"One-Third of Popular PyPI Packages Mistakenly Flagged as Malicious"

Researchers discovered that the scanners tasked with filtering out malicious contributions to packages distributed via the popular open-source code repository Python Package Index (PyPI) generate many false alerts. According to Chainguard's analysis of PyPI, the main repository for software components used in Python applications, the approach catches 59 percent of malicious packages while also flagging one-third of popular legitimate Python packages and 15 percent of a random sample of packages. Chainguard researchers say the research aims to create a data set that Python maintainers and the PyPI repository can employ to determine the effectiveness of their system for scanning projects for malicious changes and supply chain attacks. While the current approach detects most malware, it requires improvements to avoid wasting project managers' time with false alarms, according to Zack Newman, a senior software engineer at Chainguard who contributed to the research. Many software analysis tools, and thus security teams, suffer from false positives. Even if a system is 100 percent accurate in detecting malicious packages, if it has a 1 percent false positive rate, developers and application-security professionals would still have to sift through 200 alerts each week to determine whether any of the 20,000 weekly PyPI releases are malicious. This article continues to discuss findings from Chainguard researchers' analysis of PyPI, PyPI's malware scanning method, and the targeting of open-source software repositories by cybercriminals.  

Dark Reading reports "One-Third of Popular PyPI Packages Mistakenly Flagged as Malicious"