Top issues
Detected presence of software components authored by accounts in regions with EU export restrictions.
hunting
Problem
Export restrictions (or a restriction on exportation) are limitations on the quantity of goods exported to a specific country or countries by a Government. The European Union has imposed export restrictions on a number of countries and regions. These restrictions may or may not apply to digital goods such as software and other related intellectual property. It is advised that the reported findings are put in the usage context so that they can be audited and reviewed by the legal department before the software package is deployed. Current list of countries with export restrictions includes: Belarus (.by), Iran (.ir), Iraq (.iq), Libya (.ly), Myanmar (.mm), North Korea (.nk), Syria (.sy), Venezuela (.ve) and Zimbabwe (.zw).Prevalence in npm community
0 packages
found in
Top 100
2 packages
found in
Top 1k
34 packages
found in
Top 10k
2.72k packages
in community
Next steps
Investigate reported detections.
You should delay the software release until the legal review is completed.
Problem
Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign, some are commonly abused by malicious software with the intent to cause harm. When a software package shares behavior traits with malicious software, it may become flagged by security solutions. Any detection from security solutions can cause friction for the end-users during software deployment. While the behavior is likely intended by the developer, there is a small chance this detection is true positive, and an early indication of a software supply chain attack.Prevalence in npm community
9 packages
found in
Top 100
29 packages
found in
Top 1k
255 packages
found in
Top 10k
95.32k packages
in community
Next steps
Investigate reported detections.
If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider rewriting the flagged code without using the marked behaviors.
Top behaviors
Executes files during installation or upon launch.
execution
Prevalence in npm community
Behavior often found in this community (Common)
95 packages
found in
Top 100
726 packages
found in
Top 1k
7488 packages
found in
Top 10k
4.56M packages
in community
The software package was developed by a user registered with an email address from a region sanctioned by the European Union.
anomaly
Prevalence in npm community
Behavior commonly used by malicious software (Important)
Behavior uncommon for this community (Uncommon)
0 packages
found in
Top 100
2 packages
found in
Top 1k
34 packages
found in
Top 10k
2.72k packages
in community
Converts binary data to its string representation, commonly used in obfuscation.
packer
Prevalence in npm community
Behavior often found in this community (Common)
40 packages
found in
Top 100
305 packages
found in
Top 1k
3796 packages
found in
Top 10k
1.13M packages
in community
Writes to files.
file
Prevalence in npm community
Behavior often found in this community (Common)
29 packages
found in
Top 100
113 packages
found in
Top 1k
1621 packages
found in
Top 10k
581.73k packages
in community
Reads from files.
file
Prevalence in npm community
Behavior often found in this community (Common)
37 packages
found in
Top 100
186 packages
found in
Top 1k
2304 packages
found in
Top 10k
715.47k packages
in community
Top vulnerabilities
No vulnerabilities found.