guarddog
guarddog copied to clipboard
Add detection of compiled binaries in package code
Adds new rule that detects packages containing EXE or ELF files. The goal is to detect if executables are smuggled into the system. This detection makes use of file magic bytes to detect file types regardless of their extension
An false positive analysis scan was performed with the following results:
- against the top 1k npm produced 4 false positives
- against the top 1k pypi packages produced 0 false positives
- against the last week pypi ~50 packages with 0 false positives
- against the last week npm ~196 packages with 0 false positives