public
/
website
5
0
Fork 0
Code Issues 6 Pull Requests 4 Packages Projects Releases Wiki Activity

minor updates

This commit is contained in:
Anton Livaja 2025-06-12 04:01:15 -07:00
parent 096a7b4c71
commit 2b198a29b2
Signed by: anton
GPG Key ID: 44A86CFF1FDF0E85
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
_posts/2025-06-07-package-managers.md
View File

@ -26,8 +26,8 @@ without revision, most individuals would say that that it isn't okay. When the
same question arises about whether it's okay for millions of lines of code by
hundreds or even thousands of developers from around the globe to introduce
changes to a codebase, most companies shrug and say that they use Static
Application Security Testing (SAST) - but we all know this doesn't address the
issue, otherwise supply chain attacks would not be nearly as common.
Application Security Testing (SAST) and monitor - but we all know this doesn't
address the issue, otherwise supply chain attacks would not be nearly as common.
## SAST and Spiderman
@ -68,6 +68,11 @@ this year so far:
* June 5 2025: "One collection of PyPI packages is designed to "monkey patch" Solana key-generation methods by modifying relevant functions at runtime without making any changes to the original source code." [ref](https://web.archive.org/web/20250605205948/https://thehackernews.com/2025/06/malicious-pypi-npm-and-ruby-packages.html)
So next time when installing a package, consider what is being installed. The
issue is that it's usually not just the top level dependency that will end up
being installed - there are often many sub-dependencies, and package managers
like npm will run the installation lifecycle scripts of each one.
## Who Wrote The Code?
Package managers are open ecosystems with contributors from all over the world,
@ -109,7 +114,8 @@ installation and during runtime resulting in complete compromise.
* Not reviewing every line of code manually will inevitably lead to compromise
given a long enough time horizon.
* SAST is a feel good measure that is not sufficient for ensuring code security.
* SAST/monitoring is a partial measure that is not sufficient for ensuring
code security.
* If it can be done with the standard language library, avoid adding
dependencies.