List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.
Prevalence in npm community
31 packages
found in
Top 100
147 packages
found in
Top 1k
1855 packages
found in
Top 10k
781.4k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Crypto tokens are versatile digital assets used within the blockchain ecosystem. Crypto tokens are used to represent a wide range of values, rights, or utilities. They play a crucial role in decentralized finance (DeFi), governance, and other blockchain-based applications. Most crypto tokens are built on existing blockchains using smart contracts. A smart contract is a self-executing contract with the terms of the agreement directly written as lines of code. These contracts automatically execute and enforce themselves when predetermined conditions are met, without the need for intermediaries. For this reason, attackers often aim to steal crypto tokens from the machines they infect. Once stolen, crypto tokens are difficult to trace or recover due to the decentralized and pseudonymous nature of blockchain technology. The irreversibility of blockchain transactions means that once the tokens are transferred to the another crypto wallet, they are effectively gone, making them an attractive target for financially motivated actors. While presence of regex code that detects crypto tokens does not imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider working with crypto tokens.
Prevalence in npm community
0 packages
found in
Top 100
0 packages
found in
Top 1k
14 packages
found in
Top 10k
12.19k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. A port number is associated with a network address of a host, such as an IP address, and the type of network protocol used for communication. Within URLs, the ports are optional. Ports can be specified in a URL immediately following the domain name. Each network protocol, or schema, has a set of standard ports on which the service operates. This issue is raised when a mismatch between a network protocol and its expected port number is detected. While the presence of non-standard ports does not imply malicious intent, all of their uses in a software package should be documented and approved.
Prevalence in npm community
4 packages
found in
Top 100
31 packages
found in
Top 1k
597 packages
found in
Top 10k
280.99k packages
in community
Next steps
Investigate reported detections.
If the software should not include these network references, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider changing the port to one that is standard for the networking protocol.
Problem
Service access tokens are considered sensitive information that should not be included in released software packages. However, developers frequently release sensitive information alongside their applications to facilitate automated software testing. Testing tokens and keys often proliferate through the software supply chain. Any publicly documented testing keys or service access tokens can safely be ignored. List of such commonly distributed sensitive information is automatically updated and requires no additional user actions.
Prevalence in npm community
0 packages
found in
Top 100
1 packages
found in
Top 1k
21 packages
found in
Top 10k
6.32k packages
in community
Next steps
Review the commonly shared sensitive information for evidence of inadvertently exposed secrets.
If the tokens were published unintentionally and the software has been made public, you should revoke the tokens and file a security incident.
Problem
Unicode is a text encoding standard designed to support the use of text written in all of the major languages and writing systems. While most languages are written from left to right, some are written in alternative directions. To accommodate encoding text written in such languages, the Unicode standard includes a number of special characters that allow the text direction to be specified. However, changing text direction can have adverse effects on how the encoded text is displayed and interpreted. For this reason, bidirectional Unicode control characters are commonly abused by malicious actors as a means of bypassing security solutions and avoiding detection. While presence of special Unicode characters does not imply malicious intent, all of its uses in a software package should be documented and approved. One example of acceptable use for these special characters is in script files that parse, validate, and transform Unicode-encoded text.
Prevalence in npm community
6 packages
found in
Top 100
27 packages
found in
Top 1k
392 packages
found in
Top 10k
140.96k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.