The increasingly sophisticated environment in which attackers operate makes software security an even greater challenge in open-source projects, where malicious packages are prevalent. Static analysis tools, such as Malcontent, are highly useful but are often incapable of dealing with obfuscated malware. Such situations lead to an unreasonably high rate of false positives. This paper highlights that dynamic analysis, rather than static analysis, provides greater insight but is also more resource-intensive for understanding software behaviour during execution. In this study, we enhance a dynamic analysis tool, package-analysis, to capture key runtime behaviours, including commands executed, files accessed, and network communications. This modification enables the use of container sandboxing technologies, such as gVisor, to analyse potentially malicious packages without significantly compromising the host system.

翻译：攻击者所处的环境日益复杂，使得软件安全在恶意软件包普遍存在的开源项目中成为一项更为严峻的挑战。诸如Malcontent之类的静态分析工具虽然非常有用，但通常无法有效处理经过混淆的恶意软件。这种情况导致了不合理的高误报率。本文强调，与静态分析相比，动态分析能提供更深入的洞察，但对于理解软件在运行期间的行为也更为资源密集。在本研究中，我们增强了一个动态分析工具package-analysis，使其能够捕获关键的运行时行为，包括执行的命令、访问的文件以及网络通信。这项改进使得能够利用容器沙箱技术（例如gVisor）来分析潜在恶意的软件包，而不会对主机系统造成显著影响。