The Cyber Defense eMagazine November Edition for 2023

An analysis of the largest, most active software package managers developers pull packages from found
that in Q2, an average of about 28,000 packages were published every day - a staggering amount when
considering that most of these package managers have a veritable skeleton crew on staff of usually one
to three individuals responsible for trying to manage and triage all of the software being published. While
these ecosystems are the primary locations developers pull packages from in order to build software, the
contents are largely unvetted. In fact, bursts of bad activity have actually triggered some of these
ecosystems to shut down portions of their functionality altogether.
Phylum's research reports for Q1 and Q2 Security researchers have noted an increase in incidents in
which bad actors have pumped out hundreds of thousands of packages that are either spam or actively
malicious incidents in which bad actors have pumped out hundreds of thousands of packages that are
either spam or actively malicious; the vast majority of which targeted software developers and CI/CD
infrastructure. While some of these attacks take a spray-and-pray approach, many are much more
targeted. Attacks like dependency confusion enable malicious actors to surgically target organizations
through their software supply chains, and a massive rise in typosquatting attacks, which may come in a
surprising variety of flavors, tend to target popular open-source packages in use by organizations of
interest. Additionally, threat actors have also employed attacks against the package maintainers
themselves in order to gain a foothold.
Software Developers: The New Keepers of the Crown Jewels
Software developers have become the new high-value targets, owning much more privilege, with much
less security and oversight than in the past. Attackers are capitalizing on this, as evidenced by the
dramatic increase in software supply chain-borne attacks and compromises in recent years, and targeted
attacks on software developers in many recent breaches.
Organizations have their work cut out for them in adjusting security posture to match organizational
changes driven by digital transformation. A rapid focus on closing these security gaps is now critically
important, as it is now more a matter of when, rather than if, a breach as a result of a malicious package
installed from the open-source ecosystem occurs without intervention.
About the Author
My name is Aaron Bray, CEO and Co-Founder, Phylum. Aaron has 14 years of
experience working in software engineering and information security. He spent
11 years working within the U.S. Intelligence Community before joining Sony to
lead development for the Global Threat Emulation cell. Aaron’s past research
has focused on program synthesis, malware diversity, software anomaly
detection, and the application of natural language processing techniques to
binary analysis. Aaron can be reached online at aaron@phylum.com and
https://www.linkedin.com/in/aaron-bray-422ba06a/ and at our company
website http://www.phylum.io
Cyber Defense eMagazine – November 2023 Edition 106
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.