List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. System security settings are the first line of defense against the most common attack vectors. For that reason, attackers often aim to tamper with system security settings. Disabling User Access Controls (UAC) and other security settings enables malicious code to execute without being blocked. While the presence of code that tampers with system security settings does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with system security settings. One example of acceptable use for such functions is allowing specialized applications to install as services that monitor the operating system events.
Prevalence in PowerShell Gallery community
6 packages
found in
Top 100
84 packages
found in
Top 1k
753 packages
found in
Top 10k
1.56k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consult Mitre ATT&CK documentation: T1562.001 - Disable or Modify Tools.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Software components sometimes need to interact with sensitive parts of the runtime environment, often requiring privileged access to accomplish a task. Build pipeline configuration includes high-value information such as CI/CD platform secrets and tokens, pipeline definition files and runner configuration, build-time environment variables containing signing keys or deploy credentials, and artifact registry and package publishing credentials. That information is used by continuous integration and delivery systems. Attackers often abuse access to build pipeline configuration to harvest secrets from build environments, which can later be exfiltrated to attacker-controlled infrastructure and used to tamper with software releases or publish malicious artifacts under trusted identities. While the presence of code that accesses build pipeline configuration does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select software components should consider using functions that read build pipeline configuration. One example of acceptable use for such functions is release tooling that reads publishing credentials to push artifacts.
Prevalence in PowerShell Gallery community
0 packages
found in
Top 100
5 packages
found in
Top 1k
41 packages
found in
Top 10k
79 packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.
Prevalence in PowerShell Gallery community
7 packages
found in
Top 100
394 packages
found in
Top 1k
1525 packages
found in
Top 10k
2.97k packages
in community
Next steps
Investigate reported detections.
If the software should not include these network references, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider an alternative delivery mechanism for software packages.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.
Prevalence in PowerShell Gallery community
1 packages
found in
Top 100
3 packages
found in
Top 1k
5951 packages
found in
Top 10k
15.55k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.
Prevalence in PowerShell Gallery community
8 packages
found in
Top 100
474 packages
found in
Top 1k
7926 packages
found in
Top 10k
18.04k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Problem
Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. A port number is associated with a network address of a host, such as an IP address, and the type of network protocol used for communication. Within URLs, the ports are optional. Ports can be specified in a URL immediately following the domain name. Each network protocol, or schema, has a set of standard ports on which the service operates. This issue is raised when a mismatch between a network protocol and its expected port number is detected. While the presence of non-standard ports does not imply malicious intent, all of their uses in a software package should be documented and approved.
Prevalence in PowerShell Gallery community
12 packages
found in
Top 100
105 packages
found in
Top 1k
405 packages
found in
Top 10k
770 packages
in community
Next steps
Investigate reported detections.
If the software should not include these network references, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider changing the port to one that is standard for the networking protocol.
Problem
Operating systems allow multiple user accounts to coexist on a single computer system. Each registered user has identity information associated with their account. At the very least, user accounts consist of a user name and an optional password. In some cases, user account data may also include personally identifiable information. Extended personal information may include user's given and last name, their email and mailing address, personal photo and their telephone number. Financially motivated attackers may seek to collect personal information for purposes of selling the private data to a third-party. Malicious code that typically exhibits these behavior traits is commonly referred to as an information stealer. While the presence of code that accesses identity information does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Accessing identity information is a very common behavior for software packages. One example of acceptable use for such functions is verifying that the active user has purchased a software license that allows them to run the application.
Prevalence in PowerShell Gallery community
9 packages
found in
Top 100
176 packages
found in
Top 1k
972 packages
found in
Top 10k
1.9k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.