Viewing profile — ashishbijlani

I've been building an OSS tool to detect software supply-chain attacks: https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indica…

Built Packj [1] to audit dependencies easily from CLI. 1. Packj ( https://github.com/ossillate-inc/packj ) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral an…

Built Packj [1] to do exactly this. 1. Packj ( https://github.com/ossillate-inc/packj ) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses sta…

This is a great initiative. Thanks for sharing! I will use it to create my personal cache of package registries (beyond obvious advantages of caching, it can also mitigate typo-squ…

I’m extending Packj sandbox for agentic code execution [1]. You can specify allowlist for network/fs. 1. https://github.com/ossillate-inc/packj/blob/main/packj/sandb...

Plug: I've been building a tool to detect software supply-chain cyberattacks: https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for …

Packj [1] detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning…

Plug: I've been building a similar tool: https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawn…

Hi Abhishek, the backtracking feature looks super useful. Congrats on launching!

Not for contributions only, but developing ExtFUSE [1] got me a lot of offers and consulting work. 1. https://github.com/extfuse/extfuse optimizes FUSE with eBPF

> If the tech is open-sourced, then an attacker can keep trying in private until they find an exploit, and then use it. So you'd rather assume that if something is obscure, it is s…

We scan PyPI packages regularly for malware to provide a private registry of vetted packages. The tech is open-sourced: Packj [1]. It uses static+dynamic code/behavioral analysis t…

This is exactly why I'm building Packj audit [1]. It detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan f…

Good to see Packj[1] as one of the malware scanners used. 1. https://github.com/ossillate-inc/packj Packj detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral ana…

Plug: I’ve been building Packj [1] to detect malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of…

I’ve been building Packj [1] to detect malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compr…

I’ve been building Packj [1] to detect such attacks. Packj can flag malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP dependencies. We use static, dynamic, …

I’ve been building an open-source tool Packj [1] to detect publicly malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out st…

> For how to know you can trust a dependency, I'm afraid there is no solution: no theorem prover nor isolation, cryptography nor layerizarion can save you. I'm taking a stab at add…

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes …

Cool project! Are you fetching app metadata from Google Playstore in real-time or you've cached data of all Android apps on your server already?

Creator of Packj [1] here. How do you envision sandboxing/security policies will be specified? Per-lib policies when you've hundreds of dependencies will become overwhelming. Havin…

I’ve been building Packj [1] to detect publicly UNKNOWN dummy, malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out static/…

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes …