PRevent: Open-Source Tool to Detect Malicious Code in Pull Requests

Apiiro security researchers have released open-source tools to help organizations detect malicious code during the software development lifecycle. The tools include PRevent, a scanner for pull requests, and a malicious code detection ruleset for Semgrep and Opengrep static code analysis tools.

👇 GitHub Repository 👇

https://lnkd.in/dmVn9ps5

Practice Verified Codes and Commands

1. Install Semgrep:

pip install semgrep

2. Run Semgrep with PRevent Ruleset:

semgrep --config=https://github.com/apiiro/PRevent-ruleset

3. Clone PRevent Repository:

git clone https://github.com/apiiro/PRevent.git
cd PRevent

4. Scan Pull Requests with PRevent:

python3 prevent.py --repo <repository_url> --pr <pull_request_number>

5. Integrate PRevent with CI/CD Pipeline:

Add the following to your `.github/workflows/prevent.yml`:

name: PRevent Scan
on: [pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v2
- name: Run PRevent
run: |
pip install semgrep
semgrep --config=https://github.com/apiiro/PRevent-ruleset

1. Check for Malicious Code in a Specific File:

   semgrep --config=https://github.com/apiiro/PRevent-ruleset /path/to/your/file.py
   

7. View Semgrep Results in JSON Format:

semgrep --config=https://github.com/apiiro/PRevent-ruleset --json /path/to/your/code

8. Update PRevent Ruleset:

semgrep --update

9. Scan a Directory Recursively:

semgrep --config=https://github.com/apiiro/PRevent-ruleset /path/to/your/directory

10. Exclude Specific Files or Directories:

semgrep --config=https://github.com/apiiro/PRevent-ruleset /path/to/your/code --exclude /path/to/exclude

What Undercode Say

The release of PRevent and its integration with Semgrep and Opengrep marks a significant step forward in securing the software development lifecycle. By leveraging these tools, developers can proactively detect and mitigate malicious code in pull requests, reducing the risk of vulnerabilities and breaches.

For Linux users, commands like grep, awk, and `sed` can be combined with these tools to enhance security workflows. For example:

grep -r "malicious_pattern" /path/to/code | awk '{print $1}' | sed 's/://'

Windows users can utilize PowerShell to automate scans:

Invoke-WebRequest -Uri "https://github.com/apiiro/PRevent-ruleset" -OutFile "ruleset.yml"
semgrep --config=ruleset.yml

For further reading on secure coding practices, visit:

• OWASP Secure Coding Practices
• GitHub Security Best Practices

By integrating these tools and commands into your workflow, you can ensure a robust defense against malicious code and maintain the integrity of your software projects.

References:

Hackers Feeds, Undercode AI