ILillegalmemory·Jan 31, 2025
https://github.com/phylum-dev/birdcage
https://github.com/servo/gaol
and several others ?
In Developers should embrace creative coding againphylum-dev
birdcage
Rust2022–2025
phylum-dev / birdcage · Archived
birdcage
Cross-platform embeddable sandboxing
2Distinct people
15Mentions
0Explicit recommenders
219GitHub stars
What to know before exploring
What it is
Cross-platform embeddable sandboxing
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month15 dated mentions
Observed mentions: 2022-11-02 17:54:24 UTC to 2025-01-31 18:07:00 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Nov 2022 | 2022-11-01 00:00:00 UTC | 2022-12-01 00:00:00 UTC | 4 | 0 | 4 |
| Dec 2022 | 2022-12-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 1 | 0 | 1 |
| Jan 2023 | 2023-01-01 00:00:00 UTC | 2023-02-01 00:00:00 UTC | 1 | 0 | 1 |
| Feb 2023 | 2023-02-01 00:00:00 UTC | 2023-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2023 | 2023-03-01 00:00:00 UTC | 2023-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2023 | 2023-04-01 00:00:00 UTC | 2023-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2023 | 2023-05-01 00:00:00 UTC | 2023-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2023 | 2023-06-01 00:00:00 UTC | 2023-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2023 | 2023-07-01 00:00:00 UTC | 2023-08-01 00:00:00 UTC | 1 | 0 | 1 |
| Aug 2023 | 2023-08-01 00:00:00 UTC | 2023-09-01 00:00:00 UTC | 2 | 0 | 2 |
| Sep 2023 | 2023-09-01 00:00:00 UTC | 2023-10-01 00:00:00 UTC | 2 | 0 | 2 |
| Oct 2023 | 2023-10-01 00:00:00 UTC | 2023-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2023 | 2023-11-01 00:00:00 UTC | 2023-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2023 | 2023-12-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
| Jan 2024 | 2024-01-01 00:00:00 UTC | 2024-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2024 | 2024-02-01 00:00:00 UTC | 2024-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2024 | 2024-03-01 00:00:00 UTC | 2024-04-01 00:00:00 UTC | 2 | 0 | 2 |
| Apr 2024 | 2024-04-01 00:00:00 UTC | 2024-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2024 | 2024-05-01 00:00:00 UTC | 2024-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2024 | 2024-06-01 00:00:00 UTC | 2024-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2024 | 2024-07-01 00:00:00 UTC | 2024-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2024 | 2024-08-01 00:00:00 UTC | 2024-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2024 | 2024-09-01 00:00:00 UTC | 2024-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2024 | 2024-10-01 00:00:00 UTC | 2024-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2024 | 2024-11-01 00:00:00 UTC | 2024-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2024 | 2024-12-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2025 | 2025-01-01 00:00:00 UTC | 2025-02-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
15 sourcesI'm one of the co-founders @ Phylum. We've been tracking this campaign [1] (along with several other unrelated ones). The collective group of security researchers (Shoutout to https://vipyrsec.com/) in our Discord have been reporting these packages to PyPI for removal. If this is something you'd be interested in helping with, please join our Discord (https://discord.gg/Fe6pr5eW6p)!
Besides the gigantic analytics platform we've constructed to monitor supply chain attacks targeting open source, we've also open sourced a few tools to better mitigate attacks targeting developers. For example, a sandbox to minimize the impacts of malicious packages during installation [2] (with a pre-check to our API for known malware), which allows you to do things like
phylum npm install <pkgName>
Happy to answer any questions about this campaign or oth
Read the rest
ers we've uncovered!
1. https://blog.phylum.io/typosquatting-campaign-targets-python...
2. https://github.com/phylum-dev/birdcage
Yeah, the broad campaign makes it extremely noticeable. There are active campaigns right now that don't take this approach. Singular packages with novel malicious payloads.
> As a person who regularly runs pip install on my main desktop, where I am worried about arbitrary code execution that happens when you pip install.
We've open-sourced a sandbox and wrapped the Phylum CLI with it so you can do something like `phylum pip install <pkgName>,` it'll check our API first for known malware, then if it appears clean, will perform the installation in the sandbox. You can specify what the sandbox is allowed to touch in a TOML file.
See: https://github.com/phylum-dev/birdcage
In PyPI Suspends New User and Project Creation in Wake of Malware CampaignCo-founder @ Phylum here (https://phylum.io). We've been actively scanning dependencies across most open source package registries (e.g., npm, PyPI, Crates.io, etc.) for a few years now. Quite successfully, I might add, with recent findings targeting financial institutions [1], North Korean state actors [2], and some of the first malware staging to be seen on Crates.io [3].
