List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Proprietary ReversingLabs malware detection algorithms have determined that the software package contains one or more malicious files. The detection was made by a machine learning model. This malware detection method is considered proactive, and can typically identify the malware threat type. The detection is strongly influenced by behaviors that software components exhibit. Behaviors similar to previously discovered malware and software supply chain attacks may cause some otherwise benign components to be detected as malicious.
Prevalence in PyPI community
0 packages
found in
Top 100
2 packages
found in
Top 1k
10 packages
found in
Top 10k
328 packages
in community
Next steps
Inspect behaviors exhibited by the detected software components.
If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.
Avoid using this software package until it is vetted as safe.
Consider rewriting code that may have triggered the detection due to its malware similarity.
Problem
Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.
Prevalence in PyPI community
35 packages
found in
Top 100
210 packages
found in
Top 1k
1787 packages
found in
Top 10k
86.39k packages
in community
Next steps
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.
Prevalence in PyPI community
27 packages
found in
Top 100
156 packages
found in
Top 1k
1294 packages
found in
Top 10k
58.62k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Private keys are used to protect sensitive information, digitally sign content, and to secure information transmission. Private keys are considered secrets, and as such should never be published. Depending on the private key type its exposure can carry a varying degree of risk. While it is common for private keys to be found as standalone files, the detected ones have been found embedded within another software package component. This could indicate an attempt to hide private key presence. Attackers abuse private keys to gain unauthorized server access, decrypt sensitive information, digitally sign content, or impersonate users whose private keys have been leaked.
Prevalence in PyPI community
4 packages
found in
Top 100
18 packages
found in
Top 1k
51 packages
found in
Top 10k
655 packages
in community
Next steps
Review the reported private keys and remove them from the software package if they were accidentally included.
If the keys were published unintentionally and the software has been made public, you should revoke the keys and file a security incident.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.
Prevalence in PyPI community
42 packages
found in
Top 100
278 packages
found in
Top 1k
1960 packages
found in
Top 10k
77.08k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.
Prevalence in PyPI community
0 packages
found in
Top 100
0 packages
found in
Top 1k
5 packages
found in
Top 10k
38.63k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Problem
ASLR (address-space layout randomization) is a mitigation technique that increases the difficulty of performing buffer-overflow attacks that require the attacker to know the address of the program in memory. This is done by loading the program at a randomly selected address in the process' address space. ASLR-enabled kernels can choose a random load address only for position-independent executables and code.
Prevalence in PyPI community
3 packages
found in
Top 100
17 packages
found in
Top 1k
119 packages
found in
Top 10k
2.96k packages
in community
Next steps
To support ASLR, the program must be compiled as position-independent code. In most compilers, this is done by passing the corresponding position-independent flag, such as -fPIC for shared libraries or -fPIE for executables.
Problem
On Linux, external symbols are resolved via the procedure linkage table (PLT) and the global offset table (GOT). The global offset table is split into two tables - one for external data, and one for external functions. Without any protection, both are writable at runtime and thus leave the executable vulnerable to data overwrite attacks and pointer hijacking. Data overwrite attacks can be mitigated by using partial read-only relocations, while pointer hijacking can be mitigated with full read-only relocations. Both approaches have some drawbacks. Partial read-only relocations don't provide full protection, because the external function GOT remains writable. Full read-only relocations require that all external function symbols are resolved at load-time instead of during execution. This may increase loading time for large programs.
Prevalence in PyPI community
21 packages
found in
Top 100
95 packages
found in
Top 1k
405 packages
found in
Top 10k
3.91k packages
in community
Next steps
In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).
If the executable load-time is an issue, you should use partial read-only relocations.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.
Prevalence in PyPI community
36 packages
found in
Top 100
209 packages
found in
Top 1k
1750 packages
found in
Top 10k
81.53k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Various network communication protocols allow including plaintext authentication credentials. Information such as user names and passwords could be passed through a non-encrypted channel, and therefore intercepted by malicious actors. Credentials are considered secrets, and should be kept encrypted until they are used. This policy control matches the following URI pattern protocol://username:password@domain within any software package component.
Prevalence in PyPI community
21 packages
found in
Top 100
86 packages
found in
Top 1k
378 packages
found in
Top 10k
7.36k packages
in community
Next steps
Review the reported matches. If the warning refers to a placeholder credential value, it can be safely ignored.