South Tyrol Free Software Conference, profile picture
Uploaded bySouth Tyrol Free Software Conference
100 views

SFScon 21 - Duc Ly Vu - LastPyMile: a lightweight approach for securing Python ecosystem from software supply chain attacks

The document discusses a research project funded by various EU Horizon 2020 programs, focusing on a lightweight method called LastPymile for securing the Python ecosystem against software supply chain attacks. It highlights the prevalence of discrepancies between source code and distributed packages on PyPI, with a significant percentage of packages containing malicious code vulnerabilities. The paper outlines the challenges of verifying package security at scale and proposes solutions to improve the detection and prevention of code injection threats.

Embed presentation

Download to read offline
This research has been partly funded by the EU H2020 Programs H2020-EU.2.1.1-CyberSec4Europe (Grant No. 830929), AssureMoss (Grant No. 952647) and SPARTA project (Grant No. 830892). LastPyMile: a lightweight approach for securing Python ecosystem from software supply chain attack D.L. Vu1 F. Massacci1,2 I. Pashchenko1 H. Plate3 A. Sabetta3 1 University of Trento, IT, 2 Vrije Universiteit Amsterdam, NL, 3 SAP Security Research, FR
In FOSS, we all go and use the Source, don’t we? • Well, mostly not, we all download a binary (for Linux), or a package (in Python) from a repository (e.g. PyPI) • What if • the package in PyPI is NOT the “same” as the source in Github? • In the top 2.5K packages in PyPI (around 10MLoC), 65% have subtle differences, 5% changes in Python code • Malicious code anyone? • How to check this AT SCALE? • PyPI’s ~10 maintainers must “shepherd” 400K package owners • In 2020 → 1.9K updates x day with average of 3.5K files by 77K developers • Reproducible builds? A non-starter → too many developers, too many diffs • Gitlog? Malware check all lines? A non starter → even 1 False Positive x #updates ... 2 2
A PyPI Journey: From Source to Package 3
A PyPI Journey: From Source to Package 3 Start releasing Source code repo (e.g., Github) Development
A PyPI Journey: From Source to Package 3 Start releasing Build, additional code generation (e.g., Swagger, Codegen Release-ready code config info: - CI credentials - Source code repo credentials Source code repo (e.g., Github) Development
A PyPI Journey: From Source to Package 3 Start releasing Build, additional code generation (e.g., Swagger, Codegen Upload to package repo (e.g., by twine) Release-ready code Generated Artifacts Possibly: - OS binaries - Test Coverage Log - Documentation - Automated generated code config info: - CI credentials - Source code repo credentials config info: - Package repo credentials Source code repo (e.g., Github) Development Build systems (CI Cloud services such as Travis CI, developers’ workstation, etc.) Build and Publication
A PyPI Journey: From Source to Package 3 Start releasing Build, additional code generation (e.g., Swagger, Codegen Upload to package repo (e.g., by twine) Release-ready code Generated Artifacts Possibly: - OS binaries - Test Coverage Log - Documentation - Automated generated code Generated Artifacts in package repo (PyPI) Possibly: - OS binaries - Test Coverage Log - Documentation - Automated generated code config info: - CI credentials - Source code repo credentials config info: - Package repo credentials Source code repo (e.g., Github) Development Build systems (CI Cloud services such as Travis CI, developers’ workstation, etc.) Build and Publication End releasing Consumption Package repository
Current Package Scanners 4
Current Package Scanners 4 Get a Package
Current Package Scanners 4 Get a Package PyPI
Current Package Scanners 4 Get a Package PyPI Select files for review
Current Package Scanners 4 Get a Package PyPI Select files for review Selected files (e.g., setup.py)
Current Package Scanners 4 Get a Package PyPI Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check)
Current Package Scanners 4 Get a Package PyPI Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Output Review
Current Package Scanners 4 Get a Package PyPI Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Output Review Malicious code can be embedded in to a different file
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Output Review Malicious code can be embedded in to a different file
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Output Review Malicious code can be embedded in to a different file
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Output Review Files, and resources Malicious code can be embedded in to a different file
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Files, and resources Malicious code can be embedded in to a different file
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code repository Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source Code Scanners Source code repository Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
Current Package Scanners 4 Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source Code Scanners Source code repository Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP All files/lines + resource intensive + human effort => many FP + not possible to perform on-the-fly
LastPyMile to Identify Code Injection 5 Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
LastPyMile to Identify Code Injection 5 LastPyMile Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
LastPyMile to Identify Code Injection 5 LastPyMile Identify source code repo (Step 1) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
LastPyMile to Identify Code Injection 5 LastPyMile Identify source code repo (Step 1) Hash Files & Collect Lines from Repo (Step 2) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
LastPyMile to Identify Code Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Repo (Step 2) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
LastPyMile to Identify Code Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Artifact (Step 3) Hash Files & Collect Lines from Repo (Step 2) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
LastPyMile to Identify Code Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Artifact (Step 3) Hash Files & Collect Lines from Repo (Step 2) Identify phantom files and lines (Step 4) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
LastPyMile to Identify Code Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Artifact (Step 3) Hash Files & Collect Lines from Repo (Step 2) Identify phantom files and lines (Step 4) Filter Input Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
LastPyMile to Identify Code Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Artifact (Step 3) Hash Files & Collect Lines from Repo (Step 2) Identify phantom files and lines (Step 4) Filter Input Filter Output Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
LastPyMile Combined with other Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
LastPyMile Combined with other Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
LastPyMile Combined with other Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
LastPyMile Combined with other Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
LastPyMile Combined with other Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
LastPyMile Combined with other Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
LastPyMile Combined with other Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
LastPyMile Combined with other Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
LastPyMile Combined with other Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
LastPyMile LastPyMile is a simple yet efficient methodology that allows you to identify discrepancies between packages and sources. Combined with other package scanners, LastPyMile is promising to be used for scanning for the maliciousness of injected code. Future plans: The code is under review by a company - stay tuned… We plan to submit LastPyMile to PyPA as a new check for the uploaded packages. Check out our replication package: https://zenodo.org/record/4899935 Want to know more about LastPyMile? Have ideas? Want to contribute? 7 Feel free to reach us!