The fact that an attacker was able to pull this off against a _secure_ hardware device is shocking but not surprising. The mechanism by which they did it is interesting and fairly insidious. Unlike a lot of other attacks that will publish the malware to the registry, this one pulls the payload from a CDN. So, static analysis of the loader (i.e., the intermediary package on npm) is unlikely to yield sufficiently interesting results. Solely focusing on the obfuscation an
Read the rest
gle is also not of particular use since quite a bit of packages are obfuscated on npm (like, a surprising amount of it. In Q3 2023 we saw over 5,000 _new_ packages shipped with some form of obfuscation).
Nonetheless, our automated platform pinged us this morning about some changes to this package and our research team has been digging into it to determine the impacts.
With that said, we've produced (and open sourced!) several tools that aim to help with software supply chain style attacks:
1. Birdcage is a cross-platform embeddable sandbox [4]
2. Our CLI is extensible and integrates Birdcage so you can do things like `phylum npm install...` or `phylum pip install...` and have the package installations be sandboxed [5]
We've also got a variety of integrations [6] along with a threat feed of software supply chain attacks (of which the Ledger package and other APT attacks have appeared).
Happy to answer any questions! A collective of us are active in Discord (https://discord.gg/Fe6pr5eW6p), continuing to hunt attacks like these. If that's something that interests you, we'd love to have you!
1. https://blog.phylum.io/encrypted-npm-packages-found-targetin...
2. https://blog.phylum.io/junes-sophisticated-npm-attack-attrib...
3. https://blog.phylum.io/rust-malware-staged-on-crates-io/
4. https://github.com/phylum-dev/birdcage
5. https://github.com/phylum-dev/cli
6. https://docs.phylum.io/docs/integrations_overview
One of the sources referenced in the paper is about the work the company I co-founded is doing (https://phylum.io). We've been working closely with PyPI to not only report issues related to malware, but are also helping provide guidance around on-going work to help curb additional malware in the ecosystem. I think this is a step in the right direction, and one I hope other ecosystems will eventually take.
Though, this is likely to be a cat and mouse game for the foreseeable future. Detection will get better, and attackers will change tactics.
In the meantime, we've been open-sourcing some tooling to help protect developers from these sorts of attacks. Namely, a sandbox that locks down network/disk/env [1] and our CLI [2] that allows you to perform a `pip` install in the sandbox, after checking our API for behaviors/issues with the package
Read the rest
. For example:
phylum pip install <pkgName>
Really glad to see software supply chain security getting some academic, rigorous study. Backstabbers Knife was one of the first I came across, and it's been a consistent stream of papers since.
1. https://github.com/phylum-dev/birdcage
2. https://github.com/phylum-dev/cli
Happy to see this on HN! I'm one of the co-founders @ Phylum.
We actively monitor and report on malware and software supply chain attacks across multiple ecosystems. Most notably, we were the first to identify and report on attacks carried out by North Korean state actors in NPM [1], prevented an early typosquat campaign against Rust developers on crates.io [2] and recently a faux email validation utility with a fairly complicated attack chain [3].
We've been monitoring npm the longest, and while I wouldn't classify this particular attack as complex or sophisticated, it's interesting in that it continues the trend of targeting build systems (and more generally, developers).
Our goal is to help clean up as many of these registries as possible, and to provide developers with the tooling to better protect themselves from attack. In doing so,
Read the rest
we're open sourcing as many things as we can. We recently open sourced our sandbox [4] that helps lock down disk/networking/env during process execution and have baked this into our open source cli so you can do things like:
phylum npm install <pkg>
To be clear, this particular package did not execute code during install, so the sandbox wouldn't have come into play, but it would have been blocked by the pre-check against Phylum's API.
Would greatly appreciate any feedback on our extensions and suggestions for improving our sandbox! We recently had a few individuals submit some great issues and suggestions, which we absolutely loved receiving.
Happy to answer any questions about software supply chain attacks or security in general!
1. https://blog.phylum.io/junes-sophisticated-npm-attack-attrib...
2. https://blog.phylum.io/rust-malware-staged-on-crates-io/
3. https://blog.phylum.io/npm-emails-validator-package-malware/
4. https://github.com/phylum-dev/birdcage
5. https://github.com/phylum-dev/cli
We're actively working on this with our sandbox (https://github.com/phylum-dev/birdcage). We've wrapped the likes of pip, yarn, and npm already and are making moves to similarly provide support for cargo.
Currently comes as part of the Phylum CLI (https://github.com/phylum-dev/cli), so that doing something like:
phylum npm install <somePkg>
Will reach out to the Phylum API to ask what we know about it (e.g., does the source have characteristics congruent with malware?), if that passes it'll then install the package from within the confines of the sandbox with limited disk, network and env access (as defined by allowed resources in the TOML file).
