How I Learned to Stop Worrying and Love Public Packages
summary
Compares CRAN/Bioconductor curation with PyPI permissiveness and shows concrete mitigations: use metrics like downloads, revision frequency and tests, run the R riskmetric-style assessment, consult advisory feeds including the new CRAN/Bioconductor advisory DB and OSV, and enforce package blocking and repository snapshots in Posit Package Manager. Demonstrates real exploits: typo squatting on TensorFlow (≈600,000 downloads/day) and dependency confusion with internal posittools packages, and explains how a unified internal/public mirror prevents those attacks.
AI-written summary · about
chapters (10)
- 0:00Public package safety concerns
- 0:49Convincing infosec teams
- 1:54Public package repositories
- 3:35Package quality assessment
- 6:21Curated repositories risks
- 7:24Package vulnerabilities
- 9:08Package confusion exploits
- 13:23Dependency confusion
- 16:59Managing risks safely
- 17:43Q&A
related talks
43mHow to hack and defend (your) open source
34mRising Threat: Securing Your Open-Source Pipeline
31mChoosing Wisely - How to Pick the Right Third Party Packages for your Project
19mCan I trust that package?
25m"Security considerations in Python Packaging"
20mMalicious Needle in a Haystack - PyPi Security Pitfalls
47mSetting Up Your Own Private, Secured Package Repository - Why and How
25mWhen the supply chain hits a sour note