More Related Content

PDF
Rust + python: lessons learnt from building a toy filesystem
byChengHui Weng
 
PDF
Python packaging and dependency resolution
byTatiana Al-Chueyr
 
PPTX
2016 bioinformatics i_bio_python_wimvancriekinge
byProf. Wim Van Criekinge
 
PDF
Catching Insider Data Theft with Stochastic Forensics 2012
by- Mark - Fullbright
 
PDF
Find and Locate: Two Commands
byKevin OBrien
 
PPTX
Introduction to Python for Security Professionals
byAndrew McNicol
 
PDF
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)
byCode Engn
 
PPT
Os Vanrossum
byoscon2007
 
Rust + python: lessons learnt from building a toy filesystem
byChengHui Weng
 
Python packaging and dependency resolution
byTatiana Al-Chueyr
 
2016 bioinformatics i_bio_python_wimvancriekinge
byProf. Wim Van Criekinge
 
Catching Insider Data Theft with Stochastic Forensics 2012
by- Mark - Fullbright
 
Find and Locate: Two Commands
byKevin OBrien
 
Introduction to Python for Security Professionals
byAndrew McNicol
 
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)
byCode Engn
 
Os Vanrossum
byoscon2007
 

Similar to SFScon 21 - Duc Ly Vu - LastPyMile: a lightweight approach for securing Python ecosystem from software supply chain attacks

PDF
PyCon 2013 : Scripting to PyPi to GitHub and More
byMatt Harrison
 
PDF
Tools to help you write better code - Princeton Wintersession
byHenry Schreiner
 
PPTX
icse-presentation.pptx
byLyVu52
 
PDF
Open source projects with python
byroskakori
 
PPTX
Complete python toolbox for modern developers
byJan Giacomelli
 
PDF
Infecting Python Bytecode
byIftach Ian Amit
 
KEY
PyCon AU 2012 - Debugging Live Python Web Applications
byGraham Dumpleton
 
PDF
Python Tricks That You Can't Live Without
byAudrey Roy
 
PDF
Using venvs - HSF-India - Punjab University, Chandigarh
byHenry Schreiner
 
PPTX
Thinking Outside The [Sand]Box
byMichael Genkin
 
PDF
Python Linters at Scale.pdf
byJimmy Lai
 
ODP
Python-specific packaging
bydwvisser
 
PDF
Christian Strappazzon - Presentazione Python Milano - Codemotion Milano 2017
byCodemotion
 