In Rust Malware Staged on Crates.ioHappy to see this on HN! I'm one of the co-founders @ Phylum.
We actively monitor and report on malware and software supply chain attacks across multiple ecosystems. Most notably, we were the first to identify and report on attacks carried out by North Korean state actors in NPM [1]. With our fairly recent addition of Crates.io support, we've begun monitoring and reporting on campaigns in the Rust ecosystem. In doing so, we identified what appeared to be staging of a malware campaign and were able to report it to Crates.io before it got too far along.
We're also in the process of releasing a beta `cargo` extension that will transparently query our API for information about a package, before it is permitted to install. This is available in our open-source CLI [2]. Prefixing `cargo` with `phylum` will perform this check before the build occ
Read the rest
urs:
phylum cargo build
In addition to this, we've also developed and released an open-source sandbox [3] that provides facilities for limiting access to disk, network, and environment variables. This is baked into our `npm`, `yarn`, and `pip` CLI extensions; we're working on adding it to more.
Would greatly appreciate any feedback on our Cargo extension and suggestions for improving our sandbox!
Happy to answer any questions about software supply chain attacks or security in general!
Stay tuned, we're tracking another fairly complicated supply chain attack.
1. https://blog.phylum.io/junes-sophisticated-npm-attack-attrib...
2. https://github.com/phylum-dev/cli
3. https://github.com/phylum-dev/birdcage
We (https://phylum.io) actually open sourced our sandbox for this exact purpose.
https://github.com/phylum-dev/birdcage
It's baked into our CLI and supports limiting access to network, disk, etc. during package installation. For example, running something like
phylum npm install react
Will perform the installation in a way that disallows access to disk and network that aren't explicitly approved. This prevents malicious packages from grabbing and exfiltrating things like developer SSH keys during package install.
In Social engineering campaign targeting tech employees spreads through NPM malwareBeen working on this exact thing for nearly two years at https://www.phylum.io. We identified and reported about 1.2k packages in ecosystems like npm, pypi and others last year. GitHub app that checks your PRs for malware. We also built a free open source sandbox for package installations [1] so if malware does get executed it’s done in a locked down environment. Happy to chat further about this sort of thing, it’s something I’m wildly interested in!
[1] https://github.com/phylum-dev/birdcage
In Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”(Disclaimer: I'm one of the co-founders at Phylum)
Our system has been alerting us to this actor's activities all morning (beginning sometime last night). They have been wildly active, and have continued to publish packages as we've worked to get them removed.
Interestingly, they have ported the Python bits to Javascript and have started publishing to NPM as well. Exact same TTP, crossing two ecosystems.
Our platform monitors these ecosystems, scanning packages for signs of risk as they are published. This way we can get them removed before they impact the wider open source community. We currently support Javascript, Typescript, Python, Ruby, Java, C# and recently just rolled out Golang and Rust support into beta.
We believe in a defense in depth approach to supply chain security and have also published an open source sandbox that limits
Read the rest
access to the filesystem, network, disk and environment variables.
https://github.com/phylum-dev/birdcage
This is rolled into our CLI so that you can do things like `phylum npm install <pkgName>` and install packages in a sandboxed way.
Happy to answer questions about this attack, security, sandboxes, etc!
Working on it! https://github.com/phylum-dev/birdcage
Allows you to specify the allowed permissions in a toml file. Still a wip, but would love some feedback!
In Malicious Python packages replace crypto addresses in developer clipboardsAwesome seeing this posted! Full disclosure: I'm a co-founder at Phylum.
This campaign is ongoing. Our system just notified us of two more packages, which have been reported to PyPI. I expect this list to continue to grow throughout the day.
As a related aside, we are working on a package sandbox that prevents access to disk, network and env variables during package installation. It's not quite ready for primetime, but it is completely open source and we'd love some early feedback/contributions!
https://github.com/phylum-dev/birdcage
If anyone has any questions, I'd be more than happy to answer them!
In Malicious Python packages replace crypto addresses in developer clipboardsThis is one of the projects we're working on (and open sourcing)!
Currently allows you to specify allowed resources during the package installation in a way very similar to what you've outlined [1].
The sandbox itself lives here [2] and can be integrated into other projects.
1. https://github.com/phylum-dev/cli/blob/main/extensions/npm/P...
2. https://github.com/phylum-dev/birdcage
In Dozens of malicious PyPI packages discovered targeting developersFull disclosure, I am a co-founder at Phylum.
We are actively working on a solution that will fully sandbox package installations for npm, yarn, poetry and others.
It's rolled up as part of our core CLI [1], but is totally open source [2]:
[1] https://github.com/phylum-dev/cli
[2] https://github.com/phylum-dev/birdcage
In Dozens of malicious PyPI packages discovered targeting developers