Sonatype Blog

1. End-users don’t need to personally verify smart contracts or any other open source software. The key is to have each version have a hash, and on EVM thatms easy — it’s the address of the contract. Then, more and more auditors go through the code and sign off on the contract. In fact, this should be done for lots of open source ecosystems, eg composer or npm, because then we might not have stuff like this: https://blog.sonatype.com/npm-project-used-by-millions-hijacked-in-supply-chain-attack

or this in log4j: https://theconversation.com/amp/what-is-log4j-a-cybersecurity-expert-explains-the-latest-internet-vulnerability-how-bad-it-is-and-whats-at-stake-173896

In fact it happens more and more:

http://cyware.com/news/analyzing-the-deadly-rise-in-npm-package-hijacking-78b24364

2) On EVM you can just audit a smart contract FACTORY, and then people can trust all the instances made from it. This is immensely powerful.

And then there is also regular use by people who put huge amounts of value into a protocol and it is never hacked. It is why for example people trust UniSwap liquidity pools not to rugpull them, and the same with many other protocols.

Now, to be fair, you don’t need a blockchain for that. You can use merkle trees and code signing. But the current Web sucks at it — you just have to trust the server not to suddenly send you bad code, or your “user agent” to execute JS that sends your password in the clear somewhere. And App Stores are black boxes where you just…

Yeah, I ask because the JVM world has had that since... whenever Maven's central repository came about [0][1][2], I guess, and it ensures that there's no debate about namesquatting [3], nor typosquatting attack vectors [4].

I am constantly baffled that NPM, PyPi, crates.io etc. didn't copy this idea for those last two reasons. In my mind, it's not quite best in class without it.

[0]: https://central.sonatype.org/publish/requirements/coordinates/#choose-your-coordinates

[1]: https://central.sonatype.org/faq/how-to-set-txt-record/

[2]: https://central.sonatype.org/publish/requirements/coordinates/#supported-code-hosting-services-for-personal-groupid

[3]: https://internals.rust-lang.org/t/pre-rfc-formal-squatting-policy-on-crates-io/11302

[4]: https://blog.sonatype.com/this-week-in-malware-may-13th-edition

Open source projects are not a good point of reference because by their very nature they invite external validation. If you are trying to steal $300M, you don't tell people before hand that you are going to do it. There also a difference between the money being right there, only one step away from being yours and infecting open source software with the possibility of maybe stealing something in some company that may or may not use your software in a way that would allow theft months or years after you submitted an update.

Edit: After doing some research, it appears that claims that open source doesn't fall victim to this problem are factually incorrect. [0]

[0] https://blog.sonatype.com/open-source-attacks-on-the-rise-top-8-malicious-packages-found-in-npm

Man Yue Mo worked at Semmle (https://blog.sonatype.com/steps-to-responsible-disclosure) before it was acquired by GitHub (https://github.blog/2019-09-18-github-welcomes-semmle/). That research function has carried on as the GitHub Security Lab.

Semmle built CodeQL, now offered by GitHub (https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql), which GitHub and Microsoft (see https://www.microsoft.com/en-us/security/blog/2023/11/02/announcing-microsoft-secure-future-initiative-to-advance-security-engineering/) want to associate with "deep security insight".

So they continue to fund this kind of novel security research, for which security practitioners across industry are grateful.

Here is a good writeup of some of the pros and cons of using a "reachability" approach.

https://blog.sonatype.com/prioritizing-open-source-vulnerabilities-is-reachability-useful

>Unfortunately, no technology currently exists that can tell you whether a method is definitively not called, and even if it is not called currently, it’s just one code change away from being called. This means that reachability should never be used as an excuse to completely ignore a vulnerability, but rather reachability of a vulnerability should be just one component of a more holistic approach to assessing risk that also takes into account the application context and severity of the vulnerability.

Seems like the Maven registry is susceptible to artifact hijacking.

Say I wan't to install artifacts from two GitHub users. I would have to add these two Maven repositories:

- https://maven.pkg.github.com/USER1
- https://maven.pkg.github.com/USER2

In that case USER1 can publish an artifact with the same groupId/artifactId as USER2 and my Maven will happily install it without suspecting anything.

Another case - someone deletes their GH account and another user takes it:
https://blog.sonatype.com/hijacking-of-a-known-github-id-go-bindata

Docs: https://help.github.com/en/articles/configuring-maven-for-use-with-github-package-registry