  Package managers have become a vital part of the modern software development
process. They allow developers to reuse third-party code, share their own code,
minimize their codebase, and simplify the build process. However, recent
reports showed that package managers have been abused by attackers to
distribute malware, posing significant security risks to developers and
end-users. For example, eslint-scope, a package with millions of weekly
downloads in Npm, was compromised to steal credentials from developers. To
understand the security gaps and the misplaced trust that make recent supply
chain attacks possible, we propose a comparative framework to qualitatively
assess the functional and security features of package managers for interpreted
languages. Based on qualitative assessment, we apply well-known program
analysis techniques such as metadata, static, and dynamic analysis to study
registry abuse. Our initial efforts found 339 new malicious packages that we
reported to the registries for removal. The package manager maintainers
confirmed 278 (82%) from the 339 reported packages where three of them had more
than 100,000 downloads. For these packages we were issued official CVE numbers
to help expedite the removal of these packages from infected victims. We
outline the challenges of tailoring program analysis tools to interpreted
languages and release our pipeline as a reference point for the community to
build on and help in securing the software supply chain.
