Rory McCune's AppSec EU 2015 talk on security risks in modern software deployment. It covers weaknesses in package ecosystems like npm, RubyGems and PyPI, and repository compromise.
Why Hacker News points people here: The speaker and others cite it in threads about malicious packages and typosquatting.
“I did a talk last year for OWASP AppSecEU that covers this kind of thing.”HN comment, 2016
“I did a talk last year for OWASP AppSecEU that covers this kind of thing.”
Talk on risks of npm, rubygems, PyPI style package installation and repository compromise.
Full comment
Kind of amusing that this is considered to need a new vuln. report, I kind of assumed it was common knowledge. Most of the programming language package repositories (e.g. npm, rubygems, PyPi, NuGet) have this kind of installation process and limited/no checks for malicious content. Also as there's no consistent use of package signing by the developer (it's either unsupported or not very used) there is also a risk of the repository itself being compromised. I did a talk last year for OWASP AppSecEU that covers this kind of thing. this video
Cites itraesene10Jun 2016
“I actually did a talk last year for OWASP AppsecEU”
Compares curl|bash with package managers like rubygems and npm on security.
Full comment
For me they're very similar. I actually did a talk last year for OWASP AppsecEU where I started with the curl|bash bit and pointed out where rubygems/npm etc aren't really a lot better in some ways this video
Cites itraesene6Sep 2017
“I did a presentation on this topic for OWASP AppSecEU 2015”
Presentation on repository attacks and compromise in software package ecosystems.
Full comment
This isn't, in any way, a new problem. I did a presentation on this topic for OWASP AppSecEU 2015 ( this video ) and when doing the research for that I encountered cases of repo. attacks and compromise. IME the problem will continue unless the customers (e.g. companies making use of the libraries hosted) are willing to pay more for a service with higher levels of assurance. The budget required to implement additional security at scale is quite high, and probably not a good match with a free (at point of use) service.
