  Software engineers regularly use JavaScript and Python for both front-end and
back-end automation tasks. On top of JavaScript and Python, there are several
frameworks to facilitate automation tasks further. Some of these frameworks are
Node Manager Package (npm) and Python Package Index (PyPi), which are open
source (OS) package libraries. The public registries npm and PyPi use to host
packages allow any user with a verified email to publish code. The lack of a
comprehensive scanning tool when publishing to the registry creates security
concerns. Users can report malicious code on the registry; however, attackers
can still cause damage until they remove their tool from the platform.
Furthermore, several packages depend on each other, making them more vulnerable
to a bad package in the dependency tree. The heavy code reuse creates security
artifacts developers have to consider, such as the package reach. This project
will illustrate a high-level overview of common risks associated with OS
registries and the package dependency structure. There are several attack
types, such as typosquatting and combosquatting, in the OS package registries.
Outdated packages pose a security risk, and we will examine the extent of
technical lag present in the npm environment. In this paper, our main
contribution consists of a survey of common threats in OS registries.
Afterward, we will offer countermeasures to mitigate the risks presented. These
remedies will heavily focus on the applications of Machine Learning (ML) to
detect suspicious activities. To the best of our knowledge, the ML-focused
countermeasures are the first proposed possible solutions to the security
problems listed. In addition, this project is the first survey of threats in
npm and PyPi, although several studies focus on a subset of threats.
