Spectra Assure
Community
Docs
failIncident: Removal
Scanned: 8 days ago

tensorflow-aarch64

Artifact:
License: unknown
Published: over 2 years ago



SAFE Assessment

Compliance

Licenses
1 weak copyleft linked components
Secrets
136 debugging symbols found

Security

Vulnerabilities
10 severe vulnerabilities exploited
Hardening
68 reduced effectiveness mitigations

Threats

Tampering
No evidence of software tampering
Malware
No evidence of malware inclusion

INCIDENTS FOR THIS VERSION:

removal
2 months agoReported By: Community

Popularity

2.55M
Total Downloads
Contributors
Declared Dependencies
12
Dependents

Top issues

Problem

Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.

Prevalence in PyPI community

38 packages
found in
Top 100
303 packages
found in
Top 1k
2611 packages
found in
Top 10k
103184 packages
in community

Next steps

We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Available threat intelligence telemetry has confirmed that the reported vulnerabilities are actively being exploited by malicious actors. Malware code that propagates through these vulnerabilities has been created. This increases the chance of automated malware attacks affecting the software component users.

Prevalence in PyPI community

10 packages
found in
Top 100
78 packages
found in
Top 1k
751 packages
found in
Top 10k
27887 packages
in community

Next steps

We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.

Prevalence in PyPI community

25 packages
found in
Top 100
212 packages
found in
Top 1k
1951 packages
found in
Top 10k
77976 packages
in community

Next steps

Perform impact analysis for the reported CVEs.
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in PyPI community

50 packages
found in
Top 100
352 packages
found in
Top 1k
2858 packages
found in
Top 10k
108771 packages
in community

Next steps

Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Weak copyleft licenses in particular impose requirements that the user must be able to replace or update the code they apply to. In practical terms, that means the object and library files that statically link to weak copyleft code must be made available publicly. For commercial applications, this is typically undesirable. Therefore, statically linking to weak copyleft code is commonly avoided or even prohibited by the organization policy. Instead of linking statically to weak copyleft licensed code, it is recommended to isolate such code into modules that the publisher-developed, first-party code can dynamically link to without the aforementioned obligations.

Prevalence in PyPI community

1 packages
found in
Top 100
13 packages
found in
Top 1k
76 packages
found in
Top 10k
1063 packages
in community

Next steps

Confirm that the software package statically links to a weak copyleft dependency.
Investigate if the software publisher provides this dependency under a non-copyleft license.
Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.
Alternatively, repackage the code so that it dynamically links to a weak copyleft dependency.

Top behaviors

Prevalence in PyPI community

Behavior often found in this community (Common)
17 packages
found in
Top 100
89 packages
found in
Top 1k
547 packages
found in
Top 10k
15951 packages
in community

Prevalence in PyPI community

Behavior often found in this community (Common)
2 packages
found in
Top 100
17 packages
found in
Top 1k
102 packages
found in
Top 10k
1482 packages
in community

Prevalence in PyPI community

Behavior often found in this community (Common)
10 packages
found in
Top 100
50 packages
found in
Top 1k
265 packages
found in
Top 10k
5875 packages
in community

Prevalence in PyPI community

Behavior often found in this community (Common)
11 packages
found in
Top 100
73 packages
found in
Top 1k
368 packages
found in
Top 10k
8619 packages
in community

Prevalence in PyPI community

Behavior uncommon for this community (Uncommon)
1 packages
found in
Top 100
19 packages
found in
Top 1k
129 packages
found in
Top 10k
2361 packages
in community

Top vulnerabilities

Vulnerability Exploitation Lifecycle
(25 Active Vulnerabilities)
3 (2 Fixable)
CVE-2025-9906h
CVE-2024-55459m
CVE-2023-38546l
22 (22 Fixable)
CVE-2023-38545c
CVE-2024-3660c
CVE-2025-1550c
1 (1 Fixable)
CVE-2023-38545c
None
Exploits Unknown
Exploits Exist
Exploited by Malware
Patching Mandated