PDF
Welcome to the Cheese Shop: setuptools, virtualenv and PyPUG
bydwvisser
 
PDF
The quality of the python ecosystem - and how we can protect it!
byBruno Rocha
 
PPTX
The New York Times: Sustainable Systems, Powered by Python
byAll Things Open
 
PDF
Effective Python Package Management [PyCon Canada 2017]
byDevon Bernard
 
PDF
Pipfile, pipenv, pip… what?!
byIvan Chernoff
 
PDF
Reproducible Environments for Reproducible Results - PyOhio 2018
byDana Walker
 
PDF
обзор Python
byYehor Nazarkin
 
PyCon 2013 : Scripting to PyPi to GitHub and More
byMatt Harrison
 
Tools to help you write better code - Princeton Wintersession
byHenry Schreiner
 
icse-presentation.pptx
byLyVu52
 
Open source projects with python
byroskakori
 
Complete python toolbox for modern developers
byJan Giacomelli
 
Infecting Python Bytecode
byIftach Ian Amit
 
PyCon AU 2012 - Debugging Live Python Web Applications
byGraham Dumpleton
 
Python Tricks That You Can't Live Without
byAudrey Roy
 
Using venvs - HSF-India - Punjab University, Chandigarh
byHenry Schreiner
 
Thinking Outside The [Sand]Box
byMichael Genkin
 
Python Linters at Scale.pdf
byJimmy Lai
 
Python-specific packaging
bydwvisser
 
Christian Strappazzon - Presentazione Python Milano - Codemotion Milano 2017
byCodemotion
 
Welcome to the Cheese Shop: setuptools, virtualenv and PyPUG
bydwvisser
 
The quality of the python ecosystem - and how we can protect it!
byBruno Rocha
 
The New York Times: Sustainable Systems, Powered by Python
byAll Things Open
 
Effective Python Package Management [PyCon Canada 2017]
byDevon Bernard
 
Pipfile, pipenv, pip… what?!
byIvan Chernoff
 
Reproducible Environments for Reproducible Results - PyOhio 2018
byDana Walker
 
обзор Python
byYehor Nazarkin
 

More from South Tyrol Free Software Conference

PDF
SFSCON24 - Luca Alloatti - Open-source silicon chips
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Moritz Mock, Barbara Russo & Jorge Melegati - Can Test Driven Deve...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Joseph P. De Veaugh Geiss - Opt out? Opt in? Opt Green! Bringing F...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Roberto Innocenti - 2025 scenario on OpenISA OpenPower Open Hardwa...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Juan Rico - Enabling global interoperability among smart devices ...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Mattia Pizzirani - Raspberry Pi and Node-RED: Open Source Tools fo...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Carmen Delgado Ivar Grimstad - Nurturing OpenJDK distribution: Ecl...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Aurelio Buonomo & Christian Zanotti - Apisense – Easily monitor an...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Jorge Melegati - Software Engineering Automation: From early tools...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Alberto Nicoletti - The SMART Box of AURA Project
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Giovanni Giannotta & Orneda Lecini - Approaches to Object Detectio...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Michal Skipala & Bruno Rossi - Monolith Splitter
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Eduardo Guerra - codEEmoji – Making code more informative with emojis
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Fulvio Mastrogiovanni - On the ethical challenges raised by robots...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Seckin Celik & Davide Serpico - Adoption Determinants of Open Hard...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Stefan Mutschlechner - Smart Werke Meran - Lorawan Use Cases
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Marina Latini - 1, 2, 3, Doc Kit!
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Chiara Civardi & Dominika Tasarz Sochacka - The Crucial Role of Op...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Attaullah Buriro - ClapMetrics: Decoding Users Genderand Age Throu...
bySouth Tyrol Free Software Conference
 
PDF
SFSCON24 - Juri Solovjov - How to start contributing and still have fun
bySouth Tyrol Free Software Conference
 
SFSCON24 - Luca Alloatti - Open-source silicon chips
bySouth Tyrol Free Software Conference
 
