From 100k to 1M lookups per month for just $99/year.

New Community+ plan

Spectra Assure

Community

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

PS Gallery

Search by package name, PURL or hash

warningRisk: Tampering

Scanned:

Microsoft.AzStack.CSSTools.AppService

latest

Top 10k

The Microsoft.AzStack.CSSTools.AppService module is designed to help Azure Stack Hub engineers work more efficiently on App Services deployed on Azure Stack Hub. Core CSS diagnostic scripts and infrastructure helper functions are packaged in this module.

License: unknown

Published:

See on PowerShell Gallery

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

1 components with malware history

Malware

No evidence of malware inclusion

INCIDENTS FOR THIS VERSION:

Overview issues8 vulnerabilities0 malware0 behaviors37 dependencies0 contributors5 versions8

FAQ for Microsoft.AzStack.CSSTools.AppService

What is Microsoft.AzStack.CSSTools.AppService?

Is Microsoft.AzStack.CSSTools.AppService malicious or is it safe to use?

The PS Gallery package Microsoft.AzStack.CSSTools.AppService was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. Malware or tampering has been detected, making it unsafe to download and use. The package contains risks, and the analysis results should be reviewed before it is downloaded and used. Visit the Issues and Behaviors sections of the analysis for more details. There have been 2 compromised malicious versions of Microsoft.AzStack.CSSTools.AppService. The most recent was 1.2510.15.1340 1 year ago.

Does Microsoft.AzStack.CSSTools.AppService have known vulnerabilities?

No vulnerabilities have been detected for this version of Microsoft.AzStack.CSSTools.AppService.

Is Microsoft.AzStack.CSSTools.AppService popular?

The PS Gallery package Microsoft.AzStack.CSSTools.AppService ranks among the top 10000 projects in this community. It has 497 recorded downloads. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

Read our best practices for protecting your software supply chain guide.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

Microsoft.AzStack.CSSTools.AppService@1.2609.4.1347 - PowerShell Gallery: Malware Incident & Safety Report | ReversingLabs Spectra Assure Community

Popularity

497

Total Downloads

Contributors

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. Some open source projects have a history of security lapses that culminated with a publication of one or more malicious component versions. To ensure that repeated supply chain incidents do not occur, the open source project should be closely monitored for up to two years. All software package versions that are published within two years of the malware incident will convey a warning about the history of security incidents tied to the open source project.

Prevalence in PowerShell Gallery community

2 packages

found in

Top 100

6 packages

found in

Top 1k

32 packages

found in

Top 10k

60 packages

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign on their own, some might become important for analysis when observed alongside other capabilities the component exhibits. This issue is reported for files that can enumerate user information and make HTTP requests. While presence of this behavior combination does not imply malicious intent, it is advised that the reported files are reviewed. One example of acceptable use for this type of data collection is the opt-in telemetry for software debugging purposes.

Prevalence in PowerShell Gallery community

0 packages

found in

Top 100

24 packages

found in

Top 1k

167 packages

found in

Top 10k

288 packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

Consider limiting the collection of user information to a minimum.

Problem

Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. Operating systems include a complete network stack with many services that allow the machine to connect to the internet. Some of these services are used to secure network access. For that reason, attackers often aim to tamper with system network settings. Disabling firewalls and other network security features enable the malicious code to execute without being blocked. While the presence of code that tampers with system network settings does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with system network settings. One example of acceptable use for such functions is allowing specialized applications to use non-standard network ports by updating the firewall allowlist.

Prevalence in PowerShell Gallery community

4 packages

found in

Top 100

100 packages

found in

Top 1k

818 packages

found in

Top 10k

1.46k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1562.004 - Disable or Modify System Firewall.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PowerShell Gallery community

8 packages

found in

Top 100

474 packages

found in

Top 1k

7926 packages

found in

Top 10k

18.04k packages

in community

Next steps

Top 1k

192 packages

found in

Top 10k

330 packages

in community

Top vulnerabilities

No vulnerabilities found.

Microsoft.AzStack.CSSTools.AppService

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: This package had 2 malicious incidents in versions published within 2 years prior to the latestLatest version with malware incident detected: about 1 year agoVersion: 1.2510.15.1340

INCIDENTS FOR THIS VERSION:

FAQ for Microsoft.AzStack.CSSTools.AppService

What is Microsoft.AzStack.CSSTools.AppService?

Is Microsoft.AzStack.CSSTools.AppService malicious or is it safe to use?

Does Microsoft.AzStack.CSSTools.AppService have known vulnerabilities?

Is Microsoft.AzStack.CSSTools.AppService popular?

Did you know...

Popularity

Top issues

TH30101Detected presence of software components that had a recent malware or tampering incident.Causes risk: components with malware historyhunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH30106Detected presence of software components that have low popularity or number of downloads.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH16106Detected presence of files that collect and exfiltrate user information.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH16113Detected presence of software components that can tamper with the system network settings.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH30107Detected presence of software components that are rarely included by other public software packages.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

Top behaviors

Tampers with storage subsystem.settings

Prevalence in PowerShell Gallery community

Tampers with network adapter settings.settings

Prevalence in PowerShell Gallery community

Loads additional snap-ins or modules to the current session.payload

Prevalence in PowerShell Gallery community

Transfers files using Background Intelligent Transfer Service (BITS).network

Prevalence in PowerShell Gallery community

Tampers with temporary or persistent mapped network drives.network

Prevalence in PowerShell Gallery community

Top vulnerabilities