Oss Forensics

OSS Forensics

Purpose

• Use this skill to investigate open-source repositories, packages, images, and dependency trees for security risk.
• It is useful for package intake, third-party code review, incident response, and supply-chain due diligence.
• Treat this as a forensic and risk-triage workflow, not a single tool.

High-Level Approach

1. Audit dependencies for known vulnerabilities.
2. Assess repository trust signals and maintainer health.
3. Review code for suspicious patterns.
4. Generate an SBOM and map packages to CVEs.
5. Check history, provenance, and release integrity.

Dependency Audit

Python:

pip audit

Node:

npm audit

Rust:

cargo audit

• Start with ecosystem-native audit tools because they surface known advisories quickly.
• Audit output is a first-pass signal, not a complete security assessment.

Repository Trust Review

• Check stars, forks, contributors, and recent activity.
• Look for consistent release cadence rather than vanity popularity alone.
• Review the maintainer set and whether development is concentrated in one fragile account.
• Inspect open issues and unresolved security reports.
• Check whether CI appears healthy and whether releases are reproducible.

Maintainer Reputation Signals

• Is the maintainer known in the ecosystem.
• Does the project have multiple active reviewers.
• Are releases signed or provenance-documented.
• Has the project recently changed owners or transfer history.
• Did a previously dormant repo suddenly publish a new release with intrusive install-time behavior.

Dependency Confusion

• Check whether private internal package names also exist publicly.
• If an internal package name is accidentally resolved from a public registry, it can become a dependency confusion vector.
• Review package names in lockfiles, private registries, and CI configuration.
• Ensure package managers are pinned to the intended registry for internal namespaces.

Typosquatting Detection

• Compare the package name to well-known packages.
• Look for single-character swaps, dropped vowels, pluralization changes, or unicode lookalikes.
• Typosquatted packages often mimic metadata, README wording, or install instructions.
• Review whether the package description feels copied but inconsistent with the code quality.

License Compliance

Python:

pip-licenses

Repository-level license detection:

licensee detect .

• Security review and license review are separate concerns, but intake usually needs both.
• Unexpected license changes can also be a signal that package ownership changed or quality control weakened.

SBOM Generation

Using Syft:

syft .
syft image:myapp

CycloneDX example:

cyclonedx-bom

• Generate an SBOM to establish what is actually present.
• SBOMs are useful for later incident response, vulnerability matching, and compliance reporting.

CVE Lookup

Container image scanning:

grype image:myapp

Filesystem scanning:

trivy fs ./

• Use grype for image/package matching against vulnerability databases.
• Use trivy fs ./ for repository and local filesystem scanning.
• CVE output should be prioritized by exploitability, exposure, and runtime presence.

Code Review for Malicious Patterns

Look for:

• obfuscated strings
• suspicious eval()
• suspicious exec()
• large base64 blobs
• dynamic network fetch during install
• shell command execution in setup hooks
• credential collection logic unrelated to the package purpose

These are not proof by themselves, but they deserve deeper inspection.

Strings and Obfuscation Heuristics

• Long unreadable encoded literals
• split-and-join string tricks
• excessive use of reflection or metaprogramming in simple packages
• hidden payload assembly at runtime
• download-and-execute logic behind environment checks

Git History Review

Check for suspicious edits and removed secrets:

git log --all -S 'password'

• Search history for credential strings, hardcoded tokens, or suspiciously removed secrets.
• Also inspect install scripts, CI files, release automation, and package publish workflows.
• A secret that existed and was later removed may still indicate a risky maintainer process.