SFSCON24 - Moritz Mock, Barbara Russo & Jorge Melegati - Can Test Driven Deve...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Joseph P. De Veaugh Geiss - Opt out? Opt in? Opt Green! Bringing F...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Roberto Innocenti - 2025 scenario on OpenISA OpenPower Open Hardwa...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Juan Rico - Enabling global interoperability among smart devices ...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Mattia Pizzirani - Raspberry Pi and Node-RED: Open Source Tools fo...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Carmen Delgado Ivar Grimstad - Nurturing OpenJDK distribution: Ecl...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Aurelio Buonomo & Christian Zanotti - Apisense – Easily monitor an...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Jorge Melegati - Software Engineering Automation: From early tools...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Alberto Nicoletti - The SMART Box of AURA Project
bySouth Tyrol Free Software Conference
 
SFSCON24 - Giovanni Giannotta & Orneda Lecini - Approaches to Object Detectio...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Michal Skipala & Bruno Rossi - Monolith Splitter
bySouth Tyrol Free Software Conference
 
SFSCON24 - Eduardo Guerra - codEEmoji – Making code more informative with emojis
bySouth Tyrol Free Software Conference
 
SFSCON24 - Fulvio Mastrogiovanni - On the ethical challenges raised by robots...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Seckin Celik & Davide Serpico - Adoption Determinants of Open Hard...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Stefan Mutschlechner - Smart Werke Meran - Lorawan Use Cases
bySouth Tyrol Free Software Conference
 
SFSCON24 - Marina Latini - 1, 2, 3, Doc Kit!
bySouth Tyrol Free Software Conference
 
SFSCON24 - Chiara Civardi & Dominika Tasarz Sochacka - The Crucial Role of Op...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Attaullah Buriro - ClapMetrics: Decoding Users Genderand Age Throu...
bySouth Tyrol Free Software Conference
 
SFSCON24 - Juri Solovjov - How to start contributing and still have fun
bySouth Tyrol Free Software Conference
 

Recently uploaded

PDF
Workshop on Sustaining & Growing Open Source Communities - GAS2025
bySammy Fung
 
PDF
100 Insights After the 200th Issue of NewMind AI Journal
byNewMind AI
 
PPTX
Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]
byUiPathCommunity
 
PPTX
Emancipatory Information Retrieval: Radically Reorienting Information Retriev...
byBhaskar Mitra
 
PPTX
Session 2 - Solving Unstructured & Complex Documents with UiPath IXP
byDianaGray10
 
PPTX
Software Analysis &Design ethiopia chap-2.pptx
byAbbas484771
 
PPTX
UiPath Autonomous Agents | Building and Orchestrating Agents End-to-End
byUiPathCommunity
 
PPTX
Technology Consulting _ by Slidesgo.pptx
byfh82277
 
PPTX
How to make Ai agents using Google Gemini AI.pptx
bypkluffy111
 
PDF
DevFest El Jadida 2025 - Product Thinking
byElmehdi AMLOU
 
PDF
Cross-Cultural Agile Development -Challenges and Strategies for Overcoming Them-
byTakashi Makino
 
PPTX
Top _HR Technology Trends _for 2026_.pptx
byAutomationEdge Technologies
 
PDF
Exam Prep Plan Overview: Amazon Web Services (AWS) Certified
byVICTOR MAESTRE RAMIREZ
 
PDF
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
PDF
What Is a Private LLM and Why Enterprises Need It
byAivada
 
PDF
Our Digital Tribe_ Cultivating Connection and Growth in Our Slack Community 🌿...
bysanjeetmishra30
 
PDF
Access Control 2025: From Security Silo to Software-Defined Ecosystem
byMemoori
 
PDF
WHITE PAPER_ Ransomware Payment Policy and Resilience Strategy_ A Framework f...
byssuser0d171c
 
PDF
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
PDF
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
Workshop on Sustaining & Growing Open Source Communities - GAS2025
bySammy Fung
 
100 Insights After the 200th Issue of NewMind AI Journal
byNewMind AI
 
Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]
byUiPathCommunity
 
Emancipatory Information Retrieval: Radically Reorienting Information Retriev...
byBhaskar Mitra
 
Session 2 - Solving Unstructured & Complex Documents with UiPath IXP
byDianaGray10
 
Software Analysis &Design ethiopia chap-2.pptx
byAbbas484771
 
UiPath Autonomous Agents | Building and Orchestrating Agents End-to-End
byUiPathCommunity
 
