List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.
Prevalence in npm community
22 packages
found in
Top 100
114 packages
found in
Top 1k
1440 packages
found in
Top 10k
528.88k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. Some open source projects have a history of security lapses that culminated with a publication of one or more malicious component versions. To ensure that repeated supply chain incidents do not occur, the open source project should be closely monitored for up to two years. All software package versions that are published within two years of the malware incident will convey a warning about the history of security incidents tied to the open source project.
Prevalence in npm community
10 packages
found in
Top 100
14 packages
found in
Top 1k
81 packages
found in
Top 10k
90.8k packages
in community
Next steps
Inspect behaviors exhibited by the detected software components.
If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.
Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.
Avoid using this software package until it is vetted as safe.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.
Prevalence in npm community
21 packages
found in
Top 100
101 packages
found in
Top 1k
1553 packages
found in
Top 10k
711.5k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Unicode is a text encoding standard designed to support the use of text written in all of the major languages and writing systems. While most languages are written from left to right, some are written in alternative directions. To accommodate encoding text written in such languages, the Unicode standard includes a number of special characters that allow the text direction to be specified. However, changing text direction can have adverse effects on how the encoded text is displayed and interpreted. For this reason, bidirectional Unicode control characters are commonly abused by malicious actors as a means of bypassing security solutions and avoiding detection. While presence of special Unicode characters does not imply malicious intent, all of its uses in a software package should be documented and approved. One example of acceptable use for these special characters is in script files that parse, validate, and transform Unicode-encoded text.
Prevalence in npm community
5 packages
found in
Top 100
21 packages
found in
Top 1k
374 packages
found in
Top 10k
113.9k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.