English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Current software supply chains heavily rely on open-source packages hosted inpublic repositories. Given the popularity of ecosystems like npm and PyPI,malicious users started to spread malware by publishing open-source packagescontaining malicious code. Recent works apply machine learning techniques todetect malicious packages in the npm ecosystem. However, the scarcity ofsamples poses a challenge to the application of machine learning techniques inother ecosystems. Despite the differences between JavaScript and Python, theopen-source software supply chain attacks targeting such languages shownoticeable similarities (e.g., use of installation scripts, obfuscated strings,URLs).  In this paper, we present a novel approach that involves a set oflanguage-independent features and the training of models capable of detectingmalicious packages in npm and PyPI by capturing their commonalities. Thismethodology allows us to train models on a diverse dataset encompassingmultiple languages, thereby overcoming the challenge of limited sampleavailability. We evaluate the models both in a controlled experiment (wherelabels of data are known) and in the wild by scanning newly uploaded packagesfor both npm and PyPI for 10 days.  We find that our approach successfully detects malicious packages for bothnpm and PyPI. Over an analysis of 31,292 packages, we reported 58 previouslyunknown malicious packages (38 for npm and 20 for PyPI), which wereconsequently removed from the respective repositories.

On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI