snare 1.6.0 — known-malicious packages in every ecosystem

snare now knows which package versions are malware, for npm, Python, Rust, Go and more, and stops them before they install.

Supply-chain malware isn't only an npm problem anymore. This month, LiteLLM's release pipeline was hijacked, and version 1.107.0 on PyPI shipped a file that Python runs every time it starts. In May, the TrapDoor campaign hit npm, PyPI and crates.io at once. Until now, snare didn't read any of those ecosystems.

Stopped before it installs

When a coding agent, or you, runs an install that names a known-malicious version, the gate stops it and shows the advisory:

🔥 FIRE ON THE MOUNTAIN — snare stopped this before it ran:
    pip install litellm==1.107.0

  litellm@1.107.0 (pypi) is known malware — this version: https://osv.dev/vulnerability/MAL-…

• Install commands covered: npm, pnpm, yarn, bun, npx, pip, uv, pipx, poetry, pdm, cargo, go, gem and composer.
• Files covered: requirements files and lockfiles are checked too.
• No version given: for a package where only some versions are bad, snare asks the registry which version would install. That's the same request the install was about to make. It only stops the install if that version is on the list.

Find and fix what's already there

snare deps            # this project: lockfiles, node_modules, virtualenvs
snare deps --system   # also your global Python, pipx, npm and cargo installs
snare deps fix        # remove each one, or replace it with a version that isn't listed

snare deps fix asks about each package. Replacements install with scripts turned off, so they can't run code while installing. If something malicious was actually installed, snare tells you to rotate your credentials next, since stealing them is what these packages are for.

Files other languages run on their own

The gate already watched package.json scripts and build configs. It now also checks:

• setup.py, conftest.py and build.rs;
• sitecustomize.py and .pth files, which Python runs at every start, the LiteLLM trick;
• //go:generate lines.

It flags them when they download code, or decode and run it. Ordinary ones are left alone.

Private by design

The known-malware list is built every six hours from OpenSSF's malicious-packages database, about 117,000 packages. Every snare downloads the same file and checks against it on your machine. Nothing about your packages is sent anywhere.

Also in this release

• A false alarm on incoming code can now be approved. Before, if the gate stopped a git checkout, pull or clone, snare gate allow only looked at files on disk. It said "nothing to allow" while the gate kept blocking. Now allow also looks at the code that's on its way in, and the block prints the exact command to approve it.
• snare respond handles those blocks too. It re-checks them, and lets you allow or leave each one.

Upgrade

snare update

Then check: snare deps status and snare deps.