List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Proprietary ReversingLabs malware detection algorithms have determined that the software package contains one or more malicious components. The detection was made by either a static byte signature, software component identity, or a complete file hash. This malware detection method is considered highly accurate, and can typically attribute malware to previously discovered software supply chain attacks. It is common to have multiple supply chain attack artifacts that relate to a single malware incident.
Prevalence in PyPI community
0 packages
found in
Top 100
2 packages
found in
Top 1k
18 packages
found in
Top 10k
15.82k packages
in community
Next steps
If the software intent does not relate to malicious behavior, investigate the build and release environment for software supply chain compromise.
Avoid using this software package.
Problem
Threat researchers have manually inspected the software package and determined that it contains one or more malicious files. The detection was made by a hash-based file reputation lookup. This malware detection method is considered highly accurate, and can typically identify the malware family by name.
Prevalence in PyPI community
0 packages
found in
Top 100
1 packages
found in
Top 1k
15 packages
found in
Top 10k
15.24k packages
in community
Next steps
Investigate the build and release environment for software supply chain compromise.
Avoid using this software package.
Problem
Most software applications use standardized installation formats for their distribution. Software installers are built from instructions written within installation scripts that act as blueprints for the distribution format assembly. Installation scripts declare the most important software properties, such as the default installation location, its external dependencies, and various actions that may occur during the installation process. Actions defined within the installation script are executed automatically during events such as software deployment, update, or removal. These events are used by software developers to set up the environment for nominal software use, or to perform cleanup upon software removal. However, installation scripts are commonly abused by threat actors to execute arbitrary commands on the deployment machine. It was detected that an installation script could execute commands that are not typically used during software installation. Such unusual commands resemble common threat actor tactics and are usually obscured by layers of cryptography, code obfuscation, anti-analysis features, and other detection evasion techniques.
Prevalence in PyPI community
0 packages
found in
Top 100
1 packages
found in
Top 1k
0 packages
found in
Top 10k
1.51k packages
in community
Next steps
Investigate reported detections.
If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider rewriting the installation procedure without using the marked behaviors.
Problem
Software components sometimes need to interact with sensitive parts of the runtime environment, often requiring privileged access to accomplish a task. Build pipeline configuration includes high-value information such as CI/CD platform secrets and tokens, pipeline definition files and runner configuration, build-time environment variables containing signing keys or deploy credentials, and artifact registry and package publishing credentials. That information is used by continuous integration and delivery systems. Attackers often abuse access to build pipeline configuration to harvest secrets from build environments, which can later be exfiltrated to attacker-controlled infrastructure and used to tamper with software releases or publish malicious artifacts under trusted identities. While the presence of code that accesses build pipeline configuration does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select software components should consider using functions that read build pipeline configuration. One example of acceptable use for such functions is release tooling that reads publishing credentials to push artifacts.
Prevalence in PyPI community
0 packages
found in
Top 100
16 packages
found in
Top 1k
58 packages
found in
Top 10k
2.44k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. Open source projects are the intellectual property of their respective authors. At any time, the authors may choose to completely remove the software component from a public repository. This often occurs when a software project reaches its end-of-life stage, or when the software authors lose interest in maintaining the project. This kind of removal frees up the software package name, its unique software identifier in the public repository, for other developers to use. However, new software project owners might have malicious intent. Threat actors are continuously monitoring popular package names in case their unique identifiers suddenly become available for hijacking. Once the software projects falls under new ownership, the new maintainers may opt to use the project popularity to spread malware to unsuspecting users.
Prevalence in PyPI community
2 packages
found in
Top 100
12 packages
found in
Top 1k
54 packages
found in
Top 10k
99.05k packages
in community
Next steps
Inspect behaviors exhibited by the detected software components.
If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.
Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.
Avoid using this software package until it is vetted as safe.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.
Prevalence in PyPI community
0 packages
found in
Top 100
0 packages
found in
Top 1k
0 packages
found in
Top 10k
74.14k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.
Prevalence in PyPI community
2 packages
found in
Top 100
22 packages
found in
Top 1k
623 packages
found in
Top 10k
614.08k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Problem
Various network communication protocols allow including plaintext authentication credentials. Information such as user names and passwords could be passed through a non-encrypted channel, and therefore intercepted by malicious actors. Credentials are considered secrets, and should be kept encrypted until they are used. This policy control matches the following URI pattern protocol://username:password@domain within any software package component.
Prevalence in PyPI community
15 packages
found in
Top 100
78 packages
found in
Top 1k
317 packages
found in
Top 10k
13.04k packages
in community
Next steps
Review the reported matches. If the warning refers to a placeholder credential value, it can be safely ignored.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.
Prevalence in PyPI community
7 packages
found in
Top 100
34 packages
found in
Top 1k
839 packages
found in
Top 10k
928.02k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Open source communities depend on the work of thousands of software developers that volunteer their time to maintain software components. Software developers build up the reputation of their open source projects by developing in public. Modern source code repositories have many social features that allow software developers to handle bug reports, have discussions with their users, and convey reaching significant project milestones. It is uncommon to find open source projects that omit linking their component to a publicly accessible source code repository.
Prevalence in PyPI community
64 packages
found in
Top 100
413 packages
found in
Top 1k
3331 packages
found in
Top 10k
468.19k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.