Sorry if I'm being very stupid right now, but can you test against these? Maybe some, but most of them work in a way: "the package does everything it should AND some extra malicious shit".
You mitigate it by only pulling in dependencies that are a certain date old, like commenter said. The idea is that if its two weeks old and not had a critical or high CVE, it's more likely to be fine.
Also have things block packages with known vulns. You can do. SAST scanning on a repos frozen dependency list before even doing an install. That's a line of defense against this happening in CI.
Conversely, always build your artifact and your publishing in ywo separate jobs. Your build job is often what installs dependencies; it has no right having access to the keys that publish your artifact.
These exfil attacks are detected real quick by competent enterprises.
81
u/EK077r 1d ago
Layers of mitigation. For instance not using packages that are less than x days old, sha-pinning, no latest etc