Hacker GitHub

← All repos

ossillate-inc/packj

View on GitHub ↗ ★ 694 Python

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

81 mentions on Hacker News by 10 people: 6 stories, 75 comments · first 2022-05-25 · latest 2026-08-31

Mentions per year 81 mentions · busiest year 2022 (31)
20082026
AllStoriesComments NewestTopOldest
  1. ▲ 3
    Open Source tool to detect software supply chain attacks
    story by daveP17 · 2026-08-31 · 0 comments
  2. ▲ 2
    Open source solution for supply chain attacks
    story by dave17 · 2026-08-24 · 1 comment
  3. I've been building an OSS tool to detect software supply-chain attacks: https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH…
    comment by ashishbijlani · 2026-08-04 · in Keyv and friends compromised in active Shai-Hulud supply chain attack
  4. Built Packj [1] to audit dependencies easily from CLI. 1. Packj ( https://github.com/ossillate-inc/packj ) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for…
    comment by ashishbijlani · 2026-06-01 · in Malicious npm packages detected across Red Hat Cloud Services
  5. ▲ 3
    Tell HN: Packj flags malicious/risky open-source packages
    story by my2c · 2026-05-22 · 0 comments
  6. Built Packj [1] to do exactly this. 1. Packj ( https://github.com/ossillate-inc/packj ) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of…
    comment by ashishbijlani · 2026-04-30 · in Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library
  7. …an interest, I'd love to collaborate and integrate Packj [1] audit for malware scans. 1. Packj ( https://github.com/ossillate-inc/packj ) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses…
    comment by ashishbijlani · 2026-02-06 · in Show HN: Artifact Keeper – Open-Source Artifactory/Nexus Alternative in Rust
  8. …Packj sandbox for agentic code execution [1]. You can specify allowlist for network/fs. 1. https://github.com/ossillate-inc/packj/blob/main/packj/sandb...
    comment by ashishbijlani · 2025-10-16 · in Cloudflare Sandbox SDK
  9. Plug: I've been building a tool to detect software supply-chain cyberattacks: https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of…
    comment by ashishbijlani · 2025-09-22 · in Show HN: Tips to stay safe from NPM supply chain attacks
  10. …It also checks for several metadata attributes to detect bad actors (e.g., typo squatting). 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2025-09-08 · in NPM debug and chalk packages compromised
  11. Plug: I've been building a similar tool: https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use…
    comment by ashishbijlani · 2025-05-03 · in Show HN: Pipask – safer pip without compromising convenience
  12. …also checks for several metadata attributes to detect impersonating packages (typo squatting). 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2024-12-15 · in Analysis of supply-chain attack on Ultralytics
  13. …It also checks for several metadata attributes to detect bad actors (e.g., typo squatting). 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2024-12-07 · in Ultralytics AI model hijacked to infect thousands with cryptominer
  14. Good to see Packj[1] as one of the malware scanners used. 1. https://github.com/ossillate-inc/packj Packj detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for…
    comment by ashishbijlani · 2024-11-21 · in A Study of Malware Prevention in Linux Distributions
  15. …It also checks for several metadata attributes to detect bad actors (e.g., typo squatting). 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2024-05-30 · in Cybercriminals pose as "helpful" Stack Overflow users to push malware
  16. …It also checks for several metadata attributes to detect bad actors (e.g., typo squatting). 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2024-03-31 · in XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
  17. …of SSH keys, network communication, use of decode+eval, etc.) OR presence of vulnerabilities. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2024-03-28 · in PyPI halted new users and projects while it fended off supply-chain attack
  18. …shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2024-02-29 · in Over 100k Infected Repos Found on GitHub
  19. …communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2024-01-19 · in A cautionary tale about software dependencies during major geopolitical events
  20. …communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-12-14 · in Ledger's NPM account has been hacked
  21. …challenge here: too restrictive will block functionality, too permissive defeats the purpose. 1. https://github.com/ossillate-inc/packj flags malicious/risky NPM/PyPI/RubyGems/Rust/Maven/PHP packages by carrying out static+dynamic+metadata…
    comment by ashishbijlani · 2023-11-15 · in Rust without crates.io
  22. …packages. Packj Github action [2] can alert if a risky dependency is pulled into your build. 1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action
    comment by ashishbijlani · 2023-11-14 · in Rust without crates.io
  23. …communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-11-14 · in We've learned nothing from the SolarWinds hack
  24. …communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-10-13 · in Making Rust supply chain attacks harder with Cackle
  25. …packages. Packj Github action [2] can alert if a risky dependency is pulled into your build. 1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action
    comment by ashishbijlani · 2023-10-07 · in A Deep Dive into 70 Layers of Obfuscated Info-Stealer Malware
