thumbnail Google Online Security Blog: The Package Analysis Project: Scalable detection of malicious open source packages