Spectra Assure

PyPI

Search by package name, PURL or hash

failIncident: Malware

Scanned:

uncrypt

Artifact:

latest

malicious

A simple Python library for encrypting and decrypting text with an embedded key

License: unknown

New!

Published:

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

1 debugging symbols found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

1 modern mitigations missing

Threats

Tampering

1 components with malware history

Malware

1 malicious components found

INCIDENTS FOR THIS VERSION:

malware

Reported By: ReversingLabs (Automated)

Learn more about malware detection

Overview issues10 vulnerabilities0 malware1 behaviors241 dependencies0 contributors1 versions3

List of software quality issues with the number of affected components.

Policies

Info

Problem

Proprietary ReversingLabs malware detection algorithms have determined that the software package contains one or more malicious files. The detection was made by a machine learning model. This malware detection method is considered proactive, and can typically identify the malware threat type. The detection is strongly influenced by behaviors that software components exhibit. Behaviors similar to previously discovered malware and software supply chain attacks may cause some otherwise benign components to be detected as malicious.

Prevalence in PyPI community

0 packages

found in

Top 100

2 packages

found in

Top 1k

10 packages

found in

Top 10k

328 packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Avoid using this software package until it is vetted as safe.

Consider rewriting code that may have triggered the detection due to its malware similarity.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. Some open source projects have a history of security lapses that culminated with a publication of one or more malicious component versions. To ensure that repeated supply chain incidents do not occur, the open source project should be closely monitored for up to two years. All software package versions that are published within two years of the malware incident will convey a warning about the history of security incidents tied to the open source project.

Prevalence in PyPI community

2 packages

found in

Top 100

18 packages

found in

Top 1k

110 packages

found in

Top 10k

1.99k packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.

Avoid using this software package until it is vetted as safe.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

5 packages

found in

Top 10k

38.63k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Buffer overrun protection on Linux is achieved in two ways. The most common solution is to use the stack canary (also called cookie). The stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. In most cases, compilers will apply the stack canary conservatively in order to avoid a negative performance impact. Therefore, stack canaries are often used together with another stack overrun mitigation - fortified functions. Fortified functions are usually wrappers around standard glibc functions (such as memcpy) which perform boundary checks either at compile time or run time to determine if a memory violation has occurred. The compiler needs additional context to generate such calls (for example, array size that needs to be known at compile time). Because of this, the compiler will virtually never substitute all viable functions with their fortified counterparts in complex programs. However, when combined with the stack canary, fortified functions provide a good measure of buffer overrun protection.

Prevalence in PyPI community

24 packages

found in

Top 100

130 packages

found in

Top 1k

733 packages

found in

Top 10k

14.31k packages

in community

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in PyPI community

10 packages

found in

Top 100

67 packages

found in

Top 1k

398 packages

found in

Top 10k

9.13k packages

in community

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PyPI community

1 packages

found in

Top 100

11 packages

found in

Top 1k

910 packages

found in

Top 10k

717.09k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Open source communities depend on the work of thousands of software developers that volunteer their time to maintain software components. Software developers build up the reputation of their open source projects by developing in public. Modern source code repositories have many social features that allow software developers to handle bug reports, have discussions with their users, and convey reaching significant project milestones. It is uncommon to find open source projects that omit linking their component to a publicly accessible source code repository.

Prevalence in PyPI community

70 packages

found in

Top 100

472 packages

found in

Top 1k

4207 packages

found in

Top 10k

413.79k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that indirect calls are made only to vetted functions. This mitigation protects dynamically resolved function targets by instrumenting the code responsible for transferring execution control. Because the code flow integrity is verified during runtime, malicious code is less likely to be able to hijack trusted execution paths.

Prevalence in PyPI community

29 packages

found in

Top 100

114 packages

found in

Top 1k

525 packages

found in

Top 10k

8.89k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Common compilers often embed source code information into executables for debugging purposes, usually by mapping symbols to source filenames or paths. While this is typically desirable in open-source software and standard tools, that information can be used to determine security weaknesses, code repository layout, trade secrets and similar sensitive information. Such symbols make it easier to reverse-engineer a closed source application.

Prevalence in PyPI community

27 packages

found in

Top 100

138 packages

found in

Top 1k

922 packages

found in

Top 10k

19.5k packages

in community

Next steps

Strip out such information in the linking phase by using compiler options like the -s flag in GCC, or in the post-build phase by using the strip tool.

