Not In My Git Yard: Catching Backdoors at Commit and Release Time
Summary
Not In My Git Yard introduces Lily, an automated backdoor detection system for open-source development and release workflows. It integrates into CI pipelines to block malicious commits and into release vetting to prevent tampered releases or compromised dependencies, using code-change analysis and fuzzing to pinpoint backdoor triggers and reduce false positives. The authors evaluate detection accuracy across numerous benign and backdoored commits and discuss potential evasion tactics and defenses.