Spectra Assure

warningRisk: Tampering

Scanned:

pywebview

Artifact:

latest

Top 10k

Build GUI for your Python program with JavaScript, HTML, and CSS

License: unknown

Published:

Visit GitHub

See on PyPI

SAFE Assessment

Compliance

Licenses

1 software distribution restrictions

Secrets

No sensitive information found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

6 low priority mitigations absent

Threats

Tampering

1 components with malware history

Malware

No evidence of malware inclusion

INCIDENTS FOR THIS VERSION:

List of software quality issues with the number of affected components.

Policies

Info

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. Some open source projects have a history of security lapses that culminated with a publication of one or more malicious component versions. To ensure that repeated supply chain incidents do not occur, the open source project should be closely monitored for up to two years. All software package versions that are published within two years of the malware incident will convey a warning about the history of security incidents tied to the open source project.

Prevalence in PyPI community

2 packages

found in

Top 100

18 packages

found in

Top 1k

110 packages

found in

Top 10k

1.99k packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.

Avoid using this software package until it is vetted as safe.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.

Prevalence in PyPI community

7 packages

found in

Top 100

82 packages

found in

Top 1k

1208 packages

found in

Top 10k

109.57k packages

in community

Next steps

Confirm that the software package references a component or a dependency with a restrictive license.

Consider replacing the software component with an alternative that offers a license compatible with organization policy.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that dynamic calls are made only to vetted functions. Trusted execution paths rely on the ability of the operating system to build a list of valid function targets. Certain functions can intentionally be disallowed to prevent malicious code from deactivating vulnerability mitigation features. A list of such invalid function targets can include publicly exported symbols. Applications that enhance control flow integrity through export suppression rely on libraries to mark their publicly visible symbols as suppressed. This is done for all symbols that are considered to be sensitive functions, and to which access should be restricted. It is considered dangerous to mix applications that perform export suppression with libraries that do not.

Prevalence in PyPI community

30 packages

found in

Top 100

143 packages

found in

Top 1k

833 packages

found in

Top 10k

15.19k packages

in community

Next steps

To enable this mitigation on library code, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that indirect calls are made only to vetted functions. This mitigation protects dynamically resolved function targets by instrumenting the code responsible for transferring execution control. Function pointers that get resolved through import and delayed import address tables do not need to be monitored during application runtime. Instead, it is expected that modern programming language toolchains place those pointers in read-only memory locations. However, the delayed import functions are resolved as they are needed during runtime. To ensure the function pointers remain read-only, the operating system must be made aware if it is safe to re-protect the memory pages that hold them. Modern toolchains typically separate import data from other application regions for this very reason.

Prevalence in PyPI community

1 packages

found in

Top 100

4 packages

found in

Top 1k

38 packages

found in

Top 10k

468 packages

in community

Next steps

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. A port number is associated with a network address of a host, such as an IP address, and the type of network protocol used for communication. Within URLs, the ports are optional. Ports can be specified in a URL immediately following the domain name. Each network protocol, or schema, has a set of standard ports on which the service operates. This issue is raised when a mismatch between a network protocol and its expected port number is detected. While the presence of non-standard ports does not imply malicious intent, all of their uses in a software package should be documented and approved.

Prevalence in PyPI community

35 packages

found in

Top 100

271 packages

found in

Top 1k

1732 packages

found in

Top 10k

61.12k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the port to one that is standard for the networking protocol.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that dynamic calls are made only to vetted functions. This mitigation is detected as enabled, but its effectiveness is impacted by unexpected function alignment. For optimal protection, guarded functions must be aligned to the 16-byte boundary. Any misalignment leaves a small window for the malicious code to take advantage of an improperly secured code flow path.

Prevalence in PyPI community

1 packages

found in

Top 100

4 packages

found in

Top 1k

35 packages

found in

Top 10k

325 packages

in community

Next steps

There are currently no programming language toolchain options to force proper function alignment. If this warning is issued for a file, it is likely that a future build, with some code changes, will make the compiler order the application code differently and eliminate the CFG coverage gaps.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in PyPI community

2 packages

found in

Top 100

18 packages

found in

Top 1k

110 packages

found in

Top 10k

1.99k packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

7 packages

found in

Top 100

82 packages

found in

Top 1k

1208 packages

found in

Top 10k

109.57k packages

in community

Next steps

Confirm that the software package references a component or a dependency with a restrictive license.

Consider replacing the software component with an alternative that offers a license compatible with organization policy.

Problem

Prevalence in PyPI community

30 packages

found in

Top 100

143 packages

found in

Top 1k

833 packages

found in

Top 10k

15.19k packages

in community

Next steps

To enable this mitigation on library code, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

4 packages

found in

Top 1k

38 packages

found in

Top 10k

468 packages

in community

Next steps

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Prevalence in PyPI community

35 packages

found in

Top 100

271 packages

found in

Top 1k

1732 packages

found in

Top 10k

61.12k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the port to one that is standard for the networking protocol.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

4 packages

found in

Top 1k

35 packages

found in

Top 10k

325 packages

in community

pywebview

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: This package had 2 malicious incidents in versions published within 2 years prior to the latestLatest version with malware incident detected: over 1 year agoVersion: 5.4

INCIDENTS FOR THIS VERSION:

TH30101Detected presence of software components that had a recent malware or tampering incident.Causes risk: components with malware historyhunting

Problem

Prevalence in PyPI community

Next steps

SQ12405Detected presence of licenses that place restrictions on software distribution.Causes risk: software distribution restrictionslicenses

Problem

Prevalence in PyPI community

Next steps

SQ14125Detected Windows shared library files that do not suppress exports which reduces CFG vulnerability mitigation protection effectiveness.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

SQ14128Detected Windows executable files that do not implement delayed import function hijacking mitigation protection.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

TH17115Detected presence of files containing URLs that use non-standard ports.hunting

Problem

Prevalence in PyPI community

Next steps

SQ14123Detected Windows executable files that might ineffectively implement CFG vulnerability mitigation protection.hardening

Problem

Prevalence in PyPI community

Next steps

Did you know...

TH30101Detected presence of software components that had a recent malware or tampering incident.Causes risk: components with malware historyhunting

Problem

Prevalence in PyPI community

Next steps

SQ12405Detected presence of licenses that place restrictions on software distribution.Causes risk: software distribution restrictionslicenses

Problem

Prevalence in PyPI community

Next steps

SQ14125Detected Windows shared library files that do not suppress exports which reduces CFG vulnerability mitigation protection effectiveness.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

SQ14128Detected Windows executable files that do not implement delayed import function hijacking mitigation protection.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

TH17115Detected presence of files containing URLs that use non-standard ports.hunting

Problem

Prevalence in PyPI community

Next steps

SQ14123Detected Windows executable files that might ineffectively implement CFG vulnerability mitigation protection.hardening

Problem

Prevalence in PyPI community

Next steps