Our AI threat analyst detects malicious packages and blogs about OSS compromises
7000 write-ups and countingRead one

Spectra Assure

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

PyPI

Search by package name, PURL or hash

warningRisk: Secrets

Scanned:

chdb

Artifact:

latest

Top 10k

chDB is an in-process OLAP SQL Engine powered by ClickHouse

License: Permissive (Apache-2.0)

Published:

Visit GitHub

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

4 web service credentials found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

INCIDENTS FOR THIS VERSION:

Overview issues5 vulnerabilities0 malware0 behaviors85 dependencies14 contributors2 versions96

List of software quality issues with the number of affected components.

Policies

Info

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.

Prevalence in PyPI community

36 packages

found in

Top 100

219 packages

found in

Top 1k

1678 packages

found in

Top 10k

63.41k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Various network communication protocols allow including plaintext authentication credentials. Information such as user names and passwords could be passed through a non-encrypted channel, and therefore intercepted by malicious actors. Credentials are considered secrets, and should be kept encrypted until they are used. This policy control matches the following URI pattern protocol://username:password@domain within any software package component.

Prevalence in PyPI community

21 packages

found in

Top 100

86 packages

found in

Top 1k

378 packages

found in

Top 10k

7.36k packages

in community

Next steps

Review the reported matches. If the warning refers to a placeholder credential value, it can be safely ignored.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. A port number is associated with a network address of a host, such as an IP address, and the type of network protocol used for communication. Within URLs, the ports are optional. Ports can be specified in a URL immediately following the domain name. Each network protocol, or schema, has a set of standard ports on which the service operates. This issue is raised when a mismatch between a network protocol and its expected port number is detected. While the presence of non-standard ports does not imply malicious intent, all of their uses in a software package should be documented and approved.

Prevalence in PyPI community

35 packages

found in

Top 100

271 packages

found in

Top 1k

1732 packages

found in

Top 10k

61.12k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the port to one that is standard for the networking protocol.

Problem

Private keys and certificates are considered sensitive information that should not be included in released software packages. However, developers frequently release sensitive information alongside their applications to facilitate automated software testing. Testing keys and certificates often proliferate through the software supply chain. When such information gets shared publicly, it is catalogued by file reputation databases. Any private key and certificate files seen by a file reputation database prior to configured time threshold can be automatically suppressed. Commonly shared sensitive information is not considered to be secret.

Prevalence in PyPI community

37 packages

found in

Top 100

169 packages

found in

Top 1k

753 packages

found in

Top 10k

16.54k packages

in community

Next steps

Review the commonly shared sensitive information for evidence of inadvertently exposed secrets.

If the keys were published unintentionally and the software has been made public, you should revoke the keys and file a security incident.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Query parameters are a defined set of parameters (key-value pairs) attached to the end of a URL. Query parameters are used to provide additional information to a web service when making a request. They are an optional, but an important part of the URL, as they may define specific content or actions based on the data being passed. Some data they pass might be considered sensitive information. Since query parameters are not encrypted, this might cause sensitive information to leak. This issue is raised for query parameters that might contain information that attackers can easily intercept. Examples of sensitive information fields include hostname, password, email, IMEI and other similar parameters.

Prevalence in PyPI community

2 packages

found in

Top 100

12 packages

found in

Top 1k

72 packages

found in

Top 10k

2.13k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the query parameters for flagged network locations.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in PyPI community

36 packages

found in

Top 100

219 packages

found in

Top 1k

1678 packages

found in

Top 10k

63.41k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Prevalence in PyPI community

21 packages

found in

Top 100

86 packages

found in

Top 1k

378 packages

found in

Top 10k

7.36k packages

in community

Next steps

Review the reported matches. If the warning refers to a placeholder credential value, it can be safely ignored.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. A port number is associated with a network address of a host, such as an IP address, and the type of network protocol used for communication. Within URLs, the ports are optional. Ports can be specified in a URL immediately following the domain name. Each network protocol, or schema, has a set of standard ports on which the service operates. This issue is raised when a mismatch between a network protocol and its expected port number is detected. While the presence of non-standard ports does not imply malicious intent, all of their uses in a software package should be documented and approved.

Prevalence in PyPI community

35 packages

found in

Top 100

271 packages

found in

Top 1k

1732 packages

found in

Top 10k

61.12k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the port to one that is standard for the networking protocol.

Problem

Prevalence in PyPI community

37 packages

found in

Top 100

169 packages

found in

Top 1k

753 packages

found in

Top 10k

16.54k packages

in community

Next steps

Review the commonly shared sensitive information for evidence of inadvertently exposed secrets.

If the keys were published unintentionally and the software has been made public, you should revoke the keys and file a security incident.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Query parameters are a defined set of parameters (key-value pairs) attached to the end of a URL. Query parameters are used to provide additional information to a web service when making a request. They are an optional, but an important part of the URL, as they may define specific content or actions based on the data being passed. Some data they pass might be considered sensitive information. Since query parameters are not encrypted, this might cause sensitive information to leak. This issue is raised for query parameters that might contain information that attackers can easily intercept. Examples of sensitive information fields include hostname, password, email, IMEI and other similar parameters.

Prevalence in PyPI community

2 packages

found in

Top 100

12 packages

found in

Top 1k

72 packages

found in

Top 10k

2.13k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the query parameters for flagged network locations.

chdb

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: This package had 182 removal incidents in versions published within 2 years prior to the latestLatest version with removal incident detected: 8 months agoVersion: 4.0.0

INCIDENTS FOR THIS VERSION:

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in PyPI community

Next steps

SQ34302Detected presence of plaintext credentials within network protocol strings.Causes risk: web service credentials foundsecrets

Problem

Prevalence in PyPI community

Next steps

TH17115Detected presence of files containing URLs that use non-standard ports.hunting

Problem

Prevalence in PyPI community

Next steps

SQ34101Detected presence of commonly distributed sensitive data.secrets

Problem

Prevalence in PyPI community

Next steps

TH17116Detected presence of files containing URLs with important query parameters.hunting

Problem

Prevalence in PyPI community

Next steps

Did you know...

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in PyPI community

Next steps

SQ34302Detected presence of plaintext credentials within network protocol strings.Causes risk: web service credentials foundsecrets

Problem

Prevalence in PyPI community

Next steps

TH17115Detected presence of files containing URLs that use non-standard ports.hunting

Problem

Prevalence in PyPI community

Next steps

SQ34101Detected presence of commonly distributed sensitive data.secrets

Problem

Prevalence in PyPI community

Next steps

TH17116Detected presence of files containing URLs with important query parameters.hunting

Problem

Prevalence in PyPI community

Next steps