Google Launches OSS Rebuild to Expose Malicious Code in Widely Used Open-Source Packages

Avatar
Google has announced the launch of a new initiative called OSS Rebuild to bolster the security of the open-source package ecosystems and prevent software supply chain attacks. “As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers,” Matthew Suozzo, Google Open Source Security
[[{“value”:”

Google has announced the launch of a new initiative called OSS Rebuild to bolster the security of the open-source package ecosystems and prevent software supply chain attacks.

“As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers,” Matthew Suozzo, Google Open Source Security Team (GOSST), said in a blog post this week.

The project aims to provide build provenance for packages across the Python Package Index (Python), npm (JS/TS), and Crates.io (Rust) package registries, with plans to extend it to other open-source software development platforms.

With OSS Rebuild, the idea is to leverage a combination of declarative build definitions, build instrumentation, and network monitoring capabilities to produce trustworthy security metadata, which can then be used to validate the package’s origin and ensure it has not been tampered with.

“Through automation and heuristics, we determine a prospective build definition for a target package and rebuild it,” Google said. “We semantically compare the result with the existing upstream artifact, normalizing each one to remove instabilities that cause bit-for-bit comparisons to fail (e.g., archive compression).”

Once the package is reproduced, the build definition and outcome is published via SLSA Provenance as an attestation mechanism that allows users to reliably verify its origin, repeat the build process, and even customize the build from a known-functional baseline.

In scenarios where automation isn’t able to fully reproduce the package, OSS Rebuild offers a manual build specification that can be used instead.

OSS Rebuild, the tech giant noted, can help detect different categories of supply chain compromises, including –

Published packages that contain code not present in the public source repository (e.g., @solana/web3.js)
Suspicious build activity (e.g., tj-actions/changed-files)
Unusual execution paths or suspicious operations embedded within a package that are challenging to identify through manual review (e.g., XZ Utils)

Besides securing the software supply chain, the solution can improve Software Bills of Materials (SBOMs), speed up vulnerability response, strengthen package trust, and eliminate the need for CI/CD platforms to be in charge of an organization’s package security.

“Rebuilds are derived by analyzing the published metadata and artifacts and are evaluated against the upstream package versions,” Google said. “When successful, build attestations are published for the upstream artifacts, verifying the integrity of the upstream artifact and eliminating many possible sources of compromise.”

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

“}]] The Hacker News 

Total
0
Shares
Previous Post

CISA Warns: SysAid Flaws Under Active Attack Enable Remote File Access and SSRF

Next Post

Kerberoasting Detections: A New Approach to a Decade-Old Challenge

Related Posts

Meta Adds Passkey Login Support to Facebook for Android and iOS Users

Meta Platforms on Wednesday announced that it's adding support for passkeys, the next-generation password standard, on Facebook. "Passkeys are a new way to verify your identity and login to your account that's easier and more secure than traditional passwords," the tech giant said in a post. Support for passkeys is expected to be available "soon" on Android and iOS mobile devices. The feature is
Avatar
Read More

Russian Hackers Exploit Microsoft OAuth to Target Ukraine Allies via Signal and WhatsApp

Multiple suspected Russia-linked threat actors are "aggressively" targeting individuals and organizations with ties to Ukraine and human rights with an aim to gain unauthorized access to Microsoft 365 accounts since early March 2025. The highly targeted social engineering operations, per Volexity, are a shift from previously documented attacks that leveraged a technique known as device code
Avatar
Read More