npm和PyPi注册中心常见威胁调查
A Survey on Common Threats in npm and PyPi Registries
摘要：
软件工程师经常使用JavaScript和Python来完成前端和后端自动化任务。除了JavaScript和Python之外，还有几个框架可以进一步促进自动化任务。其中一些框架是节点管理器包（npm）和Python包索引（PyPi），它们是开源（OS）包库。npm和PyPi用于托管包的公共注册表允许任何具有验证电子邮件的用户发布代码。在向注册表发布时缺乏全面的扫描工具会产生安全问题。用户可以在注册表上报告恶意代码;然而，攻击者仍然可以造成损害，直到他们从平台上删除他们的工具。此外，多个包相互依赖，使得它们更容易受到依赖树中坏包的影响。大量的代码重用产生了开发人员必须考虑的安全构件，比如包的范围。这个项目将说明与操作系统注册表和包依赖结构相关的常见风险的高级概述。在操作系统软件包注册表中，有几种攻击类型，例如拼写错误和组合抢注。过时的软件包会带来安全风险，我们将研究npm环境中存在的技术滞后程度。在本文中，我们的主要贡献包括在OS注册表中的常见威胁的调查。之后，我们将提出对策，以减轻所提出的风险。这些补救措施将主要集中在机器学习（ML）的应用上，以检测可疑活动。据我们所知，以ML为重点的对策是针对所列安全问题首次提出的可能解决方案。此外，该项目是第一个对npm和PyPi威胁的调查，尽管有几项研究关注的是威胁的一个子集。
英文摘要：
Software engineers regularly use JavaScript and Python for both front-end and back-end automation tasks. On top of JavaScript and Python, there are several frameworks to facilitate automation tasks further. Some of these frameworks are Node Manager Package (npm) and Python Package Index (PyPi), which are open source (OS) package libraries. The public registries npm and PyPi use to host packages allow any user with a verified email to publish code. The lack of a comprehensive scanning tool when publishing to the registry creates security concerns. Users can report malicious code on the registry; however, attackers can still cause damage until they remove their tool from the platform. Furthermore, several packages depend on each other, making them more vulnerable to a bad package in the dependency tree. The heavy code reuse creates security artifacts developers have to consider, such as the package reach. This project will illustrate a high-level overview of common risks associated with OS registries and the package dependency structure. There are several attack types, such as typosquatting and combosquatting, in the OS package registries. Outdated packages pose a security risk, and we will examine the extent of technical lag present in the npm environment. In this paper, our main contribution consists of a survey of common threats in OS registries. Afterward, we will offer countermeasures to mitigate the risks presented. These remedies will heavily focus on the applications of Machine Learning (ML) to detect suspicious activities. To the best of our knowledge, the ML-focused countermeasures are the first proposed possible solutions to the security problems listed. In addition, this project is the first survey of threats in npm and PyPi, although several studies focus on a subset of threats.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
