Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add a check to analyze malicious Python packages #750

Merged
merged 47 commits into from
Jul 4, 2024

Conversation

Yao-Wen-Chang
Copy link
Contributor

@Yao-Wen-Chang Yao-Wen-Chang commented May 26, 2024

PR Message:

Implemented PyPI's heuristics check to detect suspicious packages using seven key heuristics.

TODO List:

  • Implement PyPI's heuristics check to detect the suspicious packages with seven heuristics
  • Implement confidence policy
  • Implement PyPI package registry
  • Design the DB table to store the proper result
  • Create src/macaron/malware_analyzer/ directory and move this check there.
  • Update documentation to reflect the new heuristics and their usage
  • Write unit tests to ensure the reliability and accuracy of the heuristics implementation

@oracle-contributor-agreement oracle-contributor-agreement bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label May 26, 2024
@Yao-Wen-Chang Yao-Wen-Chang marked this pull request as draft May 26, 2024 06:25
pyproject.toml Outdated Show resolved Hide resolved
@tromai
Copy link
Member

tromai commented May 31, 2024

@Yao-Wen-Chang When you address an issue mentioned in a comment, you can put the link to the commit next to the comment indicating that it has been resolve. Something like this would be extremely helpful for my review. Thanks!

Fixed this in https://github.com/oracle/macaron/pull/750/commits/d6684088dbe7792731240709d73a17de1eba73ad

@Yao-Wen-Chang Yao-Wen-Chang force-pushed the implement-heuristic-check branch from d668408 to 80b544a Compare June 8, 2024 16:54
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
…ink analyzer

Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
@Yao-Wen-Chang Yao-Wen-Chang force-pushed the implement-heuristic-check branch from a5f7b2b to bd1e010 Compare July 4, 2024 08:11
@behnazh-w behnazh-w merged commit 6e025b2 into oracle:staging Jul 4, 2024
9 checks passed
@Yao-Wen-Chang Yao-Wen-Chang deleted the implement-heuristic-check branch July 23, 2024 14:24
art1f1c3R pushed a commit that referenced this pull request Nov 29, 2024
Signed-off-by: Yao-Wen-Chang <changyaowen19980629@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
OCA Verified All contributors have signed the Oracle Contributor Agreement.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants