From hackread.com
The repository has already amassed over 15,000 reports of malicious packages, drawing data from various sources, including the OpenSSF Package Analysis project, Checkmarx security, and exports of malicious packages tracked by GitHub.
In a bid to counter the increasing threat of malicious open source packages, the Open Source Security Foundation (OpenSSF) has introduced a new initiative called the Malicious Packages Repository. This repository could turn out to be a major player in the fight against malicious code and is aimed at enhancing the security and integrity of open source software ecosystems.
A Response to Growing Threats
The launch of the Malicious Packages Repository comes at a time when cyberattacks, leveraging malicious open source packages, are on the rise. For instance, the Lazarus Group, a notorious North Korean state-backed hacking entity, recently targeted the blockchain and cryptocurrency sectors, employing cunning tactics that included deceptive npm packages to infiltrate various software supply chains.
According to crypto security experts at Immunefi, the crypto industry lost $685 million in Q3 2023, with 30% of those funds being stolen by the Lazarus Group. In such a scenario, a centralized repository for shared intelligence could have acted as an early warning system, allowing the global community to thwart such attacks more swiftly.