Hacker GitHub

← All repos

ossillate-inc/packj

View on GitHub ↗ ★ 694 Python

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

81 mentions on Hacker News by 10 people: 6 stories, 75 comments · first 2022-05-25 · latest 2026-08-31

Mentions per year 81 mentions · busiest year 2022 (31)
20082026
AllStoriesComments NewestTopOldest
  1. …a bunch of malicious packages on PyPI/RubyGems using the tool, which have now been taken down. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-12-01 · in Ask HN: What Are You Working On? (December 2022)
  2. …spawning of shell, use of SSH keys, mismatch of GitHub code vs packaged code (provenance), etc. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-11-23 · in Analysis on Docker Hub malicious images: Attacks through public container images
  3. …a bunch of malicious packages on PyPI/RubyGems using the tool, which have now been taken down. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-11-18 · in Ask HN: What is the most impactful thing you've built?
  4. …package search right in IDE. I'd be interested to integrate Packj [1]. Sent you an email. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-11-08 · in Show HN: I built VS Code extension for Node.js package management
  5. I built Packj to flag such "risky" packages: https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-11-04 · in Dozens of malicious PyPI packages discovered targeting developers
  6. …particularly when we hear about new attacks on open-source package managers almost every week? 1. https://github.com/ossillate-inc/packj [Disclaimer: I built it]
    comment by ashishbijlani · 2022-11-04 · in Dozens of malicious PyPI packages discovered targeting developers
  7. That’s exactly why I use strace-based to sandbox ALL dependencies: https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-11-02 · in Dozens of malicious PyPI packages discovered targeting developers
  8. …exfiltrates data, is abandoned, lacks 2FA, etc. Alerts could be commented out if don't apply. 1. https://github.com/ossillate-inc/packj Disclaimer: I developed this.
    comment by ashishbijlani · 2022-11-02 · in Dozens of malicious PyPI packages discovered targeting developers
  9. …spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance). 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-11-02 · in Dozens of malicious PyPI packages discovered targeting developers
  10. Packj sandbox [1] offers "safe installation" of PyPI/NPM/Rubygems packages. 1. https://github.com/ossillate-inc/packj/blob/main/packj/sandb... It DOES NOT require a VM/Container; uses strace. It shows you a preview of file system changes…
    comment by ashishbijlani · 2022-11-02 · in Dozens of malicious PyPI packages discovered targeting developers
  11. I built Packj https://github.com/ossillate-inc/packj to scan NPM/PyPI/Ruby packages for CVEs and malicious/risky attributes.
    comment by ashishbijlani · 2022-10-18 · in Jetstack Paranoia: A New Open-Source Tool for Container Image Security
  12. …help in avoiding accidental installation of malicious packages. Disclaimer: I’m one of the devs. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-10-18 · in “You meant to install ripgrep”
  13. …in this space that I missed? 0: https://tidelift.com/solutions/catalogs 1: https://bytesafe.dev/ 2: https://github.com/ossillate-inc/packj 3: https://ossillate.com/ 4: https://socket.dev/ 5: https://github.com/lunasec-io/lunasec/
    comment by freeqaz · 2022-09-07 · in Why has software supply chain security exploded?
  14. Packj https://github.com/ossillate-inc/packj can easily detect such malicious packages by pointing out if a package accesses sensitive files (e.g., SSH keys), spawns executables, exfiltrates data, is abandoned, lacks 2FA, etc. Disclaimer:…
    comment by ashishbijlani · 2022-08-12 · in PyPI package 'secretslib' drops fileless Linux malware to mine Monero
  15. …using the tool, which have now been taken down; a few are listed here https://packj.dev/malware 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-08-12 · in No, you cannot trust third party code without reading it first
  16. …is equivalent to "runtime code generation" [1]; a developer can go and take a deeper look then. 1. https://github.com/ossillate-inc/packj/blob/main/main.py#L47...
    comment by ashishbijlani · 2022-06-27 · in PyPI: Python packets steal AWS keys from users
  17. …of shell commands (exec system call) [2]. I've updated threats.csv to flag code obfuscation. 1. https://github.com/ossillate-inc/packj/blob/main/main.py#L48... 2. https://github.com/ossillate-inc/packj/blob/main/main.py#L48...
    comment by ashishbijlani · 2022-06-27 · in PyPI: Python packets steal AWS keys from users
  18. https://github.com/ossillate-inc/packj#how-it-works I imagine you'd want some kind of fuzzer with security-oriented tracing on top. I've never heard of such a tool, but I'd bet it exists somewhere.
    comment by lrem · 2022-06-27 · in PyPI: Python packets steal AWS keys from users
  19. …using the tool, which have now been taken down; a few are listed here https://packj.dev/malware 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-06-27 · in PyPI: Python packets steal AWS keys from users
  20. …NPM/PyPI packages [1] still shows expired email domain for browserify (a top NPM package) 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-05-31 · in Top-500 NPM package maintainers now require 2FA
  21. Would love to integrate this in https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-05-30 · in Show HN: Find NPM Package Alternatives
  22. …taken down; a few are listed here https://packj.dev/malware Would love to get your feedback. 1. https://github.com/ossillate-inc/packj
    comment by ashishbijlani · 2022-05-30 · in Ask HN: What is the most interesting software you wrote in a few days?
  23. Packj tool ( https://github.com/ossillate-inc/packj ) analyzes Python/NPM packages for risky code and attributes such as Network/File permissions expired email domains. It uses static code analysis. We are adding support for Rust. We found…
    comment by ashishbijlani · 2022-05-27 · in Today’s JavaScript, from an outsider’s perspective (2020)
  24. Tool: https://github.com/ossillate-inc/packj
    comment by riyakhanna1983 · 2022-05-27 · in PyConUS talk on detecting malicious Python packages
  25. https://github.com/ossillate-inc/packj analyzes Python/NPM packages for risky code and metadata attributes. Uses static code analysis. We found a bunch of malicious packages on PyPI using the tool, which have now been taken down: examples…
    comment by ashishbijlani · 2022-05-25 · in Python utility for tracking third party dependencies within a library