: SolarWinds’ Case Study

A Comprehensive Survey of Attack Techniques, Implementation, and Mitigation Strategies in Large Language Models

A Large-scale Fine-grained Analysis of Packages in Open-Source Software Ecosystems

Journey to the Center of Software Supply Chain Attacks

Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem

An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures

A Study of Malware Prevention in Linux Distributions

A Viewpoint on Human Factors in Software Supply Chain Security: A Research Agenda