開源漏洞趨勢：公告四年低點、惡意軟體激增

🔑 增強重點摘要

• •The surge in malware advisories is largely attributed to the proliferation of automated 'dependency confusion' and 'typosquatting' attacks targeting popular package managers like npm and PyPI.
• •The decline in reviewed advisories is linked to GitHub's shift toward automated, AI-driven vulnerability detection, which has reduced the reliance on manual human review for low-severity issues.
• •The increase in CNA (CVE Numbering Authority) publishing volume reflects a broader industry push toward decentralizing vulnerability disclosure, allowing more maintainers to issue their own identifiers without waiting for centralized oversight.

🛠️ 技術深入

• •GitHub utilizes the 'GitHub Advisory Database' which integrates with the 'GitHub Security Lab' to automate the ingestion of vulnerability data from various sources including the NVD and direct maintainer submissions.
• •The platform employs machine learning models to classify incoming security alerts, distinguishing between legitimate software vulnerabilities (CWEs) and malicious packages (malware) based on behavioral analysis of code commits and package metadata.
• •The CNA publishing process is facilitated through the 'GitHub Security Advisories' (GHSA) API, which allows for automated synchronization with the CVE program's JSON schema version 5.0.

🔮 前景展望基於引用來源的 AI 分析

⏳ 時間線