warningRisk: Secrets

Scanned:

Stimulsoft.Reports.Engine.NetCore

latest

The native .NET Core cross platform report engine is the main executable component of the reporting tool for .NET Core and .NET frameworks, its basis.

License: unknown

Published:

See on NuGet

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

3 web service credentials found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

INCIDENTS FOR THIS VERSION:

Overview issues8 vulnerabilities0 malware0 behaviors89 dependencies69 contributors1 versions140

FAQ for Stimulsoft.Reports.Engine.NetCore

What is Stimulsoft.Reports.Engine.NetCore?

The native .NET Core cross platform report engine is the main executable component of the reporting tool for .NET Core and .NET frameworks, its basis. For more information about this package, visit its homepage.

Is Stimulsoft.Reports.Engine.NetCore malicious or is it safe to use?

The .NET package Stimulsoft.Reports.Engine.NetCore was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. The package contains risks, and the analysis results should be reviewed before it is downloaded and used. Visit the Issues and Behaviors sections of the analysis for more details.

Is Stimulsoft.Reports.Engine.NetCore popular?

The .NET package Stimulsoft.Reports.Engine.NetCore ranks among the top 10000 projects in this community. It has 5M recorded downloads. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

How do I secure Stimulsoft.Reports.Engine.NetCore once it is in my app?

Since we can't know when or where malicious attacks will happen, we recommend tracking how Stimulsoft.Reports.Engine.NetCore behaviors change over multiple software releases. By adopting differential analysis in your release process, you can detect unexpected changes to a Stimulsoft.Reports.Engine.NetCore version, which can prevent advanced software supply chain attacks. Read how our technology can help prevent future attacks similar to SolarWinds and 3CX.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

Popularity

4.55M

Total Downloads

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.

Prevalence in NuGet community

22 packages

found in

Top 100

461 packages

found in

Top 1k

3748 packages

found in

Top 10k

62.8k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Various network communication protocols allow including plaintext authentication credentials. Information such as user names and passwords could be passed through a non-encrypted channel, and therefore intercepted by malicious actors. Credentials are considered secrets, and should be kept encrypted until they are used. This policy control matches the following URI pattern protocol://username:password@domain within any software package component.

Prevalence in NuGet community

0 packages

found in

Top 100

2 packages

found in

Top 1k

67 packages

found in

Top 10k

578 packages

in community

Next steps

Review the reported matches. If the warning refers to a placeholder credential value, it can be safely ignored.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign, some are commonly abused by malicious software with the intent to cause harm. When a software package shares behavior traits with malicious software, it may become flagged by security solutions. Any detection from security solutions can cause friction for the end-users during software deployment. While the behavior is likely intended by the developer, there is a small chance this detection is true positive, and an early indication of a software supply chain attack.

Prevalence in NuGet community

0 packages

found in

Top 100

27 packages

found in

Top 1k

936 packages

found in

Top 10k

22.91k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Each security solution has a unique footprint that consists of installed files and changes to system configuration. Malicious code often tries to detect security solutions by accessing registry keys and folder locations associated with the software installation. Detecting which security solution is installed plays a key role in selecting the optimal malware infection strategy. When a computer system is protected by a security solution, malware may decide to behave differently. Malware may choose to delay its execution, change infection stages, or even avoid running altogether. While the presence of code that detects security solutions does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that check for presence of installed security software. One example of acceptable use for such functions is informing the user about possible compatibility issues with the detected security software.

Prevalence in NuGet community

0 packages

found in

Top 100

4 packages

found in

Top 1k

88 packages

found in

Top 10k

1.59k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1518.001 - Security Software Discovery.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. URL paths provide additional information to a web service when making a request. They are an optional, but an important part of the URL, as they may define specific content or actions based on the data being passed. Some parameters they pass might be considered sensitive information. Since path components are not encrypted this might cause sensitive information to leak. This issue is raised for URL paths than might contain information that attackers can easily intercept. Examples of sensitive information fields include passwords and other similar parameters.

Prevalence in NuGet community

0 packages

found in

Top 100

10 packages

found in

Top 1k

208 packages

found in

Top 10k

3.99k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider removing all references to flagged network locations.

Top behaviors

See all behaviors

Prevalence in NuGet community

Behavior uncommon for this community (Uncommon)

0 packages

found in

Top 100

1 packages

found in

Top 1k

57 packages

found in

Top 10k

571 packages

in community

Prevalence in NuGet community

Behavior often found in this community (Common)

3 packages

found in

Top 100

84 packages

found in

Top 1k

846 packages

found in

Top 10k

23.97k packages

in community

Prevalence in NuGet community

Behavior commonly used by malicious software (Important)

Behavior uncommon for this community (Uncommon)

0 packages

found in

Top 100

2 packages

found in

Top 1k

57 packages

found in

Top 10k

996 packages

in community

Prevalence in NuGet community

Behavior often found in this community (Common)

0 packages

found in

Top 100

16 packages

found in

Top 1k

280 packages

found in

Top 10k

6.94k packages

in community

Prevalence in NuGet community

Behavior often found in this community (Common)

9 packages

found in

Top 100

196 packages

found in

Top 1k

1948 packages

found in

Top 10k

71.76k packages

in community

Top vulnerabilities

No vulnerabilities found.

Stimulsoft.Reports.Engine.NetCore

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: This package had 1 removal incident in versions published within 2 years prior to the latestLatest version with removal incident detected: 3 months agoVersion: 2026.1.5

INCIDENTS FOR THIS VERSION:

FAQ for Stimulsoft.Reports.Engine.NetCore

What is Stimulsoft.Reports.Engine.NetCore?

Is Stimulsoft.Reports.Engine.NetCore malicious or is it safe to use?

Is Stimulsoft.Reports.Engine.NetCore popular?

How do I secure Stimulsoft.Reports.Engine.NetCore once it is in my app?

Did you know...

Popularity

Top issues

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in NuGet community

Next steps

SQ34302Detected presence of plaintext credentials within network protocol strings.Causes risk: web service credentials foundsecrets

Problem

Prevalence in NuGet community

Next steps

TH15103Detected presence of files with behaviors commonly used by malicious software.hunting

Problem

Prevalence in NuGet community

Next steps

TH16117Detected presence of software components that can detect installed security software.hunting

Problem

Prevalence in NuGet community

Next steps

TH17119Detected presence of files containing URLs with suspicious path components.hunting

Problem

Prevalence in NuGet community

Next steps

Top behaviors

Accesses system passwords.steal

Prevalence in NuGet community

Retrieves the name of the user associated with the process.search

Prevalence in NuGet community

Detects VMWare related virtualized environments.evasion

Prevalence in NuGet community

Might contain potentially obfuscated code or data.anomaly

Prevalence in NuGet community

Encodes data using the Base64 algorithm.packer

Prevalence in NuGet community

Top vulnerabilities