Detecting suspected malware in open-source dependencies

A non-transitory computer-readable medium comprising memory with instructions encoded thereon that, when executed by one or more processors, causes the one or more processors to perform operations comprising:

• receiving a request to scan a package integration for a malicious dependency, the package integration comprising a plurality of dependencies, the package integration to be integrated into an application;
• determining a subset of the plurality of dependencies that, if executed, would be used by the application;
• determining, by accessing a known package cache, that at least a portion of a file of the subset was not previously scanned;
• responsive to determining that the portion of the file of the subset was not previously scanned:
• accessing a graph representation of the portion, the graph representation comprising a tree with edges that connect a representation of the portion with representations of one or more further dependent files that depend from the portion,
• scanning the portion and each of the one or more further dependent files for malware, and
• updating the known package cache with the tree and with results of the scan;
• determining whether malware is within the package integration using the known package cache and the results of the scan;
• and
• responsive to determining that the malware is within the package integration, outputting an alert.

A system comprising:

• memory with instructions encoded thereon;
• and
• one or more processors that, when executing the instructions, are caused to perform operations comprising:
• receiving a request to scan a package integration for a malicious dependency, the package integration comprising a plurality of dependencies, the package integration to be integrated into an application;
• determining a subset of the plurality of dependencies that, if executed, would be used by the application;
• determining, by accessing a known package cache, that at least a portion of a file of the subset was not previously scanned;
• responsive to determining that the portion of the file of the subset was not previously scanned:
• accessing a graph representation of the portion, the graph representation comprising a tree with edges that connect a representation of the portion with representations of one or more further dependent files that depend from the portion,
• scanning the portion and each of the one or more further dependent files for malware, and
• updating the known package cache with the tree and with results of the scan;
• determining whether malware is within the package integration using the known package cache and the results of the scan;
• and
• responsive to determining that the malware is within the package integration, outputting an alert.