Detecting Suspicious Package Updates

kaestner@cs.cmu.edu (K. Garrett, G. Ferreira, C. Kästner, J. Sunshine, L. Jia)
Fri, 17 Jan 2020 15:18:48 -0500

Kalil Garrett, Gabriel Ferreira, Christian Kästner, Joshua Sunshine, and Limin Jia. Detecting Suspicious Package Updates. In Proceedings of the International Conference on Software Engineering -- New Ideas Track (ICSE-NIER), pages 13--16, May 2019.

With an increased level of automation provided bypackage managers, which sometimes allow updates to be installedautomatically, malicious package updates are becoming a realthreat in software ecosystems. To address this issue, we proposean approach based on anomaly detection, to identify suspiciousupdates based on security-relevant features that attackers coulduse in an attack. We evaluate our approach in the contextof Node.js/npm ecosystem, to show its feasibility in terms ofreduced review effort and the correct identification of a confirmedmalicious update attack. Although we do not expect it to bea complete solution in isolation, we believe it is an importantsecurity building block for software ecosystems.