GitHub launches code scanning tool for JavaScript and TypeScript projects
The experimental, machine learning-powered feature aims to identify security vulnerabilities using open source expertise
GitHub has released a new scanning tool for its platform that allows users to check their repositories for the most common threats targeting their codebase’s chosen development language.
Launched on Thursday as a free public beta for all users, the feature uses machine learning and deep learning to scan codebases and identify common security vulnerabilities before a product is shipped.
The experimental feature is currently available to all users on the platform, including GitHub Enterprise users as a GitHub Advanced Security feature, and can be used for projects written in JavaScript or TypeScript.
The tool is designed to scan for the four most common vulnerabilities affecting projects written in these two languages: cross-site scripting (XSS), path injection, NoSQL injection, and SQL injection.
Such attacks can result in attackers running malicious code on victims’ machines, or taking over entire databases, leading to compromised or stolen sensitive data.
“Together, these four vulnerability types account for many of the recent vulnerabilities in the JavaScript/TypeScript ecosystem, and improving code scanning’s ability to detect such vulnerabilities early in the development process is key in helping developers write more secure code,” said Tiferet Gazit, senior machine learning engineer, and Alona Hlobina, product manager, both at GitHub, in a blog post.
Developers can scan their code using the platform’s machine learning-powered CodeQL engine, querying their code as if it were data.
RELATED RESOURCE
The best defence against ransomware
How ransomware is evolving and how to defend against it
Open source queries are written by experts in the GitHub community and these are designed to recognise as many variants of a vulnerability type as possible in a single query.
Users can search for the best queries relating to the vulnerabilities they're trying to identify and run them against their own codebase for efficient security analysis.
“With the rapid evolution of the open source ecosystem, there is an ever-growing long tail of libraries that are less commonly used,” said Gazit and Hlobina. "We use examples surfaced by the manually-crafted CodeQL queries to train deep learning models to recognise such open source libraries, as well as in-house developed closed-source libraries.”
Due to the open source nature of the queries, they can be constantly updated with further refinements to catch more vulnerability variants with a single query, and recognise emerging libraries and frameworks.
Identifying emerging libraries is especially important, GitHub said, because it helps identify flows of untrusted user data, which are often the root cause of security issues.
GitHub said as the experimental feature is still in beta, users can expect a higher false-positive rate of detections compared to a standard CodeQL analysis, but this will improve over time.
-
LiteLLM PyPI compromise: Everything we know so farNews The TeamPCP hacking group is believed to have successfully backdoored the package to harvest credentials
-
The UK’s AI ambitions depend on channel partnersIndustry Insights Strong AI rollout hinges on channel partners driving successful adoption
-
Ubuntu vulnerability exposes enterprises to root escalation, complete system compromiseNews The high-severity Ubuntu vulnerability allows an unprivileged local attacker to escalate privileges through the interaction of two standard system components
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
An AWS CodeBuild vulnerability could’ve caused supply chain chaos – luckily a fix was applied before disaster struckNews A single misconfiguration could have allowed attackers to inject malicious code to launch a platform-wide compromise
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
