Risky Business Podcast: Why Open Source Software Needs Better Malware Tracking

Socket founder and CEO Feross Aboukhadijeh was recently a guest on the Risky Business podcast, where he joined cybersecurity journalist Patrick Gray to discuss the threat of malicious packages on open source software registries.

Feross highlighted the alarming frequency of attacks, with over 100 new supply chain threats identified each week across ecosystems like npm, RubyGems, PyPI, and Maven Central. These attacks often exploit developers’ trust through package hijacking or typosquatting, where attackers impersonate legitimate maintainers to insert malicious code. Once published, some of these packages can remain active for years, exposing users to risks like stolen environment variables, unauthorized command execution, and data exfiltration.

The Challenge of Centralized Threat Tracking

One of the central issues Feross addressed is the absence of a standardized repository for cataloging malicious packages. Unlike the National Vulnerability Database (NVD) for CVEs (Common Vulnerabilities and Exposures), no analogous system exists to track malware in software dependencies. Current practices often rely on private vendors like Socket to provide threat intelligence. However, these solutions are limited by the responsiveness of registries, many of which lack the resources to act swiftly.

Feross suggested exploring a more unified approach, proposing that the existing CVE infrastructure could be expanded to include malicious package tracking. This would leverage a system already integrated into many organizations’ compliance processes, ensuring broader adoption and more efficient detection.

Evolving Attacks Exploit Weaknesses in Open Source

The episode also explored the evolving tactics of attackers. From leveraging Ethereum smart contracts for command-and-control operations to targeting crypto wallets built on JavaScript-heavy frameworks like Electron, the sophistication of attacks is growing. Yet, Feross noted that many attacks are surprisingly unsophisticated, often succeeding due to a lack of developer scrutiny.

One notable example discussed was the infamous event-stream attack, which bears many similarities to the recent xz-utils attack. A malicious actor gained access to a popular package by offering to maintain it, only to later insert a backdoor. This incident underscored the systemic vulnerabilities in open source software management and inspired Feross to create Socket.

For more insights from this episode check out the video below: