Spectra Assure

failIncident: Malware

Scanned:

file-share-temp-welkin

Artifact:

latest

malicious

License: unknown

Published:

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

69 debugging symbols found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

53 baseline mitigations missing

Threats

Tampering

No evidence of software tampering

Malware

3 malicious components found

INCIDENTS FOR THIS VERSION:

malware

Reported By: ReversingLabs (Automated)

Learn more about malware detection

Overview issues15 vulnerabilities0 malware1 behaviors75 dependencies0 contributors0 versions1

List of software quality issues with the number of affected components.

Policies

Info

Problem

Third-party malware detection algorithms have determined that the software package contains one or more malicious files. The detection was made by a hash-based file reputation lookup. This malware detection method is considered accurate, and can typically identify the malware family by name.

Prevalence in PyPI community

1 packages

found in

Top 100

0 packages

found in

Top 1k

19 packages

found in

Top 10k

772 packages

in community

Next steps

If the software intent does not relate to malicious behavior, investigate the build and release environment for software supply chain compromise.

Avoid using this software package.

Problem

The stack is a special program segment which is writable by design, and is commonly used to store function-specific data and execution context. Granting execution privileges to the stack segment reduces application security, because it makes it possible to execute arbitrary code stored on the stack. While many modern compilers will implement a non-executable stack by default, it can be unintentionally disabled or made explicitly executable in automatically generated or misconfigured compiler options.

Prevalence in PyPI community

1 packages

found in

Top 100

4 packages

found in

Top 1k

48 packages

found in

Top 10k

441 packages

in community

Next steps

Enable non-executable stack mitigation with the -z noexecstack parameter during compilation.

Problem

Operating systems execute application code in multiple privilege access levels. Separation of privileges is designed to protect the stability and integrity of the operating system by shielding it from issues that the user run applications may cause. However, some users may need to interact with higher privilege parts of the operating system to accomplish specific tasks. For this purpose, operating systems provide facilities that users may leverage to temporarily elevate their running privileges. Users with higher privileges can run any application with the same privilege level as their own. Attackers often try to trick privileged users into running malicious code, enabling them to infect the operating system. While the presence of code that elevates user privileges does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that can elevate user privileges. One example of acceptable use for such functions is allowing the users to install software packages and updates.

Prevalence in PyPI community

1 packages

found in

Top 100

31 packages

found in

Top 1k

194 packages

found in

Top 10k

4.1k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1548 - Abuse Elevation Control Mechanism.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

5 packages

found in

Top 10k

38.63k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

13 packages

found in

Top 1k

37 packages

found in

Top 10k

443.06k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Buffer overrun protection on Linux is achieved in two ways. The most common solution is to use the stack canary (also called cookie). The stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. In most cases, compilers will apply the stack canary conservatively in order to avoid a negative performance impact. Therefore, stack canaries are often used together with another stack overrun mitigation - fortified functions. Fortified functions are usually wrappers around standard glibc functions (such as memcpy) which perform boundary checks either at compile time or run time to determine if a memory violation has occurred. The compiler needs additional context to generate such calls (for example, array size that needs to be known at compile time). Because of this, the compiler will virtually never substitute all viable functions with their fortified counterparts in complex programs. However, when combined with the stack canary, fortified functions provide a good measure of buffer overrun protection.

Prevalence in PyPI community

14 packages

found in

Top 100

85 packages

found in

Top 1k

513 packages

found in

Top 10k

8.12k packages

in community

Next steps

Presence of unfortified string functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in PyPI community

24 packages

found in

Top 100

130 packages

found in

Top 1k

733 packages

found in

Top 10k

14.31k packages

in community

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in PyPI community

10 packages

found in

Top 100

67 packages

found in

Top 1k

398 packages

found in

Top 10k

9.13k packages

in community

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

ASLR (address-space layout randomization) is a mitigation technique that increases the difficulty of performing buffer-overflow attacks that require the attacker to know the address of the program in memory. This is done by loading the program at a randomly selected address in the process' address space. ASLR-enabled kernels can choose a random load address only for position-independent executables and code.

