lunasec-io

lunasec

TypeScript2021–2024

lunasec-io / lunasec

lunasec

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

Explore on GitHub Read Hacker News discussions

4Distinct people

39Mentions

1Explicit recommenders

1.5KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

Nit picking a bit but I prefer btrfs even if it's slower. Easier to work with. What bootloader is this using? Or is it just straight EFI booting? I helped write a guide a few…

freeqaz used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year39 dated mentions

Observed mentions: 2021-11-01 15:24:34 UTC to 2024-09-14 21:35:23 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	10	2	8
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	24	1	23
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	4	0	4
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	1	0	1

What Hacker News says

39 sources

freeqaz·Sep 14, 2024Recommendation phrase

Nit picking a bit but I prefer btrfs even if it's slower. Easier to work with. What bootloader is this using? Or is it just straight EFI booting? I helped write a guide a few years back that still is what I do using systemd-boot. https://github.com/lunasec-io/lunasec/blob/master/docs/blog/... How is Wayland support these days? I love i3 but I know Sway promises to be close enough.

In Installing Arch Linux on a Laptop

freeqaz·Mar 6, 2023

Are you planning to make this Open Source? We run an Open Source project[0] and we would love to work with y'all since this is related to where our heads are at, but we would want to have the core be open for that! 0: https://github.com/lunasec-io/lunasec

In Launch HN: Vellum (YC W23) – Dev Platform for LLM Apps

freeqaz·Feb 24, 2023

I agree that it is a threat. I don't think this instance is (it's too noisy). I wrote a comment on the NPM thread earlier (https://news.ycombinator.com/threads?id=freeqaz) that I'll quote here: > "While being flooded with spam is never good, it gets immediately noticed and mitigated. It's harder for open source projects to spot and stop rare one-offs" This is the real problem that NPM and other ecosystems face. A determined attacker that is trying to "poison" a popular Open Source package just has to feign as a maintainer long enough to succeed[0]. Defeating these types of attacks will require rethinking how we think about trust of packages. Projects like Deno are one approach (fork the ecosystem) while projects like Packj (mentioned elsewhere here), Socket.dev, and LunaTrace[1] are taking the other angle (make it harder to install malwar

Read the rest

e). It's hard to say which approach is better right away. (Probably a hybrid of both, realistically) It's just non-trivial to fix this in one clean swoop. It's messy. 0: https://www.trendmicro.com/vinfo/us/security/news/cybercrime... 1: https://github.com/lunasec-io/lunasec

In Aggressive Attack on PyPI Attempting to Deliver Rust Executable

freeqaz·Feb 24, 2023

The lead is buried at the bottom of the article (imo). > "While being flooded with spam is never good, it gets immediately noticed and mitigated. It's harder for open source projects to spot and stop rare one-offs" This is the real problem that NPM and other ecosystems face. A determined attacker that is trying to "poison" a popular Open Source package just has to feign as a maintainer long enough to succeed[0]. Defeating these types of attacks will require rethinking how we think about trust of packages. Projects like Deno are one approach (fork the ecosystem) while projects like Packj (mentioned elsewhere here), Socket.dev, and LunaTrace[1] are taking the other angle (make it harder to install malware). It's hard to say which approach is better right away. (Probably a hybrid of both, realistically) It's just non-trivial to fix this in o

Read the rest

ne clean swoop. It's messy. 0: https://www.trendmicro.com/vinfo/us/security/news/cybercrime... 1: https://github.com/lunasec-io/lunasec

