Skip to content

feat(heuristics): add two analyzers to detect dependency confusion and distinguish from stub packages#1117

Merged
behnazh-w merged 3 commits into
oracle:mainfrom
AmineRaouane:dependency-confusion
Sep 9, 2025
Merged

feat(heuristics): add two analyzers to detect dependency confusion and distinguish from stub packages#1117
behnazh-w merged 3 commits into
oracle:mainfrom
AmineRaouane:dependency-confusion

Conversation

@AmineRaouane

@AmineRaouane AmineRaouane commented Jul 5, 2025

Copy link
Copy Markdown
Member

Summary

This PR adds three new heuristic analyzers designed to detect potential dependency confusion attacks and differentiate them from harmless stub or placeholder packages.

Description of changes

  • Implemented two new analyzers :
    • minimal_content : Indicates that the package has minimal content ( low number of files).
    • unsecure_description : Indicates that the package's description is unsecure, such as not having a descriptive keywords that indicates it's a stub package .
  • Integrated these analyzers into the heuristics.py.

Related issues

None

Checklist

  • I have reviewed the contribution guide.
  • My PR title and commits follow the Conventional Commits convention.
  • My commits include the "Signed-off-by" line.
  • I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
  • I have updated the relevant documentation, if applicable.
  • I have tested my changes and verified they work as expected.

@oracle-contributor-agreement oracle-contributor-agreement Bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Jul 5, 2025
@AmineRaouane AmineRaouane force-pushed the dependency-confusion branch from 2585e75 to ab17698 Compare July 5, 2025 13:37
@AmineRaouane AmineRaouane changed the title Dependency confusion detection feat(heuristics): add three analyzers to detect dependency confusion and distinguish from stub packages Jul 5, 2025
@AmineRaouane AmineRaouane force-pushed the dependency-confusion branch from ab17698 to ae021e1 Compare July 5, 2025 13:54
@AmineRaouane AmineRaouane changed the title feat(heuristics): add three analyzers to detect dependency confusion and distinguish from stub packages feat(heuristics): add two analyzers to detect dependency confusion and distinguish from stub packages Aug 6, 2025
@AmineRaouane AmineRaouane force-pushed the dependency-confusion branch from d555c54 to 7b6f07c Compare August 7, 2025 22:45
Comment thread src/macaron/malware_analyzer/README.md Outdated
Comment thread src/macaron/slsa_analyzer/checks/detect_malicious_metadata_check.py
Amine added 2 commits September 5, 2025 02:12
…and distinguish from stub packages

Signed-off-by: Amine <amine.raouane@enim.ac.ma>
Signed-off-by: Amine <amine.raouane@enim.ac.ma>
@behnazh-w behnazh-w merged commit ca1fc9c into oracle:main Sep 9, 2025
13 of 14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OCA Verified All contributors have signed the Oracle Contributor Agreement.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants