Creator and maintainer of vet here. We monitor public package registries, perform code analysis to identify malicious packages & work towards getting them reported and eliminated.
We recently reported a bunch of malicious npm packages which finally got included in OSV and now hopefully all SCA tools and everyone else will identify and block these. Npm takes longer but got these removed from the registry as well.
We have been doing this for a while. We started with simple signature matching, then static code analysis and eventually dynamic analysis. Our systems are becoming complex, consuming resources and like any other complex systems, harder to extend. But we don't see any improvement in the overall ecosystems. We are still seeing the same type of malicious packages published every day. I am sure there are more sophisticated ones that we are yet to identify.
Intuitively it just seems like the problem of early 2000 where anyone would upload malicious executables in various freeware download sites. Eventually the AV and OS ecosystems improved in terms adopting signed executables, endpoint protection etc. With malicious open source packages, the attack is shifted towards developers, leveraging higher level scripting languages running within trusted processes like Node, Java, Python etc.
How do you see a solution emerging against malicious package sprawl?