In NPM repository flooded with 15,000 phishing packages

freeqaz·Jan 27, 2023

LunaTrace: https://lunatrace.lunasec.io/ Premise: Open Source[0] alternative to GitHub Dependabot and `npm audit` that focuses on helping you prioritize where to patch first (since only 0.1% of CVEs are used in cyber attacks). Short YouTube demo: https://www.youtube.com/watch?v=ugdSyR2L6sY A newer video showing off the Static Analysis engine: https://www.youtube.com/watch?v=vPd4MSUJ98M Price: $0 for Open Source repos. We're hoping to charge for private repos in the future, but we need to build out the billing features first lol. (We're at $0 in revenue currently.) If you are filled with rage because of CVEs spamming you, come vent your frustrations on Discord: https://discord.gg/2EbHdAR5w7 We're looking for early customers that are interested in working with us. My email is on my profile. Cheers! [0]: Source Code, https://github.com/lunas

Read the rest

ec-io/lunasec/

In Ask HN: Those making $0/month or less on side projects – Show and tell

freeqaz·Dec 30, 2022

(Note: I'm the person that coined the term "Log4Shell") You may be surprised when I tell you what the Apache Software foundation's yearly budget is. You'd think for software that is used by practically every Fortune 500 company and most governments, it would be something reasonable. Maybe a few hundred million dollars a year to pay for a reasonable full-time staff, right? It turns out... it's about $2 million a year. (Wikipedia[0]) This helps explain to me why the devs of Log4j directly uploaded the file "JNDIExploit.java" (the POC) to GitHub while they were patching. (Here is a full analysis about what happened[1].) They're not security people. They're volunteers working on this in addition to their full-time job. What kind of brave soul wants to trudge through and maintain log4j in their spare time for zero compensation? I appreciate th

Read the rest

e people that are capable of doing that, but I think they are rare! This whole entire vulnerability was eye opening for everybody and I have actually spent the last year building tooling on GitHub to help fix the problems that Log4Shell exposed. If you have 2 seconds to try that out or just Star the repo[2], it would be very helpful! 0: Log4j revenue https://en.wikipedia.org/wiki/The_Apache_Software_Foundation 1: "How to Discuss and Fix Vulnerabilities in Open Source" https://www.lunasec.io/docs/blog/how-to-mitigate-open-source... 2: GitHub project building better dependency patching tools https://github.com/lunasec-io/lunasec

In Log4Shell Still Has Sting in the Tail

freeqaz·Dec 27, 2022

This is a real problem that I believe will become increasingly commonly used by attackers to break into companies. Unfortunately, it's not an easy problem to automate the detection. There are some heuristics, but you're basically writing something like Norton Antivirus for Python packages lol. A sufficiently skilled attacker can make their code look totally innocent[0]. :) Source: Former security engineer at Uber/Snap that's now working on tooling in this space[1]. 0: "Underhanded C Competition" http://www.underhanded-c.org/ 1: Open Source "Supply Chain Security" platform https://github.com/lunasec-io/lunasec

In Detecting the use of “curl | bash” server side (2016)

freeqaz·Nov 3, 2022

It is possible to set your registry in NPM via the "npmrc" file. That will let you hit the specified HTTP server whenever you run commands like "npm install". I know this is also possible for Python because we did it at Uber. I don't remember the specific details anymore though. In either case though, a lot of people have written proxies for this use case (I helped write one for NPM at Uber). Companies like Bytesafe and Artifactory also exist in this space. We're working on something similar that's on GitHub here: https://github.com/lunasec-io/lunasec Proxy support isn't built out yet but the data is all there already.

In Dozens of malicious PyPI packages discovered targeting developers

freeqaz·Oct 28, 2022

The current system is broken. I don't think I agree with everything in the post, but I'm excited to see movement in this space given that this is a space I spend a lot of time thinking about. (I'll expand on that below) Even if I disagree with parts of this, this is still one of the most interesting things that I've read around OSS licensing in a minute! Having actual VC money behind this movement is awesome. For context: I run an Open Source company that's YC + VC-backed. We use a hybrid of Apache and Business Source License (BSL, a "non-compete" license that converts to Apache in 2-3 years). Our license file[0] has context about my thought process around this, but I still am not totally happy with it. (BSL isn't an "OSI-Compatible" license, but feels like the "best compromise" license out there currently.) To come to that conclusion, I'

