ossillate-inc/packj on Hacker News

I've been building an OSS tool to detect software supply-chain attacks: https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH…

comment by ashishbijlani · 2026-08-04 · in Keyv and friends compromised in active Shai-Hulud supply chain attack

Built Packj [1] to audit dependencies easily from CLI. 1. Packj ( https://github.com/ossillate-inc/packj ) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for…

comment by ashishbijlani · 2026-06-01 · in Malicious npm packages detected across Red Hat Cloud Services

Built Packj [1] to do exactly this. 1. Packj ( https://github.com/ossillate-inc/packj ) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of…

comment by ashishbijlani · 2026-04-30 · in Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

…an interest, I'd love to collaborate and integrate Packj [1] audit for malware scans. 1. Packj ( https://github.com/ossillate-inc/packj ) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses…

comment by ashishbijlani · 2026-02-06 · in Show HN: Artifact Keeper – Open-Source Artifactory/Nexus Alternative in Rust

…Packj sandbox for agentic code execution [1]. You can specify allowlist for network/fs. 1. https://github.com/ossillate-inc/packj/blob/main/packj/sandb...

comment by ashishbijlani · 2025-10-16 · in Cloudflare Sandbox SDK

Plug: I've been building a tool to detect software supply-chain cyberattacks: https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of…

comment by ashishbijlani · 2025-09-22 · in Show HN: Tips to stay safe from NPM supply chain attacks

…It also checks for several metadata attributes to detect bad actors (e.g., typo squatting). 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2025-09-08 · in NPM debug and chalk packages compromised

Plug: I've been building a similar tool: https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use…

comment by ashishbijlani · 2025-05-03 · in Show HN: Pipask – safer pip without compromising convenience

…also checks for several metadata attributes to detect impersonating packages (typo squatting). 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2024-12-15 · in Analysis of supply-chain attack on Ultralytics

…It also checks for several metadata attributes to detect bad actors (e.g., typo squatting). 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2024-12-07 · in Ultralytics AI model hijacked to infect thousands with cryptominer

Good to see Packj[1] as one of the malware scanners used. 1. https://github.com/ossillate-inc/packj Packj detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for…

comment by ashishbijlani · 2024-11-21 · in A Study of Malware Prevention in Linux Distributions

…It also checks for several metadata attributes to detect bad actors (e.g., typo squatting). 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2024-05-30 · in Cybercriminals pose as "helpful" Stack Overflow users to push malware

…It also checks for several metadata attributes to detect bad actors (e.g., typo squatting). 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2024-03-31 · in XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

…of SSH keys, network communication, use of decode+eval, etc.) OR presence of vulnerabilities. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2024-03-28 · in PyPI halted new users and projects while it fended off supply-chain attack

…shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2024-02-29 · in Over 100k Infected Repos Found on GitHub

…communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2024-01-19 · in A cautionary tale about software dependencies during major geopolitical events

…communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-12-14 · in Ledger's NPM account has been hacked

…challenge here: too restrictive will block functionality, too permissive defeats the purpose. 1. https://github.com/ossillate-inc/packj flags malicious/risky NPM/PyPI/RubyGems/Rust/Maven/PHP packages by carrying out static+dynamic+metadata…

comment by ashishbijlani · 2023-11-15 · in Rust without crates.io

…packages. Packj Github action [2] can alert if a risky dependency is pulled into your build. 1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action

comment by ashishbijlani · 2023-11-14 · in Rust without crates.io

…communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-11-14 · in We've learned nothing from the SolarWinds hack

…communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-10-13 · in Making Rust supply chain attacks harder with Cackle

…packages. Packj Github action [2] can alert if a risky dependency is pulled into your build. 1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action

comment by ashishbijlani · 2023-10-07 · in A Deep Dive into 70 Layers of Obfuscated Info-Stealer Malware

…packages. Packj Github action [2] can alert if a risky dependency is pulled into your build. 1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action

comment by ashishbijlani · 2023-09-22 · in The Bogus CVE Problem

…scorecards or even the checks that socket.dev do today on these packages to help determine risk? https://github.com/ossillate-inc/packj/blob/main/.packj.yaml Secondly, what about impersonation where attackers imitate a popular package and…

comment by thenerdhead · 2023-09-10 · in A study of malicious code in PyPI ecosystem

…code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-09-09 · in A study of malicious code in PyPI ecosystem

…packages. It performs static/dynamic/metadata analysis to look for "suspicious” attributes. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-07-25 · in Social engineering campaign targeting tech employees spreads through NPM malware

