Spectra Assure

failRisk: Vulnerabilities

Scanned:

Microsoft.WinGet.Client

latest

Top 100

PowerShell Module for the Windows Package Manager Client.

License: unknown

Published:

Visit GitHub

See on PowerShell Gallery

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

2 debugging symbols found

Security

Vulnerabilities

1 severe vulnerabilities exploited

Hardening

6 ineffective mitigations detected

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

INCIDENTS FOR THIS VERSION:

List of software quality issues with the number of affected components.

Policies

Info

Problem

Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.

Prevalence in PowerShell Gallery community

2 packages

found in

Top 100

26 packages

found in

Top 1k

118 packages

found in

Top 10k

193 packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Address Space Layout Randomization (ASLR) is a vulnerability mitigation option that forces software components to load on a different memory base address each time they are used. This mitigation is detected as enabled, but rendered ineffective due to the lack of code relocations necessary for layout randomization. This issue is reported for native 32-bit applications that contain code and opt in to use ASLR. Reasons for relocation absence include forcing software component load on a fixed address, removing relocations post-build, and using non-ASLR-compliant executable packing solutions.

Prevalence in PowerShell Gallery community

1 packages

found in

Top 100

12 packages

found in

Top 1k

42 packages

found in

Top 10k

91 packages

in community

Next steps

Review the programming language linker documentation.

In Microsoft VisualStudio, make sure the linker option /FIXED is disabled (set to OFF).

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in PowerShell Gallery community

2 packages

found in

Top 100

28 packages

found in

Top 1k

125 packages

found in

Top 10k

205 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing services URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverages the GitHub service to deliver malicious payloads.

Prevalence in PowerShell Gallery community

7 packages

found in

Top 100

387 packages

found in

Top 1k

1476 packages

found in

Top 10k

2.58k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Program database (PDB) files are typically only used during software development. They contain private debug symbols that make it significantly easier to reverse engineer a closed-source application. In some cases, having a program database file is equivalent to having access to the source code. Presence of program databases could indicate that one or more software components have been built using a debug profile, instead of the release.

Prevalence in PowerShell Gallery community

3 packages

found in

Top 100

29 packages

found in

Top 1k

130 packages

found in

Top 10k

237 packages

in community

Next steps

Private debug database files should not be embedded within executables, and you should remove them from the software package before releasing it.

The integrity verification of the embedded database files should not be done with insecure hashing algorithms. SHA1 and MD5 hashes should be deprecated throughout the application, and a more secure SHA256 algorithm should be used instead.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in PowerShell Gallery community

2 packages

found in

Top 100

23 packages

found in

Top 1k

84 packages

found in

Top 10k

161 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign, some are commonly abused by malicious software with the intent to cause harm. When a software package shares behavior traits with malicious software, it may become flagged by security solutions. Any detection from security solutions can cause friction for the end-users during software deployment. While the behavior is likely intended by the developer, there is a small chance this detection is true positive, and an early indication of a software supply chain attack.

Prevalence in PowerShell Gallery community

13 packages

found in

Top 100

176 packages

found in

Top 1k

997 packages

found in

Top 10k

1.61k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Operating systems provide multiple integration points for applications to insert themselves in the system startup sequence. Startup sequence is executed in its entirety each time the computer system powers on. For that reason, attackers typically try to register their malicious code in the system startup sequence. When malicious code is registered to start with the operating system, it achieves persistence, as it becomes permanently installed. While the presence of code that modifies the system startup sequence does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only applications that require constant background operation should consider installing themselves as a part of the startup sequence. One exemption to this recommendation would include running the application after the first system reboot to complete the software installation.

Prevalence in PowerShell Gallery community

2 packages

found in

Top 100

8 packages

found in

Top 1k

26 packages

found in

Top 10k

49 packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1547.001 - Registry Run Keys/Startup Folder.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as low severity.

Prevalence in PowerShell Gallery community

1 packages

found in

Top 100

10 packages

found in

Top 1k

32 packages

found in

Top 10k

67 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

Lower severity vulnerabilities can be resolved with less urgency, but you should still make a plan to do so.

Problem

Debug databases are typically only used during software development. On Windows, they are usually files embedded into the executable (PDB), while on Linux, they're contained inside special executable sections. The databases contain private debug symbols that make it significantly easier to reverse-engineer a closed-source application. In some cases, having a debug database is equivalent to having access to the source code. Presence of debug databases could indicate that one or more software components have been built using a debug profile, instead of the release. Private debug databases can be embedded into software components by programming language tools.