Read the rest

ve read both Heather Meeker's book, "Open (Source) for Business"[1], multiple times now and I've also blogged about this topic[2] before. (She helped write the BSL license.) All of that is to say, it's complicated and there are some perverse incentives that can prevent you from always "doing the right thing". Problem #1: You lose control. You may begin with Apache but, as OP states, you eventually end up with the incentive to "rug pull" by switching the license because of market forces/VC influence. (I'm the founder of my company and I would resist it, but eventually our investors might control the board and make that happen anyway by firing me.) Problem #2: The hardest part of building a company is getting traction. Just getting anybody to care about you takes a ton of effort and having a permissive license makes it way easier to get that early adoption. And, by the time you have adoption and you decide to go raise VC money, you now end up with Problem #1. Problem #3: If you start with a copyleft license like GPL/AGPL then you make Problem #2 (adoption) harder. Many companies simply won't use your software if you're using a copyleft license (like Google). (Linux is a notable exception here, while companies like MongoDB switched from AGPL. It's crazy.) We are using BSL because it feels like the best compromise (it becomes Apache 2.0 eventually). I do still think a lot about switching to Apache though. I just really hate the idea of "rug pulling" and I'd rather be honest from the beginning with a license like BSL, even if it is more difficult to get that initial momentum. Does anybody else have thoughts to share about this? 0: https://github.com/lunasec-io/lunasec/blob/master/LICENSE.md 1: Open (Source) for Business: A Practical Guide to Open Source Software Licensing - Third Edition https://a.co/8SLjVZI 2: https://www.lunasec.io/docs/blog/how-to-build-an-open-source...

In Preventing the bait and switch by open core software companies

freeqaz·Oct 17, 2022

There are some techniques used mostly to detect when students copy paste code. I've seen some of the tools in that space and they have varying degrees of accuracy. MOSS is a common one[0]. There are some vendors in this space too (BlackDuck comes to mind) but they're $$$ so only within the scope of large corporations. If anybody has any ideas relating to this type of analysis, I'd be excited to chat. I am working on a project[1] in this space for "Software Composition Analysis" which could potentially overlap with snippet detection for code like Co-Pilot. (We basically just have a big pipeline of analysis jobs that run on code and store the results. I need to update the docs!) 0: https://yangdanny97.github.io/blog/2019/05/03/MOSS 1: https://github.com/lunasec-io/lunasec/tree/master/lunatrace

In GitHub Copilot investigation

freeqaz·Oct 4, 2022

Here is some code on GitHub that does call site checking using SemGrep: https://github.com/lunasec-io/lunasec/blob/master/lunatrace/... (Note: I helped write that. We're building a similar service to the r2c one.) You're right that patching is hard because of opaque package diffs. I've seen some tools coming out like Socket.dev which show a diff between versions. https://socket.dev/npm/package/react/versions But, that said, this is still a hard problem to solve and it's happened before that malware[0][1] has been silently shipped because of how opaque packages are. 0: https://web.archive.org/web/20201221173112/https://github.co... 1: https://www.coindesk.com/markets/2018/11/27/fake-developer-s...

In Ignore 98% of dependency alerts: introducing Semgrep Supply Chain

freeqaz·Sep 19, 2022

I have two thoughts to share about this from what you've said: > we must stop expecting [Open Source] devs to have any responsibility for code they produce. Yes, I agree with this. And something that's been in my head for a while, which often discussed, is how people often "magically think" something along the lines of: "If we just paid these devs for support, then we'd solve the support problem!" Unfortunately, I don't think is reality. If you're a dev working at Google and you toss a library on NPM, you probably can't be paid to support it because your employer forbids it. The type of person writing libraries Open Source is not always going to be motivated by money! > Some of my clients actually do (or pay others for) security review of every single NPM dependency they use in prod. If you can not afford to review 2000 dependencies then

