No One Knows Open Source Like Sonatype

Whenever new open source vulnerabilities are disclosed, criminals immediately begin looking for opportunities to exploit them in the wild. As a result, it’s literally a race between “bad guys” and “good guys” to see who acts first. Companies lose when bad actors are able to exploit open source vulnerabilities faster than they can remediate them.

When it comes to managing the constantly evolving security threats within open source, speed is absolutely critical. That’s why Sonatype Intelligence works 24x7x365 to stay abreast of the changing threat landscape and publishes detailed information on new vulnerabilities 10X faster than NVD. Your open source vulnerability management process can move as fast as the evolving open source risk landscape demands.

Traditional software composition analysis (SCA) tools are prone to false positives and negatives because they scan apps “as declared” and trust developers to disclose the truth about dependencies embedded in software.

Sonatype scans apps “as deployed” utilizing Advanced Binary Fingerprinting (ABF). The result is accurate and comprehensive software threat intelligence based on a precise read of embedded dependencies and a Software Bill of Materials (SBOM) that reflects the truth about third-party risk. ABF identification utilizes cryptographic hash for binaries, structural similarity, derived coordinate, and file name.  It can even identify renamed or modified components whether they were declared or not, misnamed, or added to the code base manually.

Over the past two years, more than 20 instances of adversaries intentionally publishing malicious components into public open source and container repositories were recorded. Open source projects impacted by malicious injections have been difficult to detect because, on the surface, they look no different than other open source code contributions.

To combat this new type of attack, Sonatype monitors millions of open source projects in real-time to identify abnormal development behavior and suspicious patterns as new component versions are released. Now developers and security teams alike can see within Sonatype Intelligence when a component version has been detected as malicious code.

Octopus Scanner is a great example of why scanning the manifest is not "good enough" to identify malicious components being injected into our software supply chains. You need a solution that provides complete insight into open source risks for a secure software supply chain. The Sonatype platform leverages Advanced Binary Fingerprinting (ABF) intelligence to deliver the most advanced vulnerability intelligence.

Public databases like NVD provide a relatively small and typically outdated view of open source security vulnerabilities. Sonatype’s comprehensive vulnerability intelligence is far more expansive. Our research team regularly discovers new threats and vulnerabilities, which are added to Sonatype’s proprietary knowledge base.