41–50 of 102 posts
Earlier quoted context omitted.
Ain't nobody got time for that. LLMs should be capable of analysing code for anything malicious / suspicious.
Unfortunately, no, because the existence of LLMs that can automatically determine code that is suspicious will be offset by the existence of LLMs that can generate malicious code that bypasses the detection abilities of the aforementioned LLMs.
I'm curious if it'd be possible to use a Code LLM to scan GitHub repos and detect possible malware hiding in source code.
The user's reddit profile: https://archive.is/G5GIW They have a couple of other tools hosted on HuggingFace, both having the malicious dependencies and both requiring entering API keys, namely: "SillyTavern Character Generator": https://archive.is/gETq3 (requirements.txt: https://archive.is/xqqtA ) "Image Description with Claude Models and GPT-4 Vision": https://archive.is/6Ydgs (requirements.txt: https://archive.is/…
Some entity called Nullbulge Group claims they took over the repo. Today's capture (before the repo got 404'd) has their belligerence spiel. https://web.archive.org/web/20240609135118/https://github.co... This is the capture from 3 days prior: https://web.archive.org/web/20240525021402/https://github.co...
According to the original report, the “key logger” was in the custom wheels in the requirements.txt, but looking at that repository there has been only two commits, which according to Reddit both had malicious code in them.
Of course, proper discovery would be easier if the GitHub account still existed.
Earlier quoted context omitted.
Which is everybody in the world except for a handful of people.
Not really, and it takes a few minutes because most of these packages (including npm) are small. You don’t have to read the WireGuard codebase because it’s reputable enough, but for obscure or unknown add-ons/package code, it’s on you to double-check, just like reading the ‘readme’.
Earlier quoted context omitted.
Which is everybody in the world except for a handful of people.
Not really, and it takes a few minutes because most of these packages (including npm) are small. You don’t have to read the WireGuard codebase because it’s reputable enough, but for obscure or unknown add-ons/package code, it’s on you to double-check, just like reading the ‘readme’.
I don't see how doing any of this manually will help.
Earlier quoted context omitted.
Not really, and it takes a few minutes because most of these packages (including npm) are small. You don’t have to read the WireGuard codebase because it’s reputable enough, but for obscure or unknown add-ons/package code, it’s on you to double-check, just like reading the ‘readme’.
I haven’t looked at the source code of a single npm package I’ve installed in the past 5 years. “It takes a few minutes” Dude my web dev projects have like 1,000s of dependencies. I’m not going to check the source code of every package tailwind requires.
A cursory audit of primary dependencies has almost zero chance of catching anything but a brazen exploit.
Is there no way to defend against a keylogger? What can you do if a simple keylogger can steal your passwords?
So, don't run stuff as root. If it needs root access, run it in a virtual machine (personally I use qubes os for this).