November 2018 Summaries

The event-stream npm package was found to contain a malicious child package, flatmap-stream, which had been downloaded nearly 8 million times since its inclusion in September 2018. The malicious code focused on stealing bitcoins from applications, redirecting any mined bitcoins to the attacker's wallet. The incident highlights the risks of using outdated and unmaintained packages, as well as the importance of regular security testing and monitoring. Snyk has added the vulnerability to its database and notified affected users, while npm has unpublished the malicious library. Developers are advised to check if they are using the malicious package and eliminate it from their applications, and consider running a one-off test for their repositories.

Snyk has introduced its application security runtime monitoring solution, allowing developers to monitor the actual behavior of their open source components at runtime. This capability provides accurate indication of vulnerable function invocation in a project's dependencies, simplifying triaging by helping understand which part of the application is using them. The solution can be integrated into CI cycles and repositories, analyzing open source dependencies and flagging vulnerabilities with remediation actions. To get started, developers can add the @snyk/nodejs-runtime-agent dependency to their Node.js projects and configure it in their application's start sequence. For Java applications, they can download the runtime agent and create a configuration file. The solution is currently available as an early access closed beta and will be released out of beta in the next couple of weeks after gathering feedback.

The State of Open Source Security Survey` is a global view of the industry's security health, aiming to provide insights into open source maintainers' security knowledge and practices. The survey seeks answers to questions such as security knowledge ratings, vulnerability discovery methods, library tracking, upgrade drivers, response times to vulnerabilities, and more. By filling out the survey, respondents can receive a personalized PDF report with results, and their input will help create another great report showcasing the security landscape in the open source ecosystem.