Understanding Supply Chain Threats with Static Analysis
summary
A CLI and library called capslock runs call‑graph static analysis against Go code to map calls into standard‑library sinks and surface network access, file system access, and unsafe code capabilities so maintainers can spot unexpected privileges; claims show a 600% rise in supply‑chain attacks 2021→2022 and finds large-scale cloning (≈22,000 results) with malicious inits. Output includes JSON and call paths, is on GitHub, has false positives by design, and plans integration with deps.dev to make capability signals actionable.
AI-written summary · about
chapters (13)
- 0:00Supply chain threats intro
- 1:10Go security trends
- 2:55Dependency security problems
- 4:44Broad malicious packages
- 6:31Dependency management issues
- 7:36Capability analysis intro
- 9:20Capabilities vs vulnerabilities
- 10:24Code to capabilities mapping
- 11:49Transitive dependency risks
- 12:31Static analysis limits
- 13:58Caps lock analyzer goals
- 15:25Caps lock output explained
- 16:05Future caps lock plans
related talks
29mTrust, but Verify: Proactive Security in Open Source
35mSupply Chain Attacks: The New Reality
38mCapslock: Escaping Bad Dependencies
25mSupply Chain Attacks- 38mCapslock: Escaping Bad Dependencies
19mKeynote: Supply Chain Security in 2024
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
44mKeeping Your Software Supply Chain Healthy