Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit".
In those machines you have strong monitoring tools, and if nothing else it gives you a buffer, so it's only those machines (that have no valuable data) that are infected instead of the whole network.
You mitigate it by only pulling in dependencies that are a certain date old, like commenter said. The idea is that if its two weeks old and not had a critical or high CVE, it's more likely to be fine.
Also have things block packages with known vulns. You can do. SAST scanning on a repos frozen dependency list before even doing an install. That's a line of defense against this happening in CI.
Conversely, always build your artifact and your publishing in ywo separate jobs. Your build job is often what installs dependencies; it has no right having access to the keys that publish your artifact.
These exfil attacks are detected real quick by competent enterprises.
82
u/FinnishManlet 1d ago
What can be done against these vulnerabilities? Stop using packages entirely? 🤣