expertmadman @ expertmadman @sh.itjust.works

Posts

4

Comments

5

Joined

2 yr. ago

we’re working on a third party solution for this. Should have some updates that sandbox cargo builds shortly.

https://github.com/phylum-dev/birdcage

It’s a cross-platform sandbox that works on Linux via Landlock and macOS via Seatbelt. We’ve rolled this into our CLI (https://github.com/phylum-dev/cli) so you can do thinks like:

        phylum  


  

For example for npm, which currently uses the sandbox:

        phylum npm install


  

We’re adding this to cargo to similarly sandbox crate installations. Would love feedback and thoughts on our sandbox!

I'm one of the co-founders @ Phylum. We have a history of reporting these attacks/malware to the appropriate organizations. We work closely with PyPI, NPM, Github, and others - and have reported thousands of malicious packages in the last few years. If you were following GIthub's recent security advisory, you can see a shout-out for some of our previous work. There are also public thanks from the Crates.io team for our efforts over on HN.

I say all this to assure you we didn't write or release this malware. It just wouldn't make sense, especially when these open-source ecosystems contain so much malware for us to hunt and report on already. Though I get the logic, we have seen other security companies do this - and called them out for it.

Our platform is free for developers and small teams (heck, I'll give anyone who asks for it a free pro account if you really need it). We've open-sourced our CLI and sandbox that limits access to network/disk/env during package installation. We're genuinely - really - trying to help make these ecosystems safer.

https://blog.phylum.io/sophisticated-highly-targeted-attacks-continue-to-plague-npm/

tl;dr several packages were recently published to npm that appear to be subtle command and control. Behaviors of the infrastructure seem to mimic those recently identified by Phylum as being nation state activity from North Korea.

I screwed up submission

https://blog.phylum.io/sophisticated-highly-targeted-attacks-continue-to-plague-npm/

Slackware was my first Linux distro