Prevalence in PowerShell Gallery community

3 packages

found in

Top 100

38 packages

found in

Top 1k

174 packages

found in

Top 10k

331 packages

in community

Next steps

To remediate this issue and remove private debugging information, refer to your programming language toolchain documentation.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in PowerShell Gallery community

2 packages

found in

Top 100

26 packages

found in

Top 1k

118 packages

found in

Top 10k

193 packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in PowerShell Gallery community

1 packages

found in

Top 100

12 packages

found in

Top 1k

42 packages

found in

Top 10k

91 packages

in community

Next steps

Review the programming language linker documentation.

In Microsoft VisualStudio, make sure the linker option /FIXED is disabled (set to OFF).

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in PowerShell Gallery community

2 packages

found in

Top 100

28 packages

found in

Top 1k

125 packages

found in

Top 10k

205 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in PowerShell Gallery community

7 packages

found in

Top 100

387 packages

found in

Top 1k

1476 packages

found in

Top 10k

2.58k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Prevalence in PowerShell Gallery community

3 packages

found in

Top 100

29 packages

found in

Top 1k

130 packages

found in

Top 10k

237 packages

in community

Next steps

Private debug database files should not be embedded within executables, and you should remove them from the software package before releasing it.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in PowerShell Gallery community

2 packages

found in

Top 100

23 packages

found in

Top 1k

84 packages

found in

Top 10k

161 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in PowerShell Gallery community

13 packages

found in

Top 100

176 packages

found in

Top 1k

997 packages

found in

Top 10k

1.61k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Prevalence in PowerShell Gallery community

2 packages

found in

Top 100

8 packages

found in

Top 1k

26 packages

found in

Top 10k

49 packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1547.001 - Registry Run Keys/Startup Folder.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as low severity.

Prevalence in PowerShell Gallery community

1 packages

found in

Top 100

10 packages

found in

Top 1k

32 packages

found in

Top 10k

67 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

Lower severity vulnerabilities can be resolved with less urgency, but you should still make a plan to do so.

Problem

Prevalence in PowerShell Gallery community

3 packages

found in

Top 100

38 packages

found in

Top 1k

174 packages

found in

Top 10k

331 packages

in community

Next steps

To remediate this issue and remove private debugging information, refer to your programming language toolchain documentation.

Microsoft.WinGet.Client

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: This package had 5 removal incidents in versions published within 2 years prior to the latestLatest version with removal incident detected: 7 months agoVersion: 1.12.350

INCIDENTS FOR THIS VERSION:

SQ31102Detected presence of severe vulnerabilities with active exploitation.Causes risk: actively exploited vulnerabilitiesvulnerabilities

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ14107Detected Windows executable files that try to implement ASLR but do not have relocations to support that vulnerability mitigation protection.Causes risk: ineffective mitigations detectedhardening

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in PowerShell Gallery community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ14160Detected Windows executable files that embed PDB files whose integrity is verified with an insecure hashing algorithm.Causes risk: outdated toolchains detectedhardening

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ31106Detected presence of medium severity vulnerabilities.Causes risk: medium severity vulnerabilitiesvulnerabilities

Problem

Prevalence in PowerShell Gallery community

Next steps

TH15103Detected presence of files with behaviors commonly used by malicious software.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH16118Detected presence of software components that can change the system startup sequence.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ31107Detected presence of low severity vulnerabilities.Causes risk: low severity vulnerabilitiesvulnerabilities

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ34203Detected presence of hardcoded debug databases.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in PowerShell Gallery community

Next steps

Did you know...

SQ31102Detected presence of severe vulnerabilities with active exploitation.Causes risk: actively exploited vulnerabilitiesvulnerabilities

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ14107Detected Windows executable files that try to implement ASLR but do not have relocations to support that vulnerability mitigation protection.Causes risk: ineffective mitigations detectedhardening

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in PowerShell Gallery community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ14160Detected Windows executable files that embed PDB files whose integrity is verified with an insecure hashing algorithm.Causes risk: outdated toolchains detectedhardening

Problem

Prevalence in PowerShell Gallery community

Next steps

SQ31106Detected presence of medium severity vulnerabilities.Causes risk: medium severity vulnerabilitiesvulnerabilities

Problem

Prevalence in PowerShell Gallery community

Next steps

TH15103Detected presence of files with behaviors commonly used by malicious software.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH16118Detected presence of software components that can change the system startup sequence.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps