--- title: Open Source Readiness - Weekly Update - 26 September 2023 description: "This year at FINOS we are focusing on one of FINOS' key existing projects: Open Source Readiness. This is FINOS' term for helping the finance industry \"do open source properly\". It’s been all-go in the world of Open Source Readiness again this week. This week, let’s talk about Supply Chain Security." image: https://www.finos.org/hubfs/2023-09-20%20OSR%20Weekly%20Update.jpg --- [![FINOS](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/finos-logo.png?width=543&height=126&name=finos-logo.png "FINOS")](https://finos.org) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) ![Community Blog](https://www.finos.org/hubfs/10.04.19.FINOS_WebsiteBanners_3.png) # Community Blog # Open Source Readiness - Weekly Update - 26 September 2023 September 26, 2023 [Rob Moffat](https://www.finos.org/blog/author/rob-moffat) This year at FINOS we are focusing on one of FINOS' key existing projects: [Open Source Readiness](https://www.finos.org/open-source-readiness). This is FINOS' term for helping the finance industry "do open source properly". This week, let’s talk about Supply Chain Security. The table below is from our upcoming article, “Open Source Supply Chain Security” which is in PR at the moment and needs feedback. ![2023-09-26 OSR Weekly Update](https://www.finos.org/hs-fs/hubfs/2023-09-20%20OSR%20Weekly%20Update.jpg?width=531&height=297&name=2023-09-20%20OSR%20Weekly%20Update.jpg)   Here is a table from the article of some common supply chain attacks and vulnerabilities. How many have you heard of? # Examples of Common Supply Chain Attacks   | **Attack Name** | **Description** | **Example** | | --- | --- | --- | | [Dependency/Manifest Confusion](https://fossa.com/blog/dependency-confusion-understanding-preventing-attacks/) | An attacker publishes a package with the same name as a private package used by a specific company but in a public repository. If the company's build system is not properly configured, it may pull the malicious public package instead of the intended private one. | [Alex Birsan](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610) | | [Package Stealing/Hijacking](https://jfrog.com/blog/five-examples-of-infection-methods-attackers-use-to-spread-malicious-packages/#Software-Package-Hijacking) | Attackers can sometimes take over abandoned or poorly maintained packages and introduce malicious changes. They then publish the updated malicious version, and dependent systems automatically pull in these updates. | us-parser-js. | | [Malicious Forks/Masquerading](https://www.bleepingcomputer.com/news/security/35-000-code-repos-not-hacked-but-clones-flood-github-to-serve-malware/) | An attacker might create a fork of a popular open-source project, introduce malicious changes, and then attempt to promote or advertise this fork to unsuspecting users. | [Stephen Lacy](https://twitter.com/stephenlacy/status/1554697077430505473) | | [RepoJacking](https://www.bleepingcomputer.com/news/security/millions-of-github-repos-likely-vulnerable-to-repojacking-researchers-say/) | An attack where a malicious actor registers a username and creates a repository used by an organization in the past but which has since changed its name. Doing so results in any project or code that relies on the dependencies of the attacked project to fetch dependencies and code from the attacker-controlled repository, which could contain malware. | [CTX](https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-analysis-repo-jacking/) | | [Piggybacking on Legitimate Packages/Pull Request Sneaking](https://github.com/mortenson/pr-sneaking) | Some attackers contribute malicious code to popular and legitimate projects, usually through pull requests. If not thoroughly reviewed, the malicious code might get merged into the main project. | [Teleport](https://goteleport.com/blog/hack-via-pull-request/) | | [Download Count Inflation/Star Jacking](https://www.crn.com/news/security/checkmarx-attackers-hijacking-github-ratings-to-infect-as-many-targets-as-possible-) | To make a malicious package look popular and trustworthy, attackers artificially inflate the download count. | [Pampyio](https://www.pepy.tech/projects/pampyio) | | [Trojan Package](https://jfrog.com/blog/five-examples-of-infection-methods-attackers-use-to-spread-malicious-packages/#Trojan-Package) | In the trojan package infection method, the attacker publishes a fully functional library but hides malicious code in it. | lemaaa | | [Joke Packages](https://dev.to/codesphere/javascript-flaws-5-stupid-npm-packages-5fi) | Not strictly an attack, but publishing packages as jokes. Can harm the supply chain and cause dependency bloat. | [true](https://www.npmjs.com/package/true) | | [Cache Poisoning](https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/) | Exploiting weaknesses in parameter handling by package managers. | [Rack](https://security.snyk.io/vuln/SNYK-RUBY-RACK-1061917) | | [TypoSquatting](https://jfrog.com/blog/five-examples-of-infection-methods-attackers-use-to-spread-malicious-packages/#Typosquatting) | Typosquatting is the practice of obtaining (or squatting) a famous name with a slight typographical error. | "Amzon.com" |   Note: this table is just a list of notable examples. See [The MITRE ATT&CK](https://attack.mitre.org/) for a complete, authoritative list. How many did you know? # OSFF Reminder: 5 Weeks to Go! If you’re working for a FINOS member and you live in New York, why haven’t you signed up to come to OSFF yet? There are complimentary passes for employees of [FINOS Member Firms](https://www.finos.org/members) so hurry up and [register](https://events.linuxfoundation.org/open-source-finance-forum-new-york/register/) already! The OSR and InnerSource SIGs are collaborating on running a booth at the event - would you like to help staff it? [Get in touch if so!](mailto:rob.moffat@finos.org)   If you haven't received your unique member code, please contact [osff@finos.org](mailto:osff@finos.org) and we’ll get you sorted. [Sign up here!](https://bit.ly/3OR19tn)   Author: Rob Moffat   **Interested in this FINOS open source project, or any of our other projects? Click the link below to see how to get involved in the FINOS Community.** [![Get Involved](https://no-cache.hubspot.com/cta/default/2419532/89037a0a-24fa-4ef5-bbf8-34d9a45ea1d3.png)](https://cta-redirect.hubspot.com/cta/redirect/2419532/89037a0a-24fa-4ef5-bbf8-34d9a45ea1d3)   ### Share this: - [Tweet](https://twitter.com/share) [← Open Source Readiness - Weekly Update - 20 September 2023](https://www.finos.org/blog/open-source-readiness-weekly-update-20-september-2023) [Open Source Readiness - Weekly Update - 4 October 2023 →](https://www.finos.org/blog/open-source-readiness-weekly-update-4-october-2023) [![FINOS Logo](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/FINOS_Icon_Wordmark_White.png?width=689&height=971&name=FINOS_Icon_Wordmark_White.png "FINOS Logo")](https://www.finos.org/) [![Twitter logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/twitter-blue-social-panel.png)](https://twitter.com/finosfoundation) [![GitHub logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/github-black-social-panel.png)](https://finos.github.io) [![LinkedIn logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/linkedin-blue-social-panel.png)](https://www.linkedin.com/company/finosfoundation) [![SlideShare logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/slideshare-logo.png)](https://www.slideshare.net/finosfoundation) [![YouTube logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/youtube_logo-1.png)](https://www.youtube.com/channel/UCfJAdRALzJ7J7snubrb_Y-Q) [Contact Us](https://www.finos.org/contact-us) [info@finos.org](mailto:info@finos.org) +1 (650) 665-9773 [Privacy | ](https://www.finos.org/privacy-policy)[Terms of Service |](https://www.finos.org/terms-of-service)[Community Code of Conduct |](https://www.finos.org/code-of-conduct)[Email Preferences](https://www.finos.org/hs/manage-preferences/unsubscribe-simple) ![](https://px.ads.linkedin.com/collect/?pid=537250&fmt=gif)