Spectra Assure

failIncident: Malware

Scanned:

api-request-helpers

Artifact:

latest

malicious

HTTP request helpers

License: Permissive (MIT)

New!

Published:

Visit GitHub

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

1 web service credentials found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

1 dangerous install procedures

Malware

1 malicious components found

INCIDENTS FOR THIS VERSION:

malware

Reported By: ReversingLabs (Automated)

Learn more about malware detection

List of software quality issues with the number of affected components.

Policies

Info

Problem

Proprietary ReversingLabs malware detection algorithms have determined that the software package contains one or more malicious files. The detection was made by a machine learning model. This malware detection method is considered proactive, and can typically identify the malware threat type. The detection is strongly influenced by behaviors that software components exhibit. Behaviors similar to previously discovered malware and software supply chain attacks may cause some otherwise benign components to be detected as malicious.

Prevalence in PyPI community

0 packages

found in

Top 100

2 packages

found in

Top 1k

10 packages

found in

Top 10k

328 packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Avoid using this software package until it is vetted as safe.

Consider rewriting code that may have triggered the detection due to its malware similarity.

Problem

Software as a Service (SaaS) platforms expose programmable interfaces to their authenticated users. These web services enable action automation and secure exchange of information. For authorization, web service users provide a unique token that confirms their access rights. These tokens are considered secrets. They should never be included in a software release package, even if they are obfuscated by encryption on the client-side.

Prevalence in PyPI community

4 packages

found in

Top 100

14 packages

found in

Top 1k

81 packages

found in

Top 10k

2.82k packages

in community

Next steps

You should securely store web service access tokens, and fully automate their management and periodic rotation.

If tokens were published unintentionally and the software has been made public, you should revoke exposed tokens and file a security incident.

Examples of service tokens that may have been detected include AWS, Facebook, JWT, SWT, Slack and others.

Problem

Most software applications use standardized installation formats for their distribution. Software installers are built from instructions written within installation scripts that act as blueprints for the distribution format assembly. Installation scripts declare the most important software properties, such as the default installation location, its external dependencies, and various actions that may occur during the installation process. Actions defined within the installation script are executed automatically during events such as software deployment, update, or removal. These events are used by software developers to set up the environment for nominal software use, or to perform cleanup upon software removal. It is unusual for certain types of software installers to execute commands that can collect sensitive system information. Attackers often abuse software installers to run commands that collect identifiable system information such as hostnames, user names, folder structures, and other data points that could help them understand the environment in which their malicious code was installed.

Prevalence in PyPI community

0 packages

found in

Top 100

1 packages

found in

Top 1k

3 packages

found in

Top 10k

706 packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the installation procedure without using the marked behaviors.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. Python Package Index (PyPI) repository is often abused by threat actors to publish software packages that exhibit malicious behaviors. Malware authors use numerous tactics to lure developers into including malicious PyPI packages in their software projects. Most malicious packages published on PyPI target developers and their workstations. However, some are designed to activate only when deployed in the end-user environment. Both types of Python malicious packages are detected by proprietary ReversingLabs threat hunting algorithms. This detection method is considered proactive, and it is based on Machine Learning (ML) algorithms that can detect novel malware. The detection is strongly influenced by behaviors that software components exhibit. Behaviors similar to previously discovered malware and software supply chain attacks may cause some otherwise benign software packages to be detected by this policy.

Prevalence in PyPI community

1 packages

found in

Top 100

18 packages

found in

Top 1k

104 packages

found in

Top 10k

16.5k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

5 packages

found in

Top 10k

38.63k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

20 packages

found in

Top 100

92 packages

found in

Top 1k

907 packages

found in

Top 10k

43.88k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PyPI community

1 packages

found in

Top 100

11 packages

found in

Top 1k

910 packages

found in

Top 10k

717.09k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Operating systems allow multiple user accounts to coexist on a single computer system. Each registered user has identity information associated with their account. At the very least, user accounts consist of a user name and an optional password. In some cases, user account data may also include personally identifiable information. Extended personal information may include user's given and last name, their email and mailing address, personal photo and their telephone number. Financially motivated attackers may seek to collect personal information for purposes of selling the private data to a third-party. Malicious code that typically exhibits these behavior traits is commonly referred to as an information stealer. While the presence of code that accesses identity information does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Accessing identity information is a very common behavior for software packages. One example of acceptable use for such functions is verifying that the active user has purchased a software license that allows them to run the application.

