Detecting Malicious Dependencies at Scale with Static Analysis

Explore techniques for identifying and neutralizing malicious dependencies in open source package managers through static analysis in this 54-minute conference talk. Learn how to develop Semgrep rules for detecting code patterns common to malicious packages and uncommon in normal software. Discover methods for using static analysis and package metadata to identify features that collectively signal possible inclusion of malicious code. Gain insights into speeding up the auditing process for third-party software in highly-controlled environments. Presented by Kurt Boberg from Semgrep's Security Research Team at the OWASP Foundation event, this talk provides valuable knowledge for improving open-source supply chain security.