No Package is an Island: Looking at Context when Assessing Package Security - Elizabeth Wyss
No Package is an Island: Looking at Context when Assessing Package Security - Elizabeth Wyss, University of Kansas
OpenSSF has spearheaded a number of tools for computing and aggregating package security metrics, such as the ScoreCard framework. These tools are extremely valuable for developers seeking to make informed security decisions about their OSS ingestion pipeline. They also enabled a thriving research community focused on the security of ecosystems such as npm or PyPI. Given the critical role of these tools, it is important to ask ourselves--how could they be made even better? To answer this, we observe that most metrics look at properties of packages in isolation--who develops them, which best-practices are followed, etc. However, many problematic packages can only be identified in relation to the rest of the ecosystem. We present two examples of such relational properties. The first is package clones--instances where developers use malicious or outdated copies (clones) of a popular package. The second is typosquatting, where one package poses under a name that is easily confusable with another. We discuss our progress in this space, showing that plenty of insecure and actively downloaded clones exist in npm, which often also commit typosquatting. We also show how new metrics and tools can be used to quickly and efficiently identify those clones, making the case for their adoption.