Hacker News: ashishbijlani

New comment by ashishbijlani in "Keyv and friends compromised in active Shai-Hulud supply chain attack"

ashishbijlani — Tue, 04 Aug 2026 23:54:15 +0000

I've been building an OSS tool to detect software supply-chain attacks: https://github.com/ossillate-inc/packj

Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect impersonating packages (typo squatting).

New comment by ashishbijlani in "Malicious npm packages detected across Red Hat Cloud Services"

ashishbijlani — Mon, 01 Jun 2026 18:37:02 +0000

Built Packj [1] to audit dependencies easily from CLI.

1. Packj (https://github.com/ossillate-inc/packj) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).

New comment by ashishbijlani in "Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library"

ashishbijlani — Thu, 30 Apr 2026 23:31:39 +0000

Built Packj [1] to do exactly this.

New comment by ashishbijlani in "Show HN: Artifact Keeper – Open-Source Artifactory/Nexus Alternative in Rust"

ashishbijlani — Fri, 06 Feb 2026 19:47:48 +0000

This is a great initiative. Thanks for sharing! I will use it to create my personal cache of package registries (beyond obvious advantages of caching, it can also mitigate typo-squatting attacks).

BTW, if there's an interest, I'd love to collaborate and integrate Packj [1] audit for malware scans.

New comment by ashishbijlani in "Cloudflare Sandbox SDK"

ashishbijlani — Thu, 16 Oct 2025 21:49:39 +0000

I’m extending Packj sandbox for agentic code execution [1]. You can specify allowlist for network/fs.

1. https://github.com/ossillate-inc/packj/blob/main/packj/sandb...

New comment by ashishbijlani in "Show HN: Tips to stay safe from NPM supply chain attacks"

ashishbijlani — Mon, 22 Sep 2025 02:29:37 +0000

Plug: I've been building a tool to detect software supply-chain cyberattacks: https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "NPM debug and chalk packages compromised"

ashishbijlani — Mon, 08 Sep 2025 16:19:53 +0000

Packj [1] detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).

1. https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "Show HN: Pipask – safer pip without compromising convenience"

ashishbijlani — Sat, 03 May 2025 18:13:22 +0000

Plug: I've been building a similar tool: https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "Show HN: Arrakis – Open-source, self-hostable sandboxing service for AI Agents"

ashishbijlani — Wed, 02 Apr 2025 19:37:55 +0000

Hi Abhishek, the backtracking feature looks super useful. Congrats on launching!

New comment by ashishbijlani in "Ask HN: Have you ever been hired because of open-source contributions?"

ashishbijlani — Wed, 19 Mar 2025 21:37:51 +0000

Not for contributions only, but developing ExtFUSE [1] got me a lot of offers and consulting work.

1. https://github.com/extfuse/extfuse optimizes FUSE with eBPF

New comment by ashishbijlani in "Analysis of supply-chain attack on Ultralytics"

ashishbijlani — Sun, 15 Dec 2024 01:23:59 +0000

> If the tech is open-sourced, then an attacker can keep trying in private until they find an exploit, and then use it.

So you'd rather assume that if something is obscure, it is secure?

New comment by ashishbijlani in "Analysis of supply-chain attack on Ultralytics"

ashishbijlani — Sun, 15 Dec 2024 00:46:14 +0000

We scan PyPI packages regularly for malware to provide a private registry of vetted packages.

The tech is open-sourced: Packj [1]. It uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect impersonating packages (typo squatting).

1. https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "Ultralytics AI model hijacked to infect thousands with cryptominer"

ashishbijlani — Sat, 07 Dec 2024 22:59:32 +0000

This is exactly why I'm building Packj audit [1]. It detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).

1. https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "A Study of Malware Prevention in Linux Distributions"

ashishbijlani — Thu, 21 Nov 2024 23:44:31 +0000

Good to see Packj[1] as one of the malware scanners used.

1. https://github.com/ossillate-inc/packj

Packj detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).

New comment by ashishbijlani in "Cybercriminals pose as "helpful" Stack Overflow users to push malware"

ashishbijlani — Thu, 30 May 2024 19:04:53 +0000

Plug: I’ve been building Packj [1] to detect malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).

1. https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.""

ashishbijlani — Sun, 31 Mar 2024 02:10:06 +0000

I’ve been building Packj [1] to detect malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).

1. https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "PyPI halted new users and projects while it fended off supply-chain attack"

ashishbijlani — Thu, 28 Mar 2024 21:31:36 +0000

I’ve been building Packj [1] to detect such attacks. Packj can flag malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP dependencies. We use static, dynamic, & metadata analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc.) OR presence of vulnerabilities.

1. https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "Over 100k Infected Repos Found on GitHub"

ashishbijlani — Thu, 29 Feb 2024 13:17:19 +0000

I’ve been building an open-source tool Packj [1] to detect publicly malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages. It carries out static/dynamic/metadata analysis and scans for 40+ attributes such as spawning of shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages.

1. https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "A cautionary tale about software dependencies during major geopolitical events"

ashishbijlani — Fri, 19 Jan 2024 17:30:46 +0000

> For how to know you can trust a dependency, I'm afraid there is no solution: no theorem prover nor isolation, cryptography nor layerizarion can save you.

I'm taking a stab at addressing this problem with Packj [1]. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, invalid/expired email (i.e., no 2FA), use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more.

1. https://github.com/ossillate-inc/packj

New comment by ashishbijlani in "Ledger's NPM account has been hacked"

ashishbijlani — Thu, 14 Dec 2023 15:21:53 +0000

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, invalid/expired email (i.e., no 2FA), use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more.

1. https://github.com/ossillate-inc/packj