#1060 Verify packages with Datadog's `guarddog` Issue created by edgarrmondragon Some of these checks may be useful: | Heuristic | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Command overwrite](https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/cmd-overwrite.yml) | The install command is overwritten in the setup.py file, indicating that a system command is automatically run when installing the package through pip install. | | [Dynamic execution of base64-encoded data](https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/exec-base64.yml) | A base64-encoded string ends up being executed by a function like exec or eval | | [Download of an executable to disk](https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/download-executable.yml) | Data coming from an HTTP response ends up being written to disk and made executable | | [Exfiltration of sensitive data to a remote server](https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/exfiltrate-sensitive-data.yml) | Sensitive data from the environment ends up being sent through an HTTP request | | [Code execution in setup.py](https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/code-execution.yml) | Code in setup.py executes code dynamically or starts a new process | | [Unusual domain extension](https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/shady-links.yml) | Usage of a domain name with an extension frequently used by malware (e.g. .xyz or .top) | | [Dynamic execution of hidden data from an image](https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/steganography.yml) | The package uses steganography to extract a payload from an image and execute it | | [Use of a common obfuscation method](https://github.com/DataDog/guarddog/blob/main/guarddog/analyzer/sourcecode/obfuscation.yml) | The package uses an obfuscation method commonly used by malware, such as running eval on hexadecimal strings | In particular,

exec-base64

detected a backdoor in a FastAPI extension: https://securitylabs.datadoghq.com/articles/malicious-pypi-package-fastapi-toolkit/ --- Example execution for

tap-getpocket

using

pipx

and `pip freeze`: pipx install git+https://github.com/edgarrmondragon/tap-getpocket.git pipx runpip tap-getpocket freeze > requirements.txt guarddog verify requirements.txt --json > results.json Results JSON [ { "dependency": "appdirs", "version": "1.4.4", "result": { "issues": 0, "errors": {}, "results": { "exfiltrate-sensitive-data": {}, "obfuscation": {}, "steganography": {}, "exec-base64": {}, "cmd-overwrite": {}, "shady-links": {}, "code-execution": {}, "download-executable": {} }, "path": "/var/folders/8b/z9sdckf92_g3hgnh6nv0yhbh0000gn/T/tmptr8m2ln1/appdirs" } }, { "dependency": "attrs", "version": "22.1.0", "result": { "issues": 0, "errors": {}, "results": { "exfiltrate-sensitive-data": {}, "obfuscation": {}, "steganography": {}, "exec-base64": {}, "cmd-overwrite": {}, "shady-links": {}, "code-execution": {}, "download-executable": {} }, "path": "/var/folders/8b/z9sdckf92_g3hgnh6nv0yhbh0000gn/T/tmpvou1f8j6/attrs" } }, { "dependency": "backoff", "version": "2.2.1", "result": { "issues": 0, "errors": {}, "results": { "exfiltrate-sensitive-data": {}, "obfuscation": {}, "steganography": {}, "exec-base64": {}, "cmd-overwrite": {}, "shady-links": {}, "code-execution": {}, "download-executable": {} }, "path": "/var/folders/8b/z9sdckf92_g3hgnh6nv0yhbh0000gn/T/tmpvbn21yvr/backoff" } }, { "dependency": "certifi", "version": "2022.9.24", "result": { "issues": 0, "errors": {}, "results": { "exfiltrate-sensitive-data": {}, "obfuscation": {}, "steganography": {}, "exec-base64": {}, "cmd-overwrite": {}, "shady-links": {}, "code-execution": {}, "download-executable": {} }, "path": "/var/folders/8b/z9sdckf92_g3hgnh6nv0yhbh0000gn/T/tmpqkdmplzl/certifi" } }, { "dependency": "cffi", "version": "1.15.1", "result": { "issues": 0, "errors": {}, "results": { "exfiltrate-sensitive-data": {}, "obfuscation": {}, "steganography": {}, "exec-base64": {}, "cmd-overwrite": {}, "shady-links": {}, "code-execution": {}, "download-executable": {} }, "path": "/var/folders/8b/z9sdckf92_g3hgnh6nv0yhbh0000gn/T/tmpoq43ygar/cffi" } }, { "dependency": "charset-normalizer", "version": "2.1.1", "result": { "issues": 0, "errors": {}, "results": { "exfiltrate-sensitive-data": {}, "obfuscation": {}, "steganography": {}, "exec-base64": {}, "cmd-overwrite": {}, "shady-links": {}, "code-execution": {}, "download-executable": {} }, "path": "/var/folders/8b/z9sdckf92_g3hgnh6nv0yhbh0000gn/T/tmpybjfohg7/charset-normalizer" } }, { "dependency": "click", "version": "8.1.3", "result": { "issues": 0, "errors": {}, "results": { "exfiltrate-sensitive-data": {}, "obfuscation": {}, "steganography": {}, "exec-base64": {}, "cmd-overwrite": {}, "shady-links": {}, "code-execution": {}, "download-executable": {} }, "path": "/var/folders/8b/z9sdckf92_g3hgnh6nv0… meltano/hub