guarddog icon indicating copy to clipboard operation
guarddog copied to clipboard

Add detection of compiled binaries in package code

Open sobregosodd opened this issue 1 year ago • 0 comments

Adds new rule that detects packages containing EXE or ELF files. The goal is to detect if executables are smuggled into the system. This detection makes use of file magic bytes to detect file types regardless of their extension

An false positive analysis scan was performed with the following results:

  • against the top 1k npm produced 4 false positives
  • against the top 1k pypi packages produced 0 false positives
  • against the last week pypi ~50 packages with 0 false positives
  • against the last week npm ~196 packages with 0 false positives

sobregosodd avatar May 07 '24 18:05 sobregosodd