ossillate-inc

packj

Python2022–2026

ossillate-inc / packj

packj

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

Explore on GitHub Read Hacker News discussions

10Distinct people

81Mentions

0Explicit recommenders

695GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 10:49:33 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year81 dated mentions

Observed mentions: 2022-05-25 19:21:13 UTC to 2026-08-31 06:47:10 UTC.

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	31	2	29
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	31	1	30
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	8	0	8
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	4	0	4
2026 (partial)	2026-01-01 00:00:00 UTC	2027-01-01 00:00:00 UTC	7	3	4

What Hacker News says

31 sources

ashishbijlani·Dec 14, 2023

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, invalid/expired email (i.e., no 2FA), use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

In Ledger's NPM account has been hacked

ashishbijlani·Nov 15, 2023

Creator of Packj [1] here. How do you envision sandboxing/security policies will be specified? Per-lib policies when you've hundreds of dependencies will become overwhelming. Having built an eBPF-based sandbox [2], I anticipate that accuracy will be another challenge here: too restrictive will block functionality, too permissive defeats the purpose. 1. https://github.com/ossillate-inc/packj flags malicious/risky NPM/PyPI/RubyGems/Rust/Maven/PHP packages by carrying out static+dynamic+metadata analysis. 2. Sandboxing file system w/o superuser privileges: https://github.com/sandfs/sandfs.github.io

In Rust without crates.io

ashishbijlani·Nov 14, 2023

I’ve been building Packj [1] to detect publicly UNKNOWN dummy, malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as num funcs/files, spawning of shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages. Packj Github action [2] can alert if a risky dependency is pulled into your build. 1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action

In Rust without crates.io

ashishbijlani·Nov 14, 2023

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

In We've learned nothing from the SolarWinds hack

ashishbijlani·Oct 13, 2023

Good to see more attempts at analyzing dependencies for malware. Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

In Making Rust supply chain attacks harder with Cackle

ashishbijlani·Oct 7, 2023

I've been building Packj [1] to detect exactly such attacks. It can flag dummy, malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages by carrying out static/dynamic/metadata analysis. It scans for 40+ attributes such as num funcs/files, spawning of shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages. Packj Github action [2] can alert if a risky dependency is pulled into your build. 1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action

In A Deep Dive into 70 Layers of Obfuscated Info-Stealer Malware

ashishbijlani·Sep 22, 2023

I've been building Packj [1] to detect dummy, malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as num funcs/files, spawning of shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages. Packj Github action [2] can alert if a risky dependency is pulled into your build. 1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action

In The Bogus CVE Problem

thenerdhead·Sep 10, 2023

Cool project. How do you feel about projects like OpenSSF scorecards or even the checks that socket.dev do today on these packages to help determine risk? https://github.com/ossillate-inc/packj/blob/main/.packj.yaml Secondly, what about impersonation where attackers imitate a popular package and its respective metadata?

In A study of malicious code in PyPI ecosystem

ashishbijlani·Sep 9, 2023

I've been building Packj [1] to detect dummy, malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as num funcs/files, spawning of shell, use of SSH keys, network communication, use of decode+eval, mismatch of GitHub code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj

In A study of malicious code in PyPI ecosystem

ashishbijlani·Jul 25, 2023

We’ve built an open-source tool, called Packj [1], to offer developers more insights into packages, such as risky install hooks, embedded binary blobs, and other malicious/risky packages. It performs static/dynamic/metadata analysis to look for "suspicious” attributes. 1. https://github.com/ossillate-inc/packj

In Social engineering campaign targeting tech employees spreads through NPM malware

ashishbijlani·Jul 22, 2023

Plug: I've been building Packj [1] to detect dummy, malicious, abandoned, typo-squatting, and other "risky" packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as num funcs/files, spawning of shell, use of SSH keys, network communication, use of decode+eval, mismatch of GitHub code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj

In Malicious libraries can steal all your application secrets in Elixir

ashishbijlani·Jun 24, 2023

We carried out a similar analysis using Packj tool [1] and found that a large number of repos are vulnerable to supply-chain attacks. We received a bunch of bounties for reporting vulnerabilities. Hopefully, these findings will bolster open-source security. 1. http://github.com/ossillate-inc/packj flags vulnerable/malicious NPM/PyPI/Rubygems/Cargo/Packagist packages. I'm the lead dev.

In Millions of GitHub repos likely vulnerable to RepoJacking, researchers say

ashishbijlani·May 22, 2023

Packj [1] flags malicious/risky NPM/PyPI/RubyGems packages by carrying out static analysis and looking for capabilities/permissions (diff from runtime permission enforcement). Supporting VSCode/browser extensions is on our roadmap. Disclaimer: I'm the lead developer. 1. https://github.com/ossillate-inc/packj

In Malicious VSCode extensions with more than 45k installs

ashishbijlani·May 5, 2023

This is a great idea! What have been your findings comparing packaged code vs repo code? If you're interested, I'd love to integrate this in Packj tool. 1. http://github.com/ossillate-inc/packj flags vulnerable/malicious NPM/PyPI/Rubygems packages.

In Mischievous NPM Publications

ashishbijlani·Apr 27, 2023

I built Packj [1] sandboxing for securing “pip/NPM install”. It uses strace for sandboxing and blocks access to sensitive files and limits traffic to known-good IP addresses. 1. https://github.com/ossillate-inc/packj

In How to use Podman inside of a container (2021)

Showing the 15 most recent of 31 sources. Enable JavaScript to search and browse every indexed mention.