Problem

Operating systems allow multiple user accounts to coexist on a single computer system. Each registered user has identity information associated with their account. At the very least, user accounts consist of a user name and an optional password. In some cases, user account data may also include personally identifiable information. Extended personal information may include user's given and last name, their email and mailing address, personal photo and their telephone number. Financially motivated attackers may seek to collect personal information for purposes of selling the private data to a third-party. Malicious code that typically exhibits these behavior traits is commonly referred to as an information stealer. While the presence of code that accesses identity information does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Accessing identity information is a very common behavior for software packages. One example of acceptable use for such functions is verifying that the active user has purchased a software license that allows them to run the application.

Prevalence in PyPI community

16 packages

found in

Top 100

113 packages

found in

Top 1k

669 packages

found in

Top 10k

19.67k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in PyPI community

0 packages

found in

Top 100

2 packages

found in

Top 1k

10 packages

found in

Top 10k

328 packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Avoid using this software package until it is vetted as safe.

Consider rewriting code that may have triggered the detection due to its malware similarity.

Problem

Prevalence in PyPI community

2 packages

found in

Top 100

18 packages

found in

Top 1k

110 packages

found in

Top 10k

1.99k packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.

Avoid using this software package until it is vetted as safe.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

5 packages

found in

Top 10k

38.63k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

24 packages

found in

Top 100

130 packages

found in

Top 1k

733 packages

found in

Top 10k

14.31k packages

in community

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in PyPI community

10 packages

found in

Top 100

67 packages

found in

Top 1k

398 packages

found in

Top 10k

9.13k packages

in community

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PyPI community

1 packages

found in

Top 100

11 packages

found in

Top 1k

910 packages

found in

Top 10k

717.09k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Open source communities depend on the work of thousands of software developers that volunteer their time to maintain software components. Software developers build up the reputation of their open source projects by developing in public. Modern source code repositories have many social features that allow software developers to handle bug reports, have discussions with their users, and convey reaching significant project milestones. It is uncommon to find open source projects that omit linking their component to a publicly accessible source code repository.

Prevalence in PyPI community

70 packages

found in

Top 100

472 packages

found in

Top 1k

4207 packages

found in

Top 10k

413.79k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

29 packages

found in

Top 100

114 packages

found in

Top 1k

525 packages

found in

Top 10k

8.89k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Prevalence in PyPI community

27 packages

found in

Top 100

138 packages

found in

Top 1k

922 packages

found in

Top 10k

19.5k packages

in community

Next steps

Strip out such information in the linking phase by using compiler options like the -s flag in GCC, or in the post-build phase by using the strip tool.

Problem

Prevalence in PyPI community

16 packages

found in

Top 100

113 packages

found in

Top 1k

669 packages

found in

Top 10k

19.67k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

uncrypt

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: about 7 hours agoVersion: 0.1.2

INCIDENTS FOR THIS VERSION:

SQ30108Detected presence of malicious files by a machine learning algorithm.Causes risk: malicious components foundthreats

Problem

Prevalence in PyPI community

Next steps

TH30101Detected presence of software components that had a recent malware or tampering incident.Causes risk: components with malware historyhunting

Problem

Prevalence in PyPI community

Next steps

TH30105Detected presence of software components that were recently published to the public package repository.hunting

Problem

Prevalence in PyPI community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

TH30107Detected presence of software components that are rarely included by other public software packages.hunting

Problem

Prevalence in PyPI community

Next steps

TH30112Detected presence of software components without a declared source code repository.hunting

Problem

Prevalence in PyPI community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

SQ34204Detected presence of hardcoded source code filenames or paths.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in PyPI community

Next steps

TH16126Detected presence of software components that can access user identity information.hunting

Problem

Prevalence in PyPI community

Next steps

Did you know...

SQ30108Detected presence of malicious files by a machine learning algorithm.Causes risk: malicious components foundthreats

Problem

Prevalence in PyPI community

Next steps

TH30101Detected presence of software components that had a recent malware or tampering incident.Causes risk: components with malware historyhunting

Problem

Prevalence in PyPI community

Next steps

TH30105Detected presence of software components that were recently published to the public package repository.hunting

Problem

Prevalence in PyPI community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

TH30107Detected presence of software components that are rarely included by other public software packages.hunting

Problem

Prevalence in PyPI community

Next steps

TH30112Detected presence of software components without a declared source code repository.hunting

Problem

Prevalence in PyPI community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps