Sonatype Blog

https://blog.sonatype.com/malware-removed-from-maven-central "Unlike most other open source software component ecosystems, Maven is built upon a strong namespacing concept that requires that every artifact be addressed using (minimally) a three part coordinate: Group ID : Artifact ID : Version. Group IDs follow the Java Package convention which is the reverse of a development team’s DNS. For example, all Apache Software Foundation artifacts have org.apache as the start of their Group ID. Org.apache.maven is Maven, org.apache.struts is Struts etc."

Plenty of examples of NPM packages being taken over: * https://www.whitesourcesoftware.com/resources/blog/npm-package-javascr… * https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 * https://blog.sonatype.com/npm-project-used-by-millions-hijacked-in-sup… * https://checkmarx.com/blog/attackers-write-bugs-as-well/ When was the last time you audited all of the libraries a SPA depended on? If it was during the last build, congrats, you're doing great. Lots of times it isn't automated and can be neglected, though.

Man Yue Mo worked at Semmle (https://blog.sonatype.com/steps-to-responsible-disclosure) before it was acquired by GitHub (https://github.blog/2019-09-18-github-welcomes-semmle/). That research function has carried on as the GitHub Security Lab. Semmle built CodeQL, now offered by GitHub (https://docs.github.com/en/code-security/code-scanning/introduction-to… which GitHub and Microsoft (see https://www.microsoft.com/en-us/security/blog/2023/11/02/announcing-mi… want to associate with "deep security insight". So they continue to fund this kind of novel security research, for which security practitioners across industry are grateful.

Source, https://blog.sonatype.com/npm-packages-caught-exfiltrating-kubernetes-…

Yeah, I ask because the JVM world has had that since... whenever Maven's central repository came about [0][1][2], I guess, and it ensures that there's no debate about namesquatting [3], nor typosquatting attack vectors [4]. I am constantly baffled that NPM, PyPi, crates.io etc. didn't copy this idea for those last two reasons. In my mind, it's not quite best in class without it. [0]: https://central.sonatype.org/publish/requirements/coordinates/#choose-… [1]: https://central.sonatype.org/faq/how-to-set-txt-record/ [2]: https://central.sonatype.org/publish/requirements/coordinates/#support… [3]: https://internals.rust-lang.org/t/pre-rfc-formal-squatting-policy-on-c… [4]: https://blog.sonatype.com/this-week-in-malware-may-13th-edition

One of the main guys behind Maven Central guy did a thing on this: https://blog.sonatype.com/eu-cyber-resilience-act-good-for-software-su…

> This seems sort of reasonable. If you charge for tech support, you have a business. I’m all for not making it harder for people who are actually just sharing their hobby projects, but a project that makes money isn’t a hobby anymore. With the current writing it might be that a distributor different from the commercial entity might be liable for vulnerabilities and reporting. https://blog.sonatype.com/eu-cyber-resilience-act-good-for-software-su…

Products like Nexus Firewall[0] have settings to block suspicious packages. [0] https://blog.sonatype.com/sonatype-releases-new-nexus-firewall-policy-…

Sonatype found a whole bunch of those and blogged about it in August. https://blog.sonatype.com/more-than-200-cryptominers-flood-npm-and-pyp… Disclaimer: I currently work for Sonatype, but in a different area of the company.

Here is a good writeup of some of the pros and cons of using a "reachability" approach. https://blog.sonatype.com/prioritizing-open-source-vulnerabilities-is-… >Unfortunately, no technology currently exists that can tell you whether a method is definitively not called, and even if it is not called currently, it’s just one code change away from being called. This means that reachability should never be used as an excuse to completely ignore a vulnerability, but rather reachability of a vulnerability should be just one component of a more holistic approach to assessing risk that also takes into account the application context and severity of the vulnerability.

