vet

Building vet. The goal is to automate open source package vetting beyond just CVE but actually identify code capabilities, malicious code and other security sensitive attributes through code analysis. https://github.com/safedep/vet

Someone recommended this to me on another thread and tried it yesterday and it seems very good: https://github.com/safedep/vet

- [supply-chain-security · GitHub Topics · GitHub](https://github.com/topics/supply-chain-security) - [GitHub - safedep/vet: Protect against malicious open source packages](https://github.com/safedep/vet) - [GitHub - AikidoSec/safe-chain](https://github.com/AikidoSec/safe-chain) - npm audit

May be give vet a try. It detected most of the malicious packages within few hours of publishing to npm. GitHub: https://github.com/safedep/vet

I am working on a next-gen software composition analysis tool that can identify malicious open source packages through code analysis. Adopts a policy as code (CEL) approach to build security guardrails against risky OSS components using opinionated policies. GitHub: https://github.com/safedep/vet

Not sure if it’s relevant because you specifically mentioned about B2C. For cyber security product, we took the open source route. We build our core technology in public as open source project. https://github.com/safedep/vet The commercial SaaS is for scaling and management. Our entire funnel is based on OSS. Folks who have already found value and is looking to scale their deployment. This model works for us especially at our current stage where we are 100% engineering led.

May be try out vet as well: https://github.com/safedep/vet vet is backed by a code analysis engine that performs malicious package (npm, pypi etc.) scanning. We recently extended it to support GitHub repository scanning as well. It found the malicious behaviour in mcp-servers-example/bad-mcp-server.js https://platform.safedep.io/community/malysis/01JRYPXM0SYTM8...

Hello HN! Creator and maintainer of vet here. We have been working on malicious OSS code identification through static code analysis for a while. After the recent tj-actions/changed-files hack, we wanted the ability scan GitHub Action code as well since most of them are Javascript anyway. One of the challenges with scanning GHA compared to other package registries such as pypi, npm is immutability. While npm, pypi etc. guarantees immutability for a published version of artifact, GHA tags are mutable. This means we cannot trust the results of a tag (e.g. v1) scanned in the past. To workaround this problem for GitHub Actions scanning, we choose to always resolve a given tag/branch to a commit SHA before actually performing code analysis.

I think the conventional approach of checking for vulnerabilities in 3rd party dependencies by querying CVE or some other database has set the current behaviour i.e. if its not vulnerable it must be safe. This implicit trust on vulnerability databases has been exploited in the wild to push malicious code to downstream users. I think we will see security tools shifting towards "code" as the source of truth when making safety and security decision about 3rd party packages instead of relying only on known vulnerability databases. Take a look at vet, we are working on active code analysis of OSS packages (+ transitive dependencies) to look for malicious code: https://github.com/safedep/vet

Hello HN! I want to share a new open source project I built. https://vetpkg.dev/ The goal is to provide a single view for developers and security engineers with all the information they need to make a decision about safety of an open source package. As the developer of https://github.com/safedep/vet, I often get feedback from users that installing and setting up vet in CI/CD with custom policies takes time. A web page using which anyone can quickly see package security metadata is a good start for engineers to quickly get new OSS packages approved internally. vetpkg.dev is open source, developed at https://github.com/safedep/vetpkg.dev It is a simple frontend over APIs that we built by aggregating public and private data sources on OSS package security and code analysis. vetpkg.dev also aggregates data from our OSS package code analysis t

vet now supports scanning OSS package code for malicious behaviour.

vet is a tool for identifying risks in open source software supply chain. It goes beyond just vulnerabilities and provides visibility on OSS package risks due to it's license, popularity, security hygiene, and more. vet is designed with the goal of helping software development teams consume safe and trusted OSS components through automated vetting in CI/CD.

If you are worried about the recent Lazarus group software supply chain attack, you should consider having guard rails that is more than conventional SCA. `vet` detects the package (version) published in the report as malware. Try out vet, its free and open source: https://github.com/safedep/vet More details on the attack: https://www.nodejs-security.com/blog/north-korea-malware-on-...