Spectra Assure

failRisk: Vulnerabilities

Scanned:

GitHub Copilot

Artifact:

key project

Top 10

Your AI pair programmer

License: unknown

Published:

Publisher: GitHub

See on Visual Studio Code

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

2 debugging symbols found

Security

Vulnerabilities

1 severe vulnerabilities exploited

Hardening

1 reduced effectiveness mitigations

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues23 vulnerabilities3 malware0 behaviors263 dependencies41 contributors1 versions1264

List of software quality issues with the number of affected components.

