Using ChatGPT to Find Vulnerabilities & Malware in Open Source
summary
Socket uses ChatGPT plus traditional scanners to flag real npm and Python malware: a static analysis pre-filter rejects clearly safe packages, suspicious packages hit an LLM, and humans review hits. The pipeline catches curl/download backdoors, reverse shells, credential exfiltration and obfuscation; team verifies ~1,000 confirmed attacks in 30 days and cites a 209‑day median discovery delay. Cost controls include memoization, priors (cheap signals first), multi-sampling and chain‑of‑thought prompting to reduce queries and false positives.
AI-written summary · about
chapters (8)
- 0:00Start
- 2:40What is the software supply chain?
- 16:06Developers install bad packages because
- 20:30Developers need more visibility into dependency risk
- 21:17How do developers evaluate packages?
- 28:02Give developers visibility with automation
- 44:03Mode collapse
- 45:15Ask the model to adopt a persona
related talks
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
42mPentesting ChatOps
42mPentesting ChatOps
27mChatGPT Ignites
49mKeynote: Pentesting ChatOps
38mThe Risks of Blind Trust in Code from Strangers
47mBlack Clouds and Silver Linings in Node.js Security
46mMagic of Automation and Everyday Chores