Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

Unearthing Malicious and Risky OpenSource Packages Using Packj

nullcon via YouTube

Start learning Write review
TrainSec Ad

Master Windows Internals - Kernel Programming, Debugging & Architecture

Learn More → Coursera Ad

Learn AI, Data Science & Business — Earn Certificates That Get You Hired

Learn More →

Overview

Google, IBM & Meta Certificates – 40% Off
One Coursera Plus subscription covers most Professional Certificates on Coursera.
Unlock All Certificates
This course presents software supply-chain attacks affecting open-source package managers and introduces Packj, a framework for continuously vetting packages. It covers attack techniques, metadata checks, static analysis, runtime analysis, and examples of detecting malicious packages.

Syllabus

Intro
Open-source software is everywhere
Package Managers
Package Installation today - dependency hell
Software Supply Chain Attack
Attack Techniques: Typosquatting
Technique: Social Engineering
Technique: Dependency Confusion
Technique: Account Hijacking
How do we defend against these attacks?
Manual Vetting is infeasible
Vanity Stats are not enough
Packj: a dev-friendly vetting tool
Deep Metadata Analysis
Rigorous API Analysis
Runtime Analysis
Remote Code Execution Attack
Dependency Confusion Attack - Feb 2021
Colors and Faker Attack - Jan 2022

Taught by

nullcon

Reviews

Start your review of Unearthing Malicious and Risky OpenSource Packages Using Packj

Start learning

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Sign up for free
Someone learning on their laptop while sitting on the floor.