CHAINGUARD’S SCAN OF 52K OSS PACKAGES SPOTLIGHTS “GREYWARE” BEHAVIORS HIDING IN PLAIN SIGHT
Chainguard scanned 52,000 open-source packages and found widespread "greyware" patterns that blur the line between legit code and supply‑chain risk. Chainguard...
Chainguard scanned 52,000 open-source packages and found widespread "greyware" patterns that blur the line between legit code and supply‑chain risk.
Chainguard’s new findings surface behaviors like post‑install scripts, silent telemetry, and network calls that aren’t outright malware but still change your risk profile. The scan spanned 52k packages and highlights how common these patterns have become.
If you rely on transitive deps, you may already be running unreviewed code during builds and even at runtime. Read the analysis in The New Stack’s coverage of Chainguard’s greyware scanner and results: The New Stack.
Supply-chain risk is increasingly coming from "legit" packages via post-install scripts, telemetry, and hidden network calls.
Transitive dependencies can silently execute code in CI and prod, undermining least-privilege and auditability.
-
terminal
Run CI with install scripts disabled and egress blocked; compare which packages fail or try network calls (e.g., npm --ignore-scripts plus network deny).
-
terminal
Generate and diff SBOMs weekly to catch new native binaries, post-install hooks, or surprise deps entering images.
Legacy codebase integration strategies...
- 01.
Pin and vendor critical packages; enforce an allowlist for post-install scripts and native builds in CI.
- 02.
Default-deny network egress in builds; alert on packages with obfuscated code, telemetry by default, or self-update logic.
Fresh architecture paradigms...
- 01.
Stand up an internal curated mirror and require signed, reproducible builds with script-free installs by default.
- 02.
Prefer libraries with minimal dependencies and explicit telemetry toggles; document a zero-script install policy early.
Get daily NPM + SDLC updates.
- Practical tactics you can ship tomorrow
- Tooling, workflows, and architecture notes
- One short email each weekday