List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Data Execution Prevention (DEP/NX) is a vulnerability mitigation option that prevents data from being interpreted as code anywhere within the application. This mitigation protects the application stack, heap and other memory data ranges. Executable files that fail to implement this mitigation expose the user to increased risks of malicious code injection.
Prevalence in NuGet community
1 packages
found in
Top 100
23 packages
found in
Top 1k
220 packages
found in
Top 10k
6.12k packages
in community
Next steps
It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.
To enable this mitigation, refer to your programming language linker documentation.
In Microsoft VisualStudio, you can enable DEP mitigation by setting the linker option /NXCOMPAT to ON.
Problem
Sensitive executable memory regions should be kept as read-only to protect the integrity of trusted execution code flow paths. Imported function addresses are pointers to the symbols that implement the application-required functionality. If those pointers are changed by malicious code, execution paths can be redirected to unintended locations. Most modern programming language toolchains protect those memory regions appropriately. These issues are commonly reported for outdated linkers and non-compliant executable packing solutions.
Prevalence in NuGet community
0 packages
found in
Top 100
11 packages
found in
Top 1k
127 packages
found in
Top 10k
4.09k packages
in community
Next steps
Review the programming language linker options, and consider a build toolchain update.
Problem
Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.
Prevalence in NuGet community
0 packages
found in
Top 100
12 packages
found in
Top 1k
227 packages
found in
Top 10k
18.48k packages
in community
Next steps
Confirm that the software package references a component or a dependency with a restrictive license.
Consider replacing the software component with an alternative that offers a license compatible with organization policy.
Problem
Security Development Lifecycle (SDL) is a group of enhanced compile-time checks that report common coding mistakes as errors, preventing them from reaching production. These checks minimize the number of security issues by enforcing strict memory access checks. They also prevent the use of hard-to-secure string and memory manipulation functions. To prove the binary has been compiled with these checks enabled, the compiler emits a special debug object. Removing the debug table eliminates this proof. Therefore, this check only applies to binaries that still have their debug tables.
Prevalence in NuGet community
0 packages
found in
Top 100
52 packages
found in
Top 1k
502 packages
found in
Top 10k
17.6k packages
in community
Next steps
You should keep the debug table to prove that the SDL process has been followed.
To enable these checks, refer to your programming language toolchain documentation.
In Microsoft VisualStudio, you can enable this feature by setting the compiler option /SDL to ON.
Problem
Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign, some are commonly abused by malicious software with the intent to cause harm. When a software package shares behavior traits with malicious software, it may become flagged by security solutions. Any detection from security solutions can cause friction for the end-users during software deployment. While the behavior is likely intended by the developer, there is a small chance this detection is true positive, and an early indication of a software supply chain attack.
Prevalence in NuGet community
1 packages
found in
Top 100
28 packages
found in
Top 1k
1004 packages
found in
Top 10k
30.24k packages
in community
Next steps
Investigate reported detections.
If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Obfuscation is a process of mangling the software code legibility. Obfuscation can be applied to both the application source and its compiled code counterpart. In both cases, obfuscation can interfere with the accuracy of security and software quality assessment solutions. For this reason, obfuscation is a technique commonly used by malicious actors as a means of bypassing security solutions and avoiding detection. While presence of obfuscation does not imply malicious intent, all of its uses in a software package should be documented and approved. One example of acceptable use for code obfuscation is minimizing the size of script files that are not intended to be read by humans. In such a case, the trade-off between file size and code legibility is considered acceptable.
Prevalence in NuGet community
0 packages
found in
Top 100
3 packages
found in
Top 1k
453 packages
found in
Top 10k
7.03k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consult Mitre ATT&CK documentation: T1027 - Obfuscated Files or Information.
Consider an alternative to code obfuscation to lower the risk of being mistakenly flagged by security solutions.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.
Prevalence in NuGet community
0 packages
found in
Top 100
113 packages
found in
Top 1k
1738 packages
found in
Top 10k
749k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Open source communities depend on the work of thousands of software developers that volunteer their time to maintain software components. Software developers build up the reputation of their open source projects by developing in public. Modern source code repositories have many social features that allow software developers to handle bug reports, have discussions with their users, and convey reaching significant project milestones. It is uncommon to find open source projects that omit linking their component to a publicly accessible source code repository.
Prevalence in NuGet community
99 packages
found in
Top 100
702 packages
found in
Top 1k
5909 packages
found in
Top 10k
607.09k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Problem
Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Copyleft licenses in particular impose substantial restrictions on the licensee. They typically require that any derived works, and even software code that merely interacts with copyleft code, be licensed under the same license. Since copyleft licenses are commonly applied to open source code, their inclusion requires that the entire software package becomes open sourced. For commercial applications, this is typically undesirable. Therefore, the inclusion of copyleft code is commonly avoided or even prohibited by the organization policy.
Prevalence in NuGet community
0 packages
found in
Top 100
2 packages
found in
Top 1k
62 packages
found in
Top 10k
4.23k packages
in community
Next steps
Confirm that the software component references a copyleft dependency.
Investigate if the software publisher provides this dependency under a non-copyleft license.
Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.
Problem
Address Space Layout Randomization (ASLR) is a vulnerability mitigation option that forces software components to load on a different memory base address each time they are used. This makes the memory layout unpredictable, and it is therefore harder for malicious code to be reliably injected during application runtime. Although enabling ASLR is an opt-in setting during program linking, some operating system configurations can still enforce its use if the vulnerability mitigation requirements are met. This is possible even if the application hasn't been explicitly marked as ASLR-compatible. While this generally improves security posture, the limitation of ASLR enforcement is that the application load addresses are not truly randomized. In most cases, the application load base is different than the default, but it remains the same for the entire duration of device uptime.
Prevalence in NuGet community
1 packages
found in
Top 100
21 packages
found in
Top 1k
193 packages
found in
Top 10k
6.15k packages
in community
Next steps
In Microsoft VisualStudio, you should explicitly enable ASLR mitigation by setting the linker option /DYNAMICBASE to ON.