Differential Static Analysis for Detecting Malicious Updates to Open Source Packages

Froh, Fabian ; Gobbi, Matías F. und Kinder, Johannes (2023): Differential Static Analysis for Detecting Malicious Updates to Open Source Packages. CCS '23: ACM SIGSAC Conference on Computer and Communications Security, Copenhagen Denmark, 30 November 2023. Torres-Arias, Santiago; Melara, Marcela S; Simon, Laurent; Vasilakis, Nikos und Moriarty, Kathleen (eds.) : In: Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses, New York, NY, United States: Association for Computing Machinery. pp. 41-49

Abstract

Modern software applications routinely integrate many third-party open source dependencies, with package managers delivering timely updates of the entire dependency tree. The downside is that malicious actors can inject malicious code into widely-used software packages, which is then distributed to potentially thousands of direct or indirect client applications. Such attacks on the software supply chain are no longer just theoretical curiosities, but a practical risk. To mitigate this risk, we propose a new approach using differential static analysis to flag malicious code modifications in package updates. We use specifications in the CodeQL query language to match suspicious behavior and compare results across package versions. Where we detect an anomalous change in behavior, we classify that package update as potentially malicious and requiring further analysis. We show that our approach successfully identifies all malicious versions on a dataset of packages with a history of malicious code; on a dataset of popular benign packages from the npm repository, we obtain on average 1.3% false alarms, demonstrating that our approach holds promise for practical deployment as a warning system on the open source software supply chain.

• Item Type: Conference or Workshop Item (Paper)
• Faculties: Mathematics, Computer Science and Statistics > Computer Science
• Subjects: 000 Computer science, information and general works > 004 Data processing computer science
• ISBN: 979-8-4007-0263-1
• Place of Publication: New York, NY, United States
• Language: English