Technology Consulting _ by Slidesgo.pptx
byfh82277
 
How to make Ai agents using Google Gemini AI.pptx
bypkluffy111
 
DevFest El Jadida 2025 - Product Thinking
byElmehdi AMLOU
 
Cross-Cultural Agile Development -Challenges and Strategies for Overcoming Them-
byTakashi Makino
 
Top _HR Technology Trends _for 2026_.pptx
byAutomationEdge Technologies
 
Exam Prep Plan Overview: Amazon Web Services (AWS) Certified
byVICTOR MAESTRE RAMIREZ
 
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
What Is a Private LLM and Why Enterprises Need It
byAivada
 
Our Digital Tribe_ Cultivating Connection and Growth in Our Slack Community 🌿...
bysanjeetmishra30
 
Access Control 2025: From Security Silo to Software-Defined Ecosystem
byMemoori
 
WHITE PAPER_ Ransomware Payment Policy and Resilience Strategy_ A Framework f...
byssuser0d171c
 
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 

SFScon 21 - Duc Ly Vu - LastPyMile: a lightweight approach for securing Python ecosystem from software supply chain attacks

  • 1.
    This research hasbeen partly funded by the EU H2020 Programs H2020-EU.2.1.1-CyberSec4Europe (Grant No. 830929), AssureMoss (Grant No. 952647) and SPARTA project (Grant No. 830892). LastPyMile: a lightweight approach for securing Python ecosystem from software supply chain attack D.L. Vu1 F. Massacci1,2 I. Pashchenko1 H. Plate3 A. Sabetta3 1 University of Trento, IT, 2 Vrije Universiteit Amsterdam, NL, 3 SAP Security Research, FR
  • 2.
    In FOSS, weall go and use the Source, don’t we? • Well, mostly not, we all download a binary (for Linux), or a package (in Python) from a repository (e.g. PyPI) • What if • the package in PyPI is NOT the “same” as the source in Github? • In the top 2.5K packages in PyPI (around 10MLoC), 65% have subtle differences, 5% changes in Python code • Malicious code anyone? • How to check this AT SCALE? • PyPI’s ~10 maintainers must “shepherd” 400K package owners • In 2020 → 1.9K updates x day with average of 3.5K files by 77K developers • Reproducible builds? A non-starter → too many developers, too many diffs • Gitlog? Malware check all lines? A non starter → even 1 False Positive x #updates ... 2 2
  • 3.
    A PyPI Journey:From Source to Package 3
  • 4.
    A PyPI Journey:From Source to Package 3 Start releasing Source code repo (e.g., Github) Development
  • 5.
    A PyPI Journey:From Source to Package 3 Start releasing Build, additional code generation (e.g., Swagger, Codegen Release-ready code config info: - CI credentials - Source code repo credentials Source code repo (e.g., Github) Development
  • 6.
    A PyPI Journey:From Source to Package 3 Start releasing Build, additional code generation (e.g., Swagger, Codegen Upload to package repo (e.g., by twine) Release-ready code Generated Artifacts Possibly: - OS binaries - Test Coverage Log - Documentation - Automated generated code config info: - CI credentials - Source code repo credentials config info: - Package repo credentials Source code repo (e.g., Github) Development Build systems (CI Cloud services such as Travis CI, developers’ workstation, etc.) Build and Publication
  • 7.
    A PyPI Journey:From Source to Package 3 Start releasing Build, additional code generation (e.g., Swagger, Codegen Upload to package repo (e.g., by twine) Release-ready code Generated Artifacts Possibly: - OS binaries - Test Coverage Log - Documentation - Automated generated code Generated Artifacts in package repo (PyPI) Possibly: - OS binaries - Test Coverage Log - Documentation - Automated generated code config info: - CI credentials - Source code repo credentials config info: - Package repo credentials Source code repo (e.g., Github) Development Build systems (CI Cloud services such as Travis CI, developers’ workstation, etc.) Build and Publication End releasing Consumption Package repository
  • 8.
  • 9.
  • 10.
  • 11.
    Current Package Scanners 4 Geta Package PyPI Select files for review
  • 12.
    Current Package Scanners 4 Geta Package PyPI Select files for review Selected files (e.g., setup.py)
  • 13.
    Current Package Scanners 4 Geta Package PyPI Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check)
  • 14.
    Current Package Scanners 4 Geta Package PyPI Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Output Review
  • 15.
    Current Package Scanners 4 Geta Package PyPI Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Output Review Malicious code can be embedded in to a different file
  • 16.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Output Review Malicious code can be embedded in to a different file
  • 17.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Output Review Malicious code can be embedded in to a different file
  • 18.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Output Review Files, and resources Malicious code can be embedded in to a different file