Read the rest

you can not afford 2000 dependencies. Find a leaner path. There was a post a few months ago[0] that has been talking about a way to "democratize" this review process. It's been sitting in my head and it's actually a part of a project that I'm working on now[1]. (My apologies for that not being documented anywhere yet though!) Essentially, if every company on this planet has to review every Open Source dependency, that's a massive waste of human effort because there is a ton of overlap between that work. Instead, what if you could have one person/entity do that work to review the dependencies and then you "buy" that dataset for a fraction of the price? If it takes 10 humans a year to review every dependency you have, then it's cheaper to pay 1 human salary to buy that data. (And we do the work once but then sell it 100+ times.) That's the core principle that's been in my head for a while and that's how we're trying to build a company right now. Unsexy problems aren't very "shiny" (like Stable Diffusion or NFTs) but they are important! 0: https://news.ycombinator.com/item?id=32037562 1: https://github.com/lunasec-io/lunasec

In There is no “software supply chain”

freeqaz·Sep 9, 2022

AWS CDK is pretty magical. The whole "constructs" that they have are very powerful. I was able to setup a scale-to-zero RDS Serverless database with an auto scaling backend using ECS + Fargate in a few hours. (With zero prior experience with the CDK) You can see that code here if you're curious: https://github.com/lunasec-io/lunasec/blob/master/lunatrace/... It's more complicated now but if you look at the history of that "backend-cdk" folder then it's simpler a few months ago. The important bit is the "ecs-patterns" library. That's the one that is magical and deals with setting up the load balancer, cluster, etc for you. And the way we shove the Docker images in I found to be quite straightforward. (And deploys are one line)

In Ask HN: How do you deploy your weekend project in 2022?

freeqaz·Sep 7, 2022

There are a few companies in this space that are trying to do the "Security Seal of Approval" thing to various degrees. Tidelift is one company that has a bunch of "catalogs"[0] of packages. I'm not sure how their package metadata is generated though -- maybe semi-manually? There is also Bytesafe[1] which is supposed to help give you a way to "firewall" yourself from unapproved dependencies. I don't think they sell data though. Just tools. A company based on the Open Source project, packj[2], is Ossilate[3] which is trying to use automated analysis for analyzing 3rd party packages. And another that's in this space is Socket.dev[4] which tries to warn you in your PRs about bad packages. I know about this space because I work on a project[5] that's also related to supply chain security. It's a bit different from all of the above since we're

Read the rest

focused on patching known vulns, but the idea of "vetted packages" has crossed my mind before. Are there any other services in this space that I missed? 0: https://tidelift.com/solutions/catalogs 1: https://bytesafe.dev/ 2: https://github.com/ossillate-inc/packj 3: https://ossillate.com/ 4: https://socket.dev/ 5: https://github.com/lunasec-io/lunasec/

In Why has software supply chain security exploded?

freeqaz·Sep 6, 2022

Note: I run a vuln scanning company in this space (our GitHub[0]), so I can add some context to this. GitHub has this for Dependabot via CodeQL which is a part of their "Advanced Security" package. ($$$, ie "contact us", but I've heard ~$1-1.5k per dev per year roughly) Other big ones are SonaType, FOSSA, and Snyk (which OP mentioned). There are some smaller vendors too which I can add if anybody is curious. GitHub CodeQL is by far the best and their tech comes from their acquisition of Semmle/LGTM a few years ago. When I was at Uber, we used Semmle to augment the efforts of the bug bounty and to "scale" our AppSec team to keep up with an ever growing engineering team. The lack of flexibility with CodeQL and the other proprietary scanning tools is actually the reason why, when I decided to start a security company, I decided to center the

Read the rest

company around building publicly on GitHub. It's harder to make money, at least initially, but it's also the "right" choice to actually push this industry forward. (The thought on how to make money is a hosted SaaS, of course.) Anyway, I'm happy to answer any questions around this stuff! 0: https://github.com/lunasec-io/lunasec

In Vulnerability Management for Go

Showing the 15 most recent of 39 sources. Enable JavaScript to search and browse every indexed mention.