Viewing profile — louislang

DARPA is doing something similar to this with their TRACTOR work. https://www.darpa.mil/program/translating-all-c-to-rust

(Full disclosure: I'm one of the co-founders @ Phylum) We could do a full write-up on npm's quirks and how one could take advantage of them to hide intent. Consider the following f…

this is still true of node/npm. It's also true of Cargo (Rust), Nuget (C#), and a handful of others. I'd say it's probably the _norm_ for most ecosystems to allow some form of pre/…

I'm one of the co-founders @ Phylum. We've been tracking this campaign [1] (along with several other unrelated ones). The collective group of security researchers (Shoutout to http…

Yeah, the broad campaign makes it extremely noticeable. There are active campaigns right now that don't take this approach. Singular packages with novel malicious payloads. > As a …

No, this is not unique to Python or PyPI. I'm one of the co-founders @ Phylum. We've tracked campaigns across Crates.io, Nuget, npm, PyPi, etc. see: https://blog.phylum.io/tag/rese…

Seems like gaming tax makes up for the loss of personal income tax.

Yeah, 1.1.[5,6,7] were involved in the attack.

Co-founder @ Phylum here ( https://phylum.io ). We've been actively scanning dependencies across most open source package registries (e.g., npm, PyPI, Crates.io, etc.) for a few ye…

People approach things through a lens of familiarity. Programmers are likely relating it to their experience.

One of the sources referenced in the paper is about the work the company I co-founded is doing ( https://phylum.io ). We've been working closely with PyPI to not only report issues…

What makes you say that? There doesn't seem to be a ton of info on that page about _what_ it is. Certainly not enough to call it an after though.

The fact that I'm in Houston and have grown accustomed to the threat of yearly hurricanes is personally alarming.

Happy to see this on HN! I'm one of the co-founders @ Phylum. We actively monitor and report on malware and software supply chain attacks across multiple ecosystems. Most notably, …

Sorry, I just saw this! We actively monitor each open source repository and as packages are published, we pull them down and analyze each line of code and any associated metadata. …

It's some stupid blog setting. I just disabled it. Thanks for the heads up!

Response time was one of the best we've experienced at Phylum. It's obvious you guys are putting in a ton of work over there. Please let me know if there's anything we can help out…

Yes, we (Phylum) work closely with Github and reported this account to them.

We're actively working on this with our sandbox ( https://github.com/phylum-dev/birdcage ). We've wrapped the likes of pip, yarn, and npm already and are making moves to similarly …