Watch
Russ Cox at ACM SCORED: Open Source Supply Chain Security at Google
Go's tech lead walks through real supply-chain attacks and how Go's design (checksum database, reproducible builds, no install-time code execution) defends against each.
Dependencies and the Supply Chain
Mistakes to catch in review
An import of a package that does not exist, or of a lookalike name an attacker registered to catch exactly that mistake.
A large dependency added to replace ten lines of code.
Unpinned versions that pull in a compromised release on the next install.
Install scripts that run arbitrary code on every developer machine and build server.
Every package you install, and every package it pulls in, is code you run with your own permissions.
Topics
- Choosing Dependencies
- Checking maintenance, ownership, license and size before adding a package, and preferring fewer packages overall.
- Pinning and Lockfiles
- Making installs reproducible and updates deliberate.
- Vulnerability Scanning and Patching
- Finding known vulnerabilities in dependencies and updating them on a steady schedule.
- Hallucinated and Typosquatted Packages
- Package names that models invent and attackers register, and how to verify a package is the real one.
- Provenance and SBOMs
- Build attestations, signatures and software bills of materials that show what went into a release.
You understand it when you can
- Evaluate a dependency's maintenance, ownership and security history before adding it.
- Explain what a lockfile guarantees and what it does not.
- Explain how to find every dependency a project ships, direct and transitive, and why the transitive ones need the same scrutiny.
Drill
An agent's pull request adds three packages: one whose name is a single letter off a popular library, one that brings in 140 transitive dependencies to pad a string, and one with an install script that downloads a binary. Decide which to reject, and show how you would confirm that each package is the one you think it is.
Start here
Watch
Analysis of an exploited npm package – Jarrod Overson
Takes apart the event-stream compromise, where a new maintainer slipped a targeted payload into a transitive dependency, showing how an unpinned install pulls in malicious code.
USENIX Security '23 - Beyond Typosquatting: An In-depth Look at Package Confusion
Research on the ways developers are misled into importing the wrong package, typosquats and lookalike names among them, and how to detect confusable names.
Read
Software Supply Chain Security: Securing the End-to-End Supply Chain for Software, Firmware, and Hardware
Identifies the risks and controls at each link of the chain, from secure development to third-party risk and software transparency.
Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
Explains SBOMs, attestations and provenance: what they record, how producers and consumers use them, and how they show what went into a release.
Software Engineering at Google: Lessons Learned from Programming Over Time
Its dependency-management chapter explains why every added dependency is a long-term cost and why version resolution is hard, which is the case for adding fewer packages.
Primary sources
Paper
We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs
The primary study measuring how often code models invent package names that do not exist, the basis for the 'slopsquatting' attack in this subsection's catches.
Specification
SLSA Specification v1.1
Defines build provenance and the levels of assurance it gives, so you can verify an artifact was built from the source and pipeline you expect.