Following on from my last post on using the Trusty API for source of origin provenance, this post will expand on the topic and introduce how you can get a view on packages state of maintenance and risk.
Deprecated Packages
Let's first consider a real world, case. As a developer you're tasked with building an OAuth2 framework for Python. Like most of us, you will likely start with a google search. Opening an incognito session , we see the second result references a package on pypi:
Looking at the PyPi page shows a green 'Latest Version' button:
All, looks good. The last release was a while ago, but it is possible for a project to have limited exposure to other dependencies and a good definition of done.
However, let's check out the Trusty API and in particular the archived field
curl -sS https://api.trustypkg.dev/v2/pkg\?package_name\=python-oauth2\&package_type\=pypi |jq '.archived'
true
A quick visit to the GitHub repo confirms this is true:
Malicious Packages
Let's take a recent attack discovered by Trusty, where a popular Python package "requests" was typo-squatted with a package name "requestn".
curl -sS https://api.trustypkg.dev/v2/pkg\?package_name\=requestn\&package_type\=pypi |jq '.malicious'
{
"summary": "Malicious code in requestn (PyPI)",
"details": "This package is considered malicious because it extracts OS files of the localhost and sends the contents to an unknown Telegram channel.",
"published": "2024-06-06T13:18:09Z",
"modified": "2024-06-06T13:18:09Z",
"source": "https://osv.dev/vulnerability/MAL-2024-1547"
}
Visiting the referenced OSV link shows this is in fact a malicious package
As mentioned in my previous post, Trusty's API's are public and available for others to build upon. Have a good idea for a possible integration with our API? I would love to learn more, please let me know on X @decodebytes or via a comment on this post.
Top comments (0)