…code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-07-22 · in Malicious libraries can steal all your application secrets in Elixir

…for reporting vulnerabilities. Hopefully, these findings will bolster open-source security. 1. http://github.com/ossillate-inc/packj flags vulnerable/malicious NPM/PyPI/Rubygems/Cargo/Packagist packages. I'm the lead dev.

comment by ashishbijlani · 2023-06-24 · in Millions of GitHub repos likely vulnerable to RepoJacking, researchers say

…Supporting VSCode/browser extensions is on our roadmap. Disclaimer: I'm the lead developer. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-05-22 · in Malicious VSCode extensions with more than 45k installs

…packaged code vs repo code? If you're interested, I'd love to integrate this in Packj tool. 1. http://github.com/ossillate-inc/packj flags vulnerable/malicious NPM/PyPI/Rubygems packages.

comment by ashishbijlani · 2023-05-05 · in Mischievous NPM Publications

…sandboxing and blocks access to sensitive files and limits traffic to known-good IP addresses. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-04-27 · in How to use Podman inside of a container (2021)

…supply-chain security. We are working on adding support to check for provenance in Packj. 1. https://github.com/ossillate-inc/packj flags risky/malicious NPM/PyPI/Ruby dependencies

comment by ashishbijlani · 2023-04-19 · in NPM Provenance Public Beta

…Would love to integrate this in Packj [1] as one of the open-source SAST scanners. Will DM you. 1. https://github.com/ossillate-inc/packj flags malicious/risky open-source dependencies.

comment by ashishbijlani · 2023-04-13 · in Show HN: TypeScript Security Scanner

…code vs packaged code (provenance), change in APIs across versions, etc. to flag risky packages. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-03-30 · in 50% of new NPM packages are spam

…get around rate limiting. We'd deeply appreciate if could create an issue for this on the repo. 1. https://github.com/ossillate-inc/packj#customization

comment by ashishbijlani · 2023-02-25 · in NPM repository flooded with 15,000 phishing packages

…or incorrect GitHub repo, very high version number, use of decode+exec, etc.). Full list here: https://github.com/ossillate-inc/packj/blob/main/packj/audit...

comment by ashishbijlani · 2023-02-24 · in Aggressive Attack on PyPI Attempting to Deliver Rust Executable

…packages. It performs static/dynamic/metadata analysis to look for "suspicious” attributes. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-02-24 · in Aggressive Attack on PyPI Attempting to Deliver Rust Executable

…the number. This is why in Packj [1] we check for multiple attributes (e.g., dependents). 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-02-24 · in NPM repository flooded with 15,000 phishing packages

…of GitHub code vs packaged code (provenance), change in APIs across versions, and several more. 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-02-24 · in NPM repository flooded with 15,000 phishing packages

…as spawning of shell, exfiltration of data, mismatching repo code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2023-02-14 · in Harvesting credit card numbers and passwords from your site (2018)

Very cool! I've built something similar, but for packages: https://github.com/ossillate-inc/packj Would love to talk.

comment by ashishbijlani · 2023-01-26 · in Show HN: Coder Guard – Protect Your IDE from Malicious Extensions

…registry based on Packj [1] that hosts vetted artifacts. Will post more about it publicly soon. 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.

comment by ashishbijlani · 2023-01-15 · in Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”

…spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.

comment by ashishbijlani · 2023-01-15 · in Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”

I’ve created Packj sandbox [1] for “safe installation” of PyPI/NPM/Rubygems packages 1. https://github.com/ossillate-inc/packj It DOES NOT require a VM/Container; uses strace. It shows you a preview of file system changes that installation…

comment by ashishbijlani · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30

…spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.

comment by ashishbijlani · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30

…spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.

comment by ashishbijlani · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30

…install-time filesystem/network activities. We have detected a bunch of malware with the tool. 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.

comment by ashishbijlani · 2022-12-23 · in Python malware starting to employ anti-debug techniques

…Packj [1] uses OSV APIs to report vulnerable PyPI/NPM/Rubygems packages. Disclaimer: I built it. 1. https://github.com/ossillate-inc/packj flags malicious/risky packages.

comment by ashishbijlani · 2022-12-18 · in Vulnerability scanner written in Go that uses osv.dev data

…this project here! Have you added support for permissions already? Would love to integrate this in https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2022-12-09 · in Show HN: Panoptisch – A recursive dependency scanner for Python projects

…spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj

comment by ashishbijlani · 2022-12-09 · in Ransomware Python Packages Currently Being Published to PyPI