On: Ask HN: How do you check for malware in OSS packages?

Maybe some ideas here: httpss://www.owasp.org/index.php/Source_Code_Analysis_Tools

At work we use a commercial tool for static analysis. From what I have seen it is rather stupid, it produces a lot of false positive security issues about things like allocating memory (potential resource exhaustion vulnerability...)

You also probably want to pin versions of all dependencies, and store them in a repository that you control access to (a good idea for reproducibility, ignoring security).

SAST tools take a lot of work to get up and running. If you're just running them out of the box, you're probably doing it wrong.

I've had the same experience with existing SAST tools.