  • 19.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Files, and resources Malicious code can be embedded in to a different file
  • 20.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
  • 21.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
  • 22.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
  • 23.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code repository Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
  • 24.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source Code Scanners Source code repository Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP
  • 25.
    Current Package Scanners 4 Geta Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source Code Scanners Source code repository Files, and resources Malicious code can be embedded in to a different file All files/lines => many FP All files/lines + resource intensive + human effort => many FP + not possible to perform on-the-fly
  • 26.
    LastPyMile to IdentifyCode Injection 5 Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
  • 27.
    LastPyMile to IdentifyCode Injection 5 LastPyMile Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
  • 28.
    LastPyMile to IdentifyCode Injection 5 LastPyMile Identify source code repo (Step 1) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
  • 29.
    LastPyMile to IdentifyCode Injection 5 LastPyMile Identify source code repo (Step 1) Hash Files & Collect Lines from Repo (Step 2) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
  • 30.
    LastPyMile to IdentifyCode Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Repo (Step 2) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
  • 31.
    LastPyMile to IdentifyCode Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Artifact (Step 3) Hash Files & Collect Lines from Repo (Step 2) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
  • 32.
    LastPyMile to IdentifyCode Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Artifact (Step 3) Hash Files & Collect Lines from Repo (Step 2) Identify phantom files and lines (Step 4) Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
  • 33.
    LastPyMile to IdentifyCode Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Artifact (Step 3) Hash Files & Collect Lines from Repo (Step 2) Identify phantom files and lines (Step 4) Filter Input Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
  • 34.
    LastPyMile to IdentifyCode Injection 5 LastPyMile Identify source code repo (Step 1) Get an artifact Hash Files & Collect Lines from Artifact (Step 3) Hash Files & Collect Lines from Repo (Step 2) Identify phantom files and lines (Step 4) Filter Input Filter Output Get a Package PyPI FOSS Alternative Comprehensive Security Review Select files for review Selected files (e.g., setup.py) Automated check for malware (e.g., PyPI Malware Check) Get an artifact Bandit Checks Output Review Identify source code repo Source code scanners Source code repository Files, and resources
  • 35.
    LastPyMile Combined withother Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
  • 36.
    LastPyMile Combined withother Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
  • 37.
    LastPyMile Combined withother Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
  • 38.
    LastPyMile Combined withother Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
  • 39.
    LastPyMile Combined withother Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
  • 40.
    LastPyMile Combined withother Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
  • 41.
    LastPyMile Combined withother Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
  • 42.
    LastPyMile Combined withother Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
  • 43.
    LastPyMile Combined withother Package Scanners 6 Artifact Type #Files Problem Size Malware Checks Alerts Suspicious Bandit Alerts #LoCs (all files) #LoCs (setup.py) Coverage (setup.py) setup.py whole pkg LastPyMile setup.py whole pkg LastPyMile urllib3-1.26.3 80 25,348 97 0,4% 1 260 0 8 1398 0 requests-2.25.1 32 9325 112 1,2% 3 57 0 9 505 0 setuptools-53.0.0 244 70,794 162 0,2% 4 2932 0 5 762 0 urlib3-1.21.1 72 20 448 197 1% 4 177 3 20 1044 12 request-1.0.117 3 166 52 31,3% 2 8 2 5 27 20 setup-tools-36.0.1 112 31 245 304 1% 8 1289 3 21 489 12 In setup.py B e n i g n M a l i c i o u s Y N Y
  • 44.
    LastPyMile LastPyMile is asimple yet efficient methodology that allows you to identify discrepancies between packages and sources. Combined with other package scanners, LastPyMile is promising to be used for scanning for the maliciousness of injected code. Future plans: The code is under review by a company - stay tuned… We plan to submit LastPyMile to PyPA as a new check for the uploaded packages. Check out our replication package: https://zenodo.org/record/4899935 Want to know more about LastPyMile? Have ideas? Want to contribute? 7 Feel free to reach us!