ComCat

4 ms·

1.
NPM audit passes malicious packages with no CVE(westbayberry.com)
1 points by ComCat 6mo ago|1 comments
2.
by ComCat 6mo ago
Most npm supply chain attacks never get a CVE. Shai Hulud, the chalk and debug hijack, and S1ngularity all spread before any advisory existed. Tools that rely on vulnerability databases like npm audit, Dependabot, or Snyk passed them clean
3.
Behavioral analysis engine that catches malicious packages before install(westbayberry.com)
2 points by ComCat 7mo ago|1 comments
4.
by ComCat 7mo ago
Most supply chain attacks follow the same playbook: preinstall hook runs automatically, reads your credentials, exfiltrates to a remote server. npm and pip execute this with no warning. CVE databases can't catch these. The package isn&
5.
by ComCat 7mo ago
You're describing two different things, The container comparison misses where these attacks actually happen. Containers limit what code can do at runtime. We flag what code intends to do before it ever runs. These are complementary. A
6.
by ComCat 7mo ago
that framing is too broad for what npm supply chain attacks actually look like. Antivirus deals with arbitrary binaries on a general purpose OS. npm attacks are much more constrained. The code has to run during install or import, steal cred
7.
by ComCat 7mo ago
Socket and I are solving the same problem, behavioral analysis of npm packages before install, but with different approaches. Socket uses static analysis plus LLM based threat assessment. Dependency Guardian is fully deterministic: 26 regex
8.
by ComCat 7mo ago
Yes — we’re working on adding non Google auth. API key + email/password support is coming soon.
9.
NPM install is stealing your passwords – I built a tool to catch it(westbayberry.com)
35 points by ComCat 7mo ago|17 comments
10.
by ComCat 7mo ago
I spent months studying how malicious npm packages actually work. Most of them do the same thing eg run a preinstall script, read your .env and credentials, and send them to a remote server. All before your app starts. npm install will r
11.
Behavioral NPM malware detection without CVEs(westbayberry.com)
2 points by ComCat 7mo ago|1 comments
12.
by ComCat 7mo ago
Over the past year several major npm supply chain incidents had no CVE. They were intentionally malicious packages, not vulnerable ones, so database driven scanners passed them clean. That raised a question for me. If zero day supply chain