getpublicip

Problem

Potentially unwanted applications (PUAs) can be considered a risk by some software users. This threat type typically collects private user data, or in more extreme cases, tampers with system security settings. Most threat prevention solutions detect and block PUAs. Software packages that trigger security solution detections also tend to increase the number of support calls and open tickets from users.

Problem

Proprietary ReversingLabs malware detection algorithms have determined that the software package contains one or more malicious components. The detection was made by either a static byte signature, software component identity, or a complete file hash. This malware detection method is considered highly accurate, and can typically attribute malware to previously discovered software supply chain attacks. It is common to have multiple supply chain attack artifacts that relate to a single malware incident.

Problem

Threat researchers have manually inspected the software package and determined that it contains one or more malicious files. The detection was made by a hash-based file reputation lookup. This malware detection method is considered highly accurate, and can typically identify the malware family by name.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign, some are exclusively used by malicious software with the intent to cause harm. When a software package matches behavior traits of malicious software, it becomes flagged by security solutions. It is highly likely that the software package was tampered with by a malicious actor or a rogue insider. Detected threat type matches the behaviors typically exhibited by the infostealer malware profile. Infostealers are commonly used to steal sensitive user data such as stored login details, financial information, and other personally identifiable information.

Problem

Most software applications use standardized installation formats for their distribution. Software installers are built from instructions written within installation scripts that act as blueprints for the distribution format assembly. Installation scripts declare the most important software properties, such as the default installation location, its external dependencies, and various actions that may occur during the installation process. Actions defined within the installation script are executed automatically during events such as software deployment, update, or removal. These events are used by software developers to set up the environment for nominal software use, or to perform cleanup upon software removal. It is unusual for certain types of software installers to invoke commands that download additional content from a remote server. Attackers commonly abuse software installers to fetch malicious payloads from public code repositories, file sharing websites, or their own infrastructure. Remotely hosted content is not immutable, allowing the attackers to change the type of malware they deploy at any time.

Prevalence in PyPI community

No prevalence information at this time