packj-github-action - Packj audits pull requests for malicious/risky ope

项目说明

<img src=" width="45"/>&nbsp;<span style="font-size: 36px"> Packj flags malicious/risky open-source dependencies</span>

Add *Packj* to your workflow to audit your pull requests for malicious/risky NPM/PyPI/Ruby dependencies.

Powered by our open-source tool Packj.

![GitHub Stars]() ![Discord]() ![]()

Example output

Packj will comment on the PR if any risky dependencies are found. See example Pull Request audit.

<details>
<summary><b>Show Example PR Screenshot</b></summary>

!Screen Shot 2022-11-04 at 5 18 25 PM
</details>

How to use #

Just add the following to your workflow:

<details>
<summary><b>Show a complete example</b></summary>

</details>

Inputs ###

How it works #

Packj can audit PyPI, NPM, and RubyGems packages. It performs:

Packages with expired email domains, large release time gap, sensitive APIs, etc. are flagged as risky for security reasons.

Supported threats #

The design of Packj is guided by our study of 651 malware samples of documented open-source software supply chain attacks. It scans for 40+ risky code and metadata attributes that make a package to supply chain attacks.

<details>
<summary>
<strong>Show examples of risky packages that are flagged by Packj.</strong>
</summary>
<table>
<tr>
<th>Risk</th>
<th>Reason</th>
</tr>
<tr>
<td>Packages impersonating popular packages</td>
<td>Bad actors carry out typo-squatting attacks by publishng malicious packages that impersonate popular packages (e.g., lodash )</td>
</tr>
<tr>
<td>Old or abandonded packages</td>
<td>Old or unmaintained packages do not recei fixes</td>
</tr>
<tr>
<td>Package using of sensitive APIs, such as <b>exec</b> and <b>eval</b></td>
<td>Malware uses APIs from the operating system or language runtime to perform sensiti (e.g., read SSH keys)</td>
</tr>
<tr>
<td>Packages with invalid or no email addresses of the contributors</td>
<td>Incorrect or missing email addresses suggest lack of 2FA on the account, which makes it easier for bad actors to hijack package ownership</td>
</tr>
<tr>
<td>Packages with invalid or no public source repo</td>
<td>Absence of a public repo means no easy way to audit or review the source code publicly</td>
</tr>
<tr>
<td>Packages containing known </td>
<td>Known security (CVEs) in package code could be exploited by bad actors</td>
</tr>
</table>
Full list of risks we track can be at <a href="
</details>

Customizing alerts #

Packj can be customized to ONLY send alerts that apply to your threat model. Simply add a .packj.yaml file in your repo based on our template (below) and enable/disable alerts that matter to you.

<details>
<summary>
<strong>Show .packj.yaml template.</strong>
</summary>
<pre><code class="lang-yaml">

#
# Audit policies
#
audit:

#
# Risk alerts (enable or disable according to your threat model)
#
alerts:

#
# category: malicious packages (publicly known and unknown)
#
malicious:
contains known malware:
- reason: package is known to contain a dangerous malware
- enabled: true
typo-squatting or repo-jacking package:
- reason: package impersonates another popular package to propagate malware
- enabled: true

#
# alert category: packages to code exploits
#
:
contains known :
- reason: known (CVEs) in package code could be exploited
- enabled: true

#
# packages with undesirable or "risky" attributes
#
undesirable:
package is old or abandoned:
- reason: old or abandoned packages receive no security updates and are risky
- enabled: true

invalid or no author email:
- reason: a package with lack of or invalid author email suggests 2FA not enabled
- enabled: true

invalid or no homepage:
- reason: a package with no or invalid homepage may not be preferable
- enabled: false

no source repo:
- reason: lack of public source repo may suggest malicious intention
- enabled: true

fewer downloads:
- reason: a package with few downloads may not be preferable
- enabled: true

no or insufficient readme:
- reason: a package with lack of documentation may not be preferable
- enabled: false

fewer or releases:
- reason: few suggest unstable or inacti
- enabled: true

too many dependencies:
- reason: too many dependencies increase attack surface
- enabled: false

release after a long gap:
- reason: a release after a long time may indicate account hijacking
- enabled: false

contains custom installation hooks:
- reason: custom installation hooks may download or execute malicious code
- enabled: false # WIP

#
# type: repo stats
#
few source repo stars:
- reason: a package with few repo stars may not be preferable
- enabled: false

few source repo forks:
- reason: a package with few repo forks may not be preferable
- enabled: false

forked source repo:
- reason: a forked copy of a popular package may contain malicious code
- enabled: true

#
# type: APIs and permissions
#
generates new code:
- reason: package generates new code at runtime, which could be malicious
- enabled: false
forks or exits OS processes:
- reason: package spawns new operating system processes, which could be malicious
- enabled: false
accesses obfuscated (hidden) code:
- enabled: true
accesses en :
- enabled: false
changes system/en :
- enabled: false
accesses files and dirs:
- enabled: false
communicates with external network:
- enabled: false
reads user input:
- enabled: false

sandbox:
rules:
#
# File system (allow or block accesses to file/dirs)
#
# ~/ represents home dir
# . represents cwd dir
#
# NOTE: only ONE 'allow' and 'block' lines are allowed
#
fs:
# TODO: customize as per your threat model

# block access to home dir and all other locations (except the ones below)
block: ~/, /
allow: ., ~/.cache, ~/.npm, ~/.local, ~/.ruby, /tmp, /proc, /etc, /var, /bin, /usr/include, /usr/local, /usr/bin, /usr/lib, /usr/share, /lib

#
# Network (allow or block domains/ports)
#
# NOTE: only ONE 'allow' and 'block' lines are allowed
#
network:

# TODO: customize as per your threat model

# block all external network communication (except the ones below)
block: 0.0.0.0

# For installing PyPI, Rubygems, and NPM packages
allow: pythonhosted.org:443, pypi.org:443, rubygems.org:443, npmjs.org:0, npmjs.com:0
</code></pre>
</details>

项目信息

开发语言：未知

Star 数：10

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Packj audits pull requests for malicious/risky open-source deps展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。