Top issues
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Open source communities depend on the work of thousands of software developers that volunteer their time to maintain software components. Software developers build up the reputation of their open source projects by developing in public. Modern source code repositories have many social features that allow software developers to handle bug reports, have discussions with their users, and convey reaching significant project milestones. It is uncommon to find open source projects that omit linking their component to a publicly accessible source code repository.Prevalence in PyPI community
No prevalence information at this timeNext steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Detected Linux executable files that were compiled without the recommended dynamic symbol hijacking protections.
Causes risk: execution hijacking concerns
hardening
Problem
On Linux, external symbols are resolved via the procedure linkage table (PLT) and the global offset table (GOT). Without any protection, both are writable at runtime and thus leave the executable vulnerable to pointer hijacking - an attack where the function address is overwritten with an address of a malicious function. Pointer hijacking can be mitigated by using full read-only relocations, which instruct the compiler to unify global offset tables into a single read-only table. This requires that all external function symbols are resolved at load-time instead of during execution, and may increase loading time for large programs.Prevalence in PyPI community
22 packages
found in
Top 100
122 packages
found in
Top 1k
767 packages
found in
Top 10k
16246 packages
in community
Next steps
In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).
If the executable load-time is an issue, you should use partial read-only relocations.
Problem
Debug databases are typically only used during software development. On Windows, they are usually files embedded into the executable (PDB), while on Linux, they're contained inside special executable sections. The databases contain private debug symbols that make it significantly easier to reverse-engineer a closed-source application. In some cases, having a debug database is equivalent to having access to the source code. Presence of debug databases could indicate that one or more software components have been built using a debug profile, instead of the release. Private debug databases can be embedded into software components by programming language tools.Prevalence in PyPI community
22 packages
found in
Top 100
113 packages
found in
Top 1k
748 packages
found in
Top 10k
13672 packages
in community
Next steps
To remediate this issue and remove private debugging information, refer to your programming language toolchain documentation.
Detected presence of hardcoded source code filenames or paths.
Causes risk: debugging symbols found
secrets
Problem
Common compilers often embed source code information into executables for debugging purposes, usually by mapping symbols to source filenames or paths. While this is typically desirable in open-source software and standard tools, that information can be used to determine security weaknesses, code repository layout, trade secrets and similar sensitive information. Such symbols make it easier to reverse-engineer a closed source application.Prevalence in PyPI community
22 packages
found in
Top 100
122 packages
found in
Top 1k
834 packages
found in
Top 10k
18721 packages
in community
Next steps
Strip out such information in the linking phase by using compiler options like the -s flag in GCC, or in the post-build phase by using the strip tool.
Top behaviors
The software package does not declare any source code repository.
anomaly
Prevalence in PyPI community
No behavior prevalence information at this timeQueries the system time.
settings
Prevalence in PyPI community
Behavior often found in this community (Common)
75 packages
found in
Top 100
593 packages
found in
Top 1k
4478 packages
found in
Top 10k
229841 packages
in community
Imports the "time" module, which provides various time-related functions.
execution
Prevalence in PyPI community
Behavior often found in this community (Common)
71 packages
found in
Top 100
502 packages
found in
Top 1k
4036 packages
found in
Top 10k
214507 packages
in community
Imports the "sys" module, which provides access to system-specific parameters and functions.
execution
Prevalence in PyPI community
Behavior often found in this community (Common)
100 packages
found in
Top 100
843 packages
found in
Top 1k
7075 packages
found in
Top 10k
339347 packages
in community
Imports the "re" module, which provides regular expression matching operations.
execution
Prevalence in PyPI community
Behavior often found in this community (Common)
87 packages
found in
Top 100
711 packages
found in
Top 1k
5425 packages
found in
Top 10k
227429 packages
in community
Top vulnerabilities
No vulnerabilities found.