64
submitted 1 year ago by wolf4ood@lemmy.ml to c/rust@lemmy.ml
you are viewing a single comment's thread
view the rest of the comments
[-] expertmadman@sh.itjust.works 5 points 1 year ago* (last edited 1 year ago)

I'm one of the co-founders @ Phylum. We have a history of reporting these attacks/malware to the appropriate organizations. We work closely with PyPI, NPM, Github, and others - and have reported thousands of malicious packages in the last few years. If you were following GIthub's recent security advisory, you can see a shout-out for some of our previous work. There are also public thanks from the Crates.io team for our efforts over on HN.

I say all this to assure you we didn't write or release this malware. It just wouldn't make sense, especially when these open-source ecosystems contain so much malware for us to hunt and report on already. Though I get the logic, we have seen other security companies do this - and called them out for it.

Our platform is free for developers and small teams (heck, I'll give anyone who asks for it a free pro account if you really need it). We've open-sourced our CLI and sandbox that limits access to network/disk/env during package installation. We're genuinely - really - trying to help make these ecosystems safer.

this post was submitted on 24 Aug 2023
64 points (93.2% liked)

Rust Programming

7734 readers
1 users here now

founded 5 years ago
MODERATORS