Ensuring the Security of Open Python Projects: The Challenge of Assessing Potentially Destructive Functionality

Abstract

Open source software is widely used everywhere. Unfortunately, until recently, developers have not considered the need to monitor the security of the external projects they use. One can understand programmers: they would like to believe that if the source code is open, it has already been analyzed by automated means, and if it poses a security threat, the associated package will be removed. Unfortunately, this is not the case, and malicious functionality can exist in the form of an open project named to mimic a popular package for months. Malicious actors who add harmful packages to public code repositories pursue various selfish goals: theft of user accounts, file encryption with a ransom demand, unauthorized remote control of the device. This article discusses the problem of assessing potentially destructive functionality in open source software in Python. Various methods for assessing project security are discussed, including code and documentation analysis, code deobfuscation, developer reputation checks, and project dependency tracking. Attention is paid to the difficulties associated with determining the acceptability of certain functionality in a project in accordance with its tasks. A classification of functionality that falls under the definition of unsafe for the developer (for example, which can be a channel for sending information to a malicious actor) is provided. Existing approaches to code analysis are examined in detail, and the functional parts that can be described with their help are discussed.