Prevalence in PyPI community

16 packages

found in

Top 100

113 packages

found in

Top 1k

669 packages

found in

Top 10k

19.67k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in PyPI community

0 packages

found in

Top 100

2 packages

found in

Top 1k

10 packages

found in

Top 10k

328 packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Avoid using this software package until it is vetted as safe.

Consider rewriting code that may have triggered the detection due to its malware similarity.

Problem

Prevalence in PyPI community

4 packages

found in

Top 100

14 packages

found in

Top 1k

81 packages

found in

Top 10k

2.82k packages

in community

Next steps

You should securely store web service access tokens, and fully automate their management and periodic rotation.

If tokens were published unintentionally and the software has been made public, you should revoke exposed tokens and file a security incident.

Examples of service tokens that may have been detected include AWS, Facebook, JWT, SWT, Slack and others.

Problem

Prevalence in PyPI community

0 packages

found in

Top 100

1 packages

found in

Top 1k

3 packages

found in

Top 10k

706 packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the installation procedure without using the marked behaviors.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

18 packages

found in

Top 1k

104 packages

found in

Top 10k

16.5k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

5 packages

found in

Top 10k

38.63k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

20 packages

found in

Top 100

92 packages

found in

Top 1k

907 packages

found in

Top 10k

43.88k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PyPI community

1 packages

found in

Top 100

11 packages

found in

Top 1k

910 packages

found in

Top 10k

717.09k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

16 packages

found in

Top 100

113 packages

found in

Top 1k

669 packages

found in

Top 10k

19.67k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

api-request-helpers

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: about 4 hours agoVersion: 0.185.132

INCIDENTS FOR THIS VERSION:

SQ30108Detected presence of malicious files by a machine learning algorithm.Causes risk: malicious components foundthreats

Problem

Prevalence in PyPI community

Next steps

SQ34304Detected presence of web service access tokens.Causes risk: web service credentials foundsecrets

Problem

Prevalence in PyPI community

Next steps

TH16604Detected presence of software installers that can collect sensitive system information.Causes risk: dangerous install procedureshunting

Problem

Prevalence in PyPI community

Next steps

TH15501Detected presence of files with behaviors similar to malicious packages published on PyPI.Causes risk: suspicious application behaviorshunting

Problem

Prevalence in PyPI community

Next steps

TH30105Detected presence of software components that were recently published to the public package repository.hunting

Problem

Prevalence in PyPI community

Next steps

TH15103Detected presence of files with behaviors commonly used by malicious software.hunting

Problem

Prevalence in PyPI community

Next steps

TH30107Detected presence of software components that are rarely included by other public software packages.hunting

Problem

Prevalence in PyPI community

Next steps

TH16126Detected presence of software components that can access user identity information.hunting

Problem

Prevalence in PyPI community

Next steps

Did you know...

SQ30108Detected presence of malicious files by a machine learning algorithm.Causes risk: malicious components foundthreats

Problem

Prevalence in PyPI community

Next steps

SQ34304Detected presence of web service access tokens.Causes risk: web service credentials foundsecrets

Problem

Prevalence in PyPI community

Next steps

TH16604Detected presence of software installers that can collect sensitive system information.Causes risk: dangerous install procedureshunting

Problem

Prevalence in PyPI community

Next steps

TH15501Detected presence of files with behaviors similar to malicious packages published on PyPI.Causes risk: suspicious application behaviorshunting

Problem

Prevalence in PyPI community

Next steps

TH30105Detected presence of software components that were recently published to the public package repository.hunting

Problem

Prevalence in PyPI community

Next steps

TH15103Detected presence of files with behaviors commonly used by malicious software.hunting

Problem

Prevalence in PyPI community

Next steps

TH30107Detected presence of software components that are rarely included by other public software packages.hunting

Problem

Prevalence in PyPI community

Next steps

TH16126Detected presence of software components that can access user identity information.hunting

Problem

Prevalence in PyPI community

Next steps