一句话：提出 LastPyMile，定位包构建产物与源码仓库的差异，以改进软件供应链恶意代码扫描。
开源包源代码可在仓库中检查，但开发者常直接使用 PyPI 等包仓库中的预构建包，这隐含假设源码与包一致；二者差异会带来操作风险（如依赖项目无法编译）与安全风险（如安装时部署恶意代码）。作者对 PyPI 上 2438 个热门包、约 1000 万行代码实证评估，发现现实中存在多种差异，且不能都归因于恶意注入。全量复查这些“可能正常但被修改”的包对下游用户难以管理。为此提出 LastPyMile 方法，识别包构建产物与源码仓库间的差异，并扩展当前仅覆盖已部署包代码不到 1% 的恶意代码注入扫描实践。
Open source packages have source code available on repositories for inspection (e.g. on GitHub) but developers use pre-built packages directly from the package repositories (such as npm for JavaScript, PyPI for Python, or RubyGems for Ruby). Such convenient practice assumes that there are no discrepancies between source code and packages. These differences pose both operational risks (e.g. making dependent projects unable to compile) and security risks (e.g. deploying malicious code during package installation) in the software supply chain. Our empirical assessment of 2438 popular packages in PyPI with an analysis of around 10M lines of code shows several differences in the wild: modifications cannot be just attributed to malicious injections. Yet, scanning again all and whole ‘most likely good but modified’ packages is hard to manage for FOSS downstream users. We propose a methodology, LastPyMile, for identifying the differences between build artifacts of software packages and the respective source code repository. We show how it can be used to extend current package scanning practices for malware injection (which only covers less than 1% of the code of deployed packages).
@inproceedings{paperbot6338,
title = {LastPyMile: identifying the discrepancy between sources and packages},
author = {Duc-Ly Vu and Fabio Massacci and Ivan Pashchenko and Henrik Plate and Antonino Sabetta},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3468592}
}