Security researchers at Apiiro have released two free, open-source tools designed to detect and block malicious code before they are added to software projects to curb supply chain attacks.

The two tools consist of a comprehensive ruleset for Semgrep and Opengrep designed to detect malicious code patterns with minimal false positives and PRevent, a GitHub-integrated scanner, that detects and alerts on suspicious code in pull requests (PRs).

According to Apiiro’s security researcher Matan Giladi, the tools have a minimal false positive detection rate, making them particularly valuable in real-world practice.

Specifically, the detection accuracy of the ruleset for PyPI packages is 94.3%, while it drops to the still impressive 88.4% for npm packages. PRevent successfully flags malicious PRs in 91.5% of the examined cases.

Catching malicious code

Apiiro’s malicious code detection strategy is based on identifying “code anti-patterns,” which are suspicious patterns in code that demonstrate behaviors that are rare in legitimate code but common in malware.

The detection system uses static analysis, meaning it examines code without executing it, keeping the environment safe from accidental infections.

These anti-patterns include:

• Various obfuscation methods like encoding, nested transformations, and runtime modifications that help hide the code’s functionality and intent.
• Use of exec(), eval(), or similar functions, which allow arbitrary code execution at runtime.
• Code that downloads and executes remote payloads from external, unknown servers.
• Methods for exfiltrating sensitive user data to external locations.

This ruleset can be integrated into CI/CD pipelines for automatic repository scanning, used for scanning npm and PyPI packages, or adapted to other platforms using Semgrep or Opengrep.

PRevent, which uses the same anti-patterns, is designed to scan pull request events in real-time before code is merged, stopping any threats before they reach production.

It can be set to block the merging until an authorized reviewer approves it or add comments on detected issues to ensure developers are alerted of the risks.

Apiiro acknowledges that its tools are still practically limited, as they cannot detect malware hidden in compiled binaries nor scan npm and PyPI packages directly, but plans to add more features like deep code analysis and AI-assisted scans in future updates.

Both the malicious code detection ruleset and the PRevent tool are available for free on GitHub, with instructions on how to use them.

BleepingComputer has not tested these security tools and cannot guarantee their effectiveness or safety.

February 17th Bitfinex alpha | BTC merges as a surge in inflation

Bitcoin continues to trade within the narrow $91,000 to $102,000 range, and is now growing for 81 consecutive integration days. Markets are not directional as geopolitical tensions and macroeconomic uncertainties place emphasis on emotions due to historic low volatility. Over the past week, Bitcoin’s peak-to-peak movement was only 4.3%, shutting down with a modest profit of 0.82%, underscoring the lack of strong buying and selling pressure.

Altcoins have suffered significant losses, with meme coins like Pepe plunging 46.4% over the past month, with OM, LTC and hype being the only big caps continuing to make profits.

Bitcoin Interchange Current Pulse (IFP) – a useful indicator of market sentiment – has become bearish for the first time since June 2024, suggesting a potential downside. IFP records move wallets from derivative wallets to spots in BTC exchange flows, suggesting a decrease in risk appetite, which can often lead to market corrections. Meanwhile, the realized losses surged during recent retests of low range, reflecting past surrender events within the ongoing bull cycle.

However, despite signs of weight in the recent market, Bitcoin remains structurally intact. Historically, the 81-day integration phase will be resolved within 90 days. In other words, a critical breakout (or down) should be imminent.

With inflation surged in January 2025, the US economic situation also faces new challenges, marking the biggest rise in consumer prices in nearly 18 months. The consumer price index rose 0.5% that month, pushing inflation to 3% year-on-year. An unexpected spike in inflation occurs when the Federal Reserve maintains restrictive financial policies to control price stability and is unlikely to cause an immediate interest rate cut. The labour market remains strong, with rising wages further complicating efforts to drive consumer demand and control inflation.

In addition to inflation concerns, the producer price index rose 0.4% in January and 0.5% in December, marking the sharpest two-month increase in nearly a year. Acceleration of wholesale prices indicates sustained inflationary pressures in the supply chain, making it more difficult for businesses to absorb rising costs without them taking over to consumers. Initially, the market was sold with several interest rate cuts, but inflation has proven to be more stubborn than expected, causing the Federal Reserve to rise longer, affecting borrowing costs and business investments. It may give.

It is true that US retail sales fell sharply in January, falling 0.9%, marking the biggest decline in nearly two years. However, the recession was largely due to harmful weather conditions, ongoing vehicle shortages and wildfire disruptions. The coming months will be important in determining whether this decline is a seasonal adjustment or a sign of a broader economic headwind.

In the meantime, the strategy previously known as MicroStrategy has expanded Bitcoin Holdings again, earning an additional 7,633 BTC last week. This brings the total holdings to 478,740 BTC, with an average purchase price of $62,473. Executive Chairman Michael Saylor remains steady in his long-term “purchase and hold” strategy and reaffirms his commitment to not selling the company’s Bitcoin Holdings. The latest acquisition, disclosed in a February 10th filing, further strengthens the strategic position as one of Bitcoin’s largest institutional owners and strengthens confidence in the long-term value proposition of its assets.

Meanwhile, the institutional adoption of Bitcoin has gained momentum as Abu Dhabi sovereign wealth fund Mubadara Investment Company invested heavily in BlackRock’s spot Bitcoin ETF in the fourth quarter of 2024, with a massive $436.9 million investment in BlackRock’s spot Bitcoin ETF. I’m continuing. A crypto-friendly jurisdiction that operates in Abu Dhabi during the same period and further solidifies the role of the region.

]]> https://earlybirdsinvest.com/bitfinex-alpha-btc-merges-as-a-surge-in-inflation/feed/ 0 20404