Tidelift

Tieg Zaharia
Tieg Zaharia

Posted on

Digging into the Data: OSS Repo Supply Chain Attacks

I had just wrapped up some internal research on OSS supply chain compromises last Friday when I saw Pypi's announcement about requiring 2FA on critical Pypi projects.

It seemed like great news for the OSS community — free hardware keys too! 🥹 — especially since NPM and Rubygems have been working towards similar aspirations.

But then some fallout occurred, and we saw a maintainer react to the news by de-critical'ing their project by deleting older versions. Luckily the versions were restored in the end.

It was a bit disheartening to see a maintainer react so negatively to 2FA. There's no way for the public to know how secure a maintainer's password is, so 2FA is a better level of protection as well as a nice assurance for downstream users.

Based on the open data that I've aggregated (shout out to the researchers uncovering these attacks!) it seems that the issue of repository security needs to be more public.

Graphing the Data

I've categorized the OSS repo compromises I found into several categories:

  • typosquatting
  • hijacking (e.g. account takeovers)
  • dependency confusion
  • social engineering (e.g. generally tricking people into using your malware)
  • self-sabotage
  • package manager vulnerability

Image description

The majority of repos that I found compromise data for were NPM and Pypi, with a bit of Rubygems:

Image description

Data Caveats 🧐

One has to consider some major caveats here:

  • attacks are only found where/when people are looking
  • this is only the public data we've found; there are certainly unpublished attacks out there
  • some of these attacks are actually grouped findings involving separate actors
  • on a positive note, occasionally these attacks are just pen-testers and researchers

Ecosystem 📈

It's clear that supply chain attacks have intensified (and package hijackings haven't gone away), but thanks to the work in the past four-ish years to repository contributors, we've seen:

  • 2FA and API key improvements on NPM, Nuget, Pypi and Rubygems
  • repository-signed packages on NPM and Pypi
  • author-signed packages fully supported on Nuget, and being discussed for Pypi/Rubygems

Please shout out any other big repo security milestones I've missed here in the comments, or if you have thoughts/feelings on these measures.

Also... thanks to Lifters for generally taking this stuff seriously too. 🥲

Discussion (0)