Open source projects are not a good point of reference because by their very nature they invite external validation. If you are trying to steal $300M, you don't tell people before hand that you are going to do it. There also a difference between the money being right there, only one step away from being yours and infecting open source software with the possibility of maybe stealing something in some company that may or may not use your software in a way that would allow theft months or years after you submitted an update. Edit: After doing some research, it appears that claims that open source doesn't fall victim to this problem are factually incorrect. [0] [0] https://blog.sonatype.com/open-source-attacks-on-the-rise-top-8-malici…

Sonatype Lifecycle is designed to analyze a built package and figure out what's inside it, specifically when there aren't manifest files to tell you what's -supposed- to be there. It can obviously do a lot more, but the analysis is designed to solve the exact problem you're describing. https://blog.sonatype.com/mapping-the-javascript-genome-for-devops

Actually we do validate several aspects of things being published to Central and always have. There have been many other repos that have come and gone over the years, many of them without the same standards and it ultimately creates a federated tragedy of the commons. More about the history here https://blog.sonatype.com/why-namespacing-matters-in-public-open-sourc…

I hear a lot of complains about the Sonatype process being not trivial. Here is a background article about why: https://blog.sonatype.com/why-namespacing-matters-in-public-open-sourc…

https://blog.sonatype.com/nexus-intelligence-insights-whats-in-a-ghost… https://devblogs.microsoft.com/java/addressing-ghostcat-on-azure/?WT.m…

1) Glad we have a Nexus proxy in front of npm... [a] 2) Cloudflare strikes again, this one company is at the same time making the internet better and worse. I'm constantly blocked by cloudflare for something that should not be, it's extremely frustrating. Then when you complain to them they throw their hands up and say "owner hasn't configured their site for that". Ugh. [a] https://blog.sonatype.com/using-nexus-3-as-your-repository-part-2-npm-…

This seems to be a yet another manifestation of the same underlying issue that has marred this library since 2013: https://blog.sonatype.com/jackson-databind-remote-code-execution The only reliable fix is surely stopping serialization of arbitrary classes by not using or auditting any use of the DefaultTyping feature.

Seems like the Maven registry is susceptible to artifact hijacking. Say I wan't to install artifacts from two GitHub users. I would have to add these two Maven repositories: - https://maven.pkg.github.com/USER1 - https://maven.pkg.github.com/USER2 In that case USER1 can publish an artifact with the same groupId/artifactId as USER2 and my Maven will happily install it without suspecting anything. Another case - someone deletes their GH account and another user takes it: https://blog.sonatype.com/hijacking-of-a-known-github-id-go-bindata Docs: https://help.github.com/en/articles/configuring-maven-for-use-with-git…

For Java (btw), there isn't a central repository, but Maven lets you download the Internet ( http://blog.sonatype.com/2011/04/how-not-to-download-the-internet/#.VC… ) which solves the same problem.

1. End-users don’t need to personally verify smart contracts or any other open source software. The key is to have each version have a hash, and on EVM thatms easy — it’s the address of the contract. Then, more and more auditors go through the code and sign off on the contract. In fact, this should be done for lots of open source ecosystems, eg composer or npm, because then we might not have stuff like this: https://blog.sonatype.com/npm-project-used-by-millions-hijacked-in-sup… or this in log4j: https://theconversation.com/amp/what-is-log4j-a-cybersecurity-expert-e… In fact it happens more and more: http://cyware.com/news/analyzing-the-deadly-rise-in-npm-package-hijack… 2) On EVM you can just audit a smart contract FACTORY, and then people can trust all the instances made from it. This is immensely powerful. And then there is also regular use by people who put huge amounts of value into a protocol and it is never hacked. It is why for example people trust UniSwap liquidity pools not to rugpull them, and the same with many other protocols. Now, to be fair, you don’t need a blockchain for that. You can use merkle trees and code signing. But the current Web sucks at it — you just have to trust the server not to suddenly send you bad code, or your “user agent” to execute JS that sends your password in the clear somewhere. And App Stores are black boxes where you just…