  26. …packages. Packj Github action [2] can alert if a risky dependency is pulled into your build. 1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action
    comment by ashishbijlani · 2023-09-22 · in The Bogus CVE Problem
  27. …scorecards or even the checks that socket.dev do today on these packages to help determine risk? https://github.com/ossillate-inc/packj/blob/main/.packj.yaml Secondly, what about impersonation where attackers imitate a popular package and…
    comment by thenerdhead · 2023-09-10 · in A study of malicious code in PyPI ecosystem
  28. …code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-09-09 · in A study of malicious code in PyPI ecosystem
  29. …packages. It performs static/dynamic/metadata analysis to look for "suspicious” attributes. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-07-25 · in Social engineering campaign targeting tech employees spreads through NPM malware
  30. …code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-07-22 · in Malicious libraries can steal all your application secrets in Elixir
  31. …for reporting vulnerabilities. Hopefully, these findings will bolster open-source security. 1. http://github.com/ossillate-inc/packj flags vulnerable/malicious NPM/PyPI/Rubygems/Cargo/Packagist packages. I'm the lead dev.
    comment by ashishbijlani · 2023-06-24 · in Millions of GitHub repos likely vulnerable to RepoJacking, researchers say
  32. …Supporting VSCode/browser extensions is on our roadmap. Disclaimer: I'm the lead developer. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-05-22 · in Malicious VSCode extensions with more than 45k installs
  33. …packaged code vs repo code? If you're interested, I'd love to integrate this in Packj tool. 1. http://github.com/ossillate-inc/packj flags vulnerable/malicious NPM/PyPI/Rubygems packages.
    comment by ashishbijlani · 2023-05-05 · in Mischievous NPM Publications
  34. …sandboxing and blocks access to sensitive files and limits traffic to known-good IP addresses. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-04-27 · in How to use Podman inside of a container (2021)
  35. …supply-chain security. We are working on adding support to check for provenance in Packj. 1. https://github.com/ossillate-inc/packj flags risky/malicious NPM/PyPI/Ruby dependencies
    comment by ashishbijlani · 2023-04-19 · in NPM Provenance Public Beta
  36. …Would love to integrate this in Packj [1] as one of the open-source SAST scanners. Will DM you. 1. https://github.com/ossillate-inc/packj flags malicious/risky open-source dependencies.
    comment by ashishbijlani · 2023-04-13 · in Show HN: TypeScript Security Scanner
  37. …code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-03-30 · in 50% of new NPM packages are spam
  38. …get around rate limiting. We'd deeply appreciate if could create an issue for this on the repo. 1. https://github.com/ossillate-inc/packj#customization
    comment by ashishbijlani · 2023-02-25 · in NPM repository flooded with 15,000 phishing packages
  39. …or incorrect GitHub repo, very high version number, use of decode+exec, etc.). Full list here: https://github.com/ossillate-inc/packj/blob/main/packj/audit...
    comment by ashishbijlani · 2023-02-24 · in Aggressive Attack on PyPI Attempting to Deliver Rust Executable
  40. …packages. It performs static/dynamic/metadata analysis to look for "suspicious” attributes. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-02-24 · in Aggressive Attack on PyPI Attempting to Deliver Rust Executable
  41. …the number. This is why in Packj [1] we check for multiple attributes (e.g., dependents). 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-02-24 · in NPM repository flooded with 15,000 phishing packages
  42. …of GitHub code vs packaged code (provenance), change in APIs across versions, and several more. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-02-24 · in NPM repository flooded with 15,000 phishing packages
  43. ▲ 4
    Packj flags malicious/risky open-source packages
    story by mooreds · 2023-02-14 · 1 comment
  44. …as spawning of shell, exfiltration of data, mismatching repo code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2023-02-14 · in Harvesting credit card numbers and passwords from your site (2018)
  45. Very cool! I've built something similar, but for packages: https://github.com/ossillate-inc/packj Would love to talk.
    comment by ashishbijlani · 2023-01-26 · in Show HN: Coder Guard – Protect Your IDE from Malicious Extensions
  46. …registry based on Packj [1] that hosts vetted artifacts. Will post more about it publicly soon. 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.
    comment by ashishbijlani · 2023-01-15 · in Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”
  47. …spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.
    comment by ashishbijlani · 2023-01-15 · in Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”
  48. I’ve created Packj sandbox [1] for “safe installation” of PyPI/NPM/Rubygems packages 1. https://github.com/ossillate-inc/packj It DOES NOT require a VM/Container; uses strace. It shows you a preview of file system changes that installation…
    comment by ashishbijlani · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30
  49. …spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.
    comment by ashishbijlani · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30
  50. …spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.
    comment by ashishbijlani · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30