Prevalence in PyPI community

3 packages

found in

Top 100

17 packages

found in

Top 1k

119 packages

found in

Top 10k

2.96k packages

in community

Next steps

To support ASLR, the program must be compiled as position-independent code. In most compilers, this is done by passing the corresponding position-independent flag, such as -fPIC for shared libraries or -fPIE for executables.

Problem

On Linux, external symbols are resolved via the procedure linkage table (PLT) and the global offset table (GOT). The global offset table is split into two tables - one for external data, and one for external functions. Without any protection, both are writable at runtime and thus leave the executable vulnerable to data overwrite attacks and pointer hijacking. Data overwrite attacks can be mitigated by using partial read-only relocations, while pointer hijacking can be mitigated with full read-only relocations. Both approaches have some drawbacks. Partial read-only relocations don't provide full protection, because the external function GOT remains writable. Full read-only relocations require that all external function symbols are resolved at load-time instead of during execution. This may increase loading time for large programs.

Prevalence in PyPI community

21 packages

found in

Top 100

95 packages

found in

Top 1k

405 packages

found in

Top 10k

3.91k packages

in community

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

0 packages

found in

Top 1k

19 packages

found in

Top 10k

772 packages

in community

Next steps

If the software intent does not relate to malicious behavior, investigate the build and release environment for software supply chain compromise.

Avoid using this software package.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

4 packages

found in

Top 1k

48 packages

found in

Top 10k

441 packages

in community

Next steps

Enable non-executable stack mitigation with the -z noexecstack parameter during compilation.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

31 packages

found in

Top 1k

194 packages

found in

Top 10k

4.1k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1548 - Abuse Elevation Control Mechanism.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

5 packages

found in

Top 10k

38.63k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

13 packages

found in

Top 1k

37 packages

found in

Top 10k

443.06k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

14 packages

found in

Top 100

85 packages

found in

Top 1k

513 packages

found in

Top 10k

8.12k packages

in community

Next steps

Presence of unfortified string functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in PyPI community

24 packages

found in

Top 100

130 packages

found in

Top 1k

733 packages

found in

Top 10k

14.31k packages

in community

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in PyPI community

10 packages

found in

Top 100

67 packages

found in

Top 1k

398 packages

found in

Top 10k

9.13k packages

in community

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in PyPI community

3 packages

found in

Top 100

17 packages

found in

Top 1k

119 packages

found in

Top 10k

2.96k packages

in community

Next steps

Problem

Prevalence in PyPI community

21 packages

found in

Top 100

95 packages

found in

Top 1k

405 packages

found in

Top 10k

3.91k packages

in community

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

file-share-temp-welkin

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: about 2 months agoVersion: 1.0.0

INCIDENTS FOR THIS VERSION:

SQ30110Detected presence of malicious files through file reputation or third-party scanners.Causes risk: malicious components foundthreats

Problem

Prevalence in PyPI community

Next steps

SQ18101Detected Linux executable files that declare the stack as executable, making non-executable memory mitigations less effective.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

TH16120Detected presence of software components that can elevate the user privileges.hunting

Problem

Prevalence in PyPI community

Next steps

TH30105Detected presence of software components that were recently published to the public package repository.hunting

Problem

Prevalence in PyPI community

Next steps

TH30106Detected presence of software components that have low popularity or number of downloads.hunting

Problem

Prevalence in PyPI community

Next steps

SQ18105Detected Linux executable files compiled without any kind of buffer overrun protection while using banned string functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

SQ18111Detected Linux executable files that do not implement the ASLR vulnerability mitigation protection.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

SQ18112Detected Linux executable files that were compiled without any dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

Did you know...

SQ30110Detected presence of malicious files through file reputation or third-party scanners.Causes risk: malicious components foundthreats

Problem

Prevalence in PyPI community

Next steps

SQ18101Detected Linux executable files that declare the stack as executable, making non-executable memory mitigations less effective.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

TH16120Detected presence of software components that can elevate the user privileges.hunting

Problem

Prevalence in PyPI community

Next steps

TH30105Detected presence of software components that were recently published to the public package repository.hunting

Problem

Prevalence in PyPI community

Next steps

TH30106Detected presence of software components that have low popularity or number of downloads.hunting

Problem

Prevalence in PyPI community

Next steps

SQ18105Detected Linux executable files compiled without any kind of buffer overrun protection while using banned string functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps