Skip to content

feat(heuristics): add three analyzers to detect dependency confusion and distinguish from stub packages #1117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

AmineRaouane
Copy link
Member

@AmineRaouane AmineRaouane commented Jul 5, 2025

Summary

This PR adds three new heuristic analyzers designed to detect potential dependency confusion attacks and differentiate them from harmless stub or placeholder packages.

Description of changes

  • Implemented three new analyzers :
    • minimal_content : Indicates that the package has minimal content ( low number of files).
    • unsecure_description : Indicates that the package's description is unsecure, such as not having a descriptive keywords that indicates it's a stub package .
  • Integrated these analyzers into the heuristics.py.
  • The UNKNOWN_ORGANIZATION and UNSECURE_DESCRIPTION were added to ONE_RELEASE and ANOMALOUS_VERSION to ensure that a package isn’t just a stub when they are triggered.

Related issues

None

Checklist

  • I have reviewed the contribution guide.
  • My PR title and commits follow the Conventional Commits convention.
  • My commits include the "Signed-off-by" line.
  • I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
  • I have updated the relevant documentation, if applicable.
  • I have tested my changes and verified they work as expected.

@oracle-contributor-agreement oracle-contributor-agreement bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Jul 5, 2025
@AmineRaouane AmineRaouane force-pushed the dependency-confusion branch from 2585e75 to ab17698 Compare July 5, 2025 13:37
@AmineRaouane AmineRaouane changed the title Dependency confusion detection feat(heuristics): add three analyzers to detect dependency confusion and distinguish from stub packages Jul 5, 2025
…and distinguish from stub packages

Signed-off-by: Amine <[email protected]>
@AmineRaouane AmineRaouane force-pushed the dependency-confusion branch from ab17698 to ae021e1 Compare July 5, 2025 13:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
OCA Verified All contributors have signed the Oracle Contributor Agreement.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant