Module 7 of 17

Managed Code, Packages, Containers, and WASM

Triage modern software artifacts and supply-chain evidence without installing or running untrusted content.

6 hours1 exercisesFree

Start here

Learning objectives

  • Identify which runtime, package manager, image format, or execution environment owns an artifact before choosing an analysis method.
  • Inspect manifests, lockfiles, signatures, SBOMs, provenance, container layers, and WebAssembly imports as offline evidence.
  • Recognize evidence associated with trojans, loaders, web shells, cryptominers, malicious packages, and compromised CI without recreating their behavior.
  • Recommend developer controls that reduce supply-chain exposure and make later investigations faster.
Managed Code, Packages, Containers, and WASM defensive workflow A four-step flow from Inventory artifact through Harden pipeline. The diagram describes defensive analysis only. Managed Code, Packages, Containers, and WASM Observe evidence, test a hypothesis, choose a control, and record uncertainty. Inventory artifact step 1 Inspect metadata step 2 Test hypotheses step 3 Harden pipeline step 4 Course rule: no live malware, weaponized payloads, stealth, persistence, credential access, or public callbacks.

Start With the Runtime, Not the Filename

Modern malware is not limited to a native executable. A suspicious delivery may be a managed assembly, a shell or browser script, a package release, a container image, a server-side extension, a mobile bundle, or a WebAssembly module. The first defensive question is therefore not “Which family is this?” It is “What would interpret this artifact, and which capabilities would that environment grant?”

File extensions are hints, not proof. Record the detected format, runtime metadata, expected entry point, declared permissions, dependencies, publisher information, and the environment in which the artifact was found. Keep observations separate from conclusions. A compressed or minified script may be normal; a signed package may still be compromised; and an unfamiliar WebAssembly import is not automatically malicious.

A Cross-Runtime Evidence Map

ArtifactUseful offline evidenceQuestions for the defender
Managed codeAssembly identity, runtime target, imports, resources, signing metadata, and configurationDoes the capability set match the stated purpose and trusted build?
Scripts and server extensionsInterpreter, imports, encoded content, template boundaries, deployment path, and change historyWas this file expected, reviewed, and produced by the approved release process?
PackagesManifest, lockfile, lifecycle declarations, dependency graph, publisher, integrity fields, SBOM, and registry provenanceDid the name, version, maintainer, source, or dependency graph change unexpectedly?
Container imagesManifest, digest, layer history, base image, user, entry point, exposed configuration, signatures, and attestationsCan the deployed digest be traced to a reviewed source revision and isolated build?
WebAssemblyModule sections, imports, exports, embedded names, host bindings, and expected digestWhich host capabilities can the module reach, and are those capabilities necessary?
Browser and mobile bundlesPermissions, update source, extension points, network destinations, signing identity, and store metadataAre requested permissions proportional to the feature and consistent with the prior release?

The strongest finding usually comes from a mismatch: a small formatting package declares an unexpected execution hook, an application image changes its base and user, or a browser extension requests a new high-impact permission. A mismatch deserves investigation, but it still needs provenance and behavioral evidence before it becomes a malware verdict.

Triage the Supply Chain Before Execution

Package and CI investigations begin with comparison. Compare the release manifest with the lockfile, the lockfile with the SBOM, the published digest with the deployed digest, and the provenance statement with the expected repository, builder, and source revision. Do this offline. Do not install the package, invoke a lifecycle hook, start the image, or run an unfamiliar build script merely to see what happens.

Look for unexplained maintainer changes, dependency confusion, a near-match package name, a source archive that does not reproduce the published artifact, mutable tags, unexpected files in a release, or a build that cannot be linked to its source. CI evidence also includes workflow changes, runner identity, secret access records, artifact upload records, signing events, and approval history. The course uses synthetic records only; learners never receive registry credentials, real CI tokens, or a functional malicious package.

Recognize Families Without Recreating Them

  • Trojans and loaders: investigate a gap between the advertised purpose and declared capabilities, unexpected secondary content, or a release that no longer matches trusted provenance. Analysis stops at describing the evidence. The course does not build a loader or execute a second stage.
  • Web shells: look for an unapproved server-side file, an unusual deployment path, unexplained interpreter activity in sanitized logs, and a change outside the release pipeline. Do not create a command-capable page.
  • Cryptominers: correlate an unexplained executable or container layer with sustained resource use and synthetic pool-like network evidence. High CPU by itself is not enough.
  • Browser and mobile threats: compare permission changes, signing identity, update origin, local storage access, and sanitized network metadata. Never inspect a learner's real browser profile or device backup.
  • Cloud and container threats: relate image provenance, workload identity, deployment audit records, runtime policy, and unexpected egress. Do not assume an image is safe because it came from an internal registry.

These labels overlap. A trojanized package could introduce a miner, a web shell could act as a backdoor, and a container could be only the delivery vehicle. Report the observable behavior and confidence before applying a family label.

Controls Developers Can Own

Preventive controls should make the trusted path narrow and the evidence path rich. Pin dependencies by immutable identifier, verify integrity, separate build and release authority, use isolated short-lived builders, protect signing operations, generate and retain provenance, scan the resolved artifact rather than only its source, and keep an inventory of deployed digests. Limit package lifecycle execution and container privileges to what the product actually needs.

A mature response is not “ban every script.” It is to define which scripts are allowed, who can change them, where they may run, what they may access, and which logs prove that policy was followed. That turns supply-chain security from a one-time scanner result into an engineering system.

Suggested Study Plan (6 hours)

The published duration includes active practice, not video playback alone. Complete each block with the course-owned evidence and retain the stated deliverable so another reviewer can reproduce your reasoning.

Study blockTimeRequired evidence
Guided lesson and primary-source review1h 26mAnnotated notes that separate observations, hypotheses, limits, and version-sensitive facts.
Worked evidence walkthroughs1h 11mReproduce the lesson's tables or decision flow and challenge at least two assumptions.
Independent practice rounds1h 11mApply the method to two alternate records in the sanitized evidence pack and compare the conclusions.
Required lab1h 15mA release-triage worksheet containing an artifact inventory, five evidence-backed observations, alternative explanations, a disposition, and a developer-control plan.
Knowledge check and review57 minutesAnswer the evidence check, review the rubric, and record one production follow-up.

Evidence Check

Question: A package has a familiar name and a valid registry checksum, but its publisher and lifecycle declarations changed. Is the checksum enough to approve it?

Reveal the defensive reasoning

No. The checksum proves that the downloaded bytes match the registry record; it does not prove that the publisher, source, or behavior is trusted. Quarantine the artifact, compare provenance and ownership history, review the declared capability change, and use approved offline evidence. Do not install it to answer the question.

Primary References

Use these primary sources for the current standard or tool behavior. The course records framework versions so mappings can be reviewed when upstream guidance changes.

Real world

Where this shows up

  • Reviewing a dependency or maintainer change before an emergency upgrade
  • Investigating why a deployed image digest differs from the approved release
  • Determining whether an unexpected server-side file came from the deployment pipeline
  • Explaining a browser, mobile, or WebAssembly permission change during security review

Production notes

Keep these close

  • Retain immutable manifests, SBOMs, signatures, provenance, and deployment digests for the same period as incident evidence.
  • Scan and attest the exact artifact that will be deployed, not only its source repository.
  • Treat CI identities, signing services, registries, and update channels as production security boundaries.
  • Build an emergency dependency process that preserves review and evidence instead of bypassing both.

Common mistakes

What usually breaks

  • Installing a suspicious package to learn what it does
  • Treating signing, a checksum, or an internal registry as a complete trust decision
  • Scanning source while deploying an unverified binary or image built elsewhere
  • Calling minification, compression, or an unfamiliar permission malicious without supporting context

Security risks

Threats to watch

  • Lifecycle hooks and build plugins can execute before an analyst expects application code to run.
  • CI and release systems may hold authority that reaches many downstream users.
  • Mutable image tags and unpinned dependencies can silently change the reviewed artifact.
  • Real package or CI evidence may contain secrets and must not be uploaded to public analysis services.

Tradeoffs

Design choices you should be able to defend

Block every new dependency or runtime capability by default

Pros

  • Creates a narrow trust boundary
  • Forces explicit review of capability changes

Cons

  • Can slow urgent maintenance
  • Needs a staffed and auditable exception path

Allow approved sources with continuous verification

Pros

  • Supports normal delivery speed
  • Uses provenance and policy at several stages

Cons

  • Source approval can become stale
  • Requires reliable inventory, logging, and policy maintenance

Think like an engineer

Questions to answer before shipping

  • Can a deployed byte be traced back to a reviewed source revision and an approved builder?
  • Which capability would remain dangerous even if the artifact had a valid signature?
  • What evidence would let an incident responder reconstruct the dependency and deployment path six months later?

Key terms

Vocabulary used in this module

Managed code

Code executed under a runtime that provides services such as loading, metadata, memory management, or verification.

SBOM

A software bill of materials that inventories components and relationships in a software artifact.

Provenance

Verifiable information about where, when, and how an artifact was produced.

Image digest

A content-derived identifier for a container image or manifest.

Host binding

A capability that a host environment exposes to a WebAssembly module.

Exercises

Practice inside the lesson

75 minutesIntermediate

Investigate a Synthetic Package and Container Release

Use an instructor-authored offline evidence bundle to decide whether a fictional developer-tool release should be trusted, quarantined, or rejected.

  1. Read the fixture manifest and confirm that the bundle contains metadata, text reports, and inert files only. Do not install, build, import, or start anything.
  2. Inventory the package manifest, lockfile, SBOM, image manifest, layer report, provenance statement, and fictional CI audit events.
  3. Compare package name, publisher, dependencies, lifecycle declarations, image digest, base image, workload user, builder identity, and source revision against the supplied approved baseline.
  4. Record each mismatch as an observation. Add at least two possible explanations and identify the evidence that would distinguish them.
  5. Choose a disposition for the release and propose controls for dependency intake, CI identity, signing, provenance retention, and deployment by digest.

Expected evidence

A release-triage worksheet containing an artifact inventory, five evidence-backed observations, alternative explanations, a disposition, and a developer-control plan.

Assessment criteria

  • The inventory clearly separates observed metadata from inferred intent.
  • The learner does not install, build, import, or execute the supplied package or image fixture.
  • The trust decision uses provenance, integrity, identity, and capability evidence rather than a single scanner label.
  • Recommended controls have an owner and a point in the build or release lifecycle.

Teardown

  1. Delete temporary working copies.
  2. Retain only the written defensive analysis.

Recap

Key takeaways

  • Choose the analysis method from the real runtime and host capability, not the filename.
  • A valid checksum proves integrity against one record; it does not establish trustworthy provenance or safe behavior.
  • Package, CI, container, browser, mobile, and WebAssembly evidence can be triaged offline before any execution decision.
  • Describe evidence and capability mismatches before applying a malware-family label.

Related resources

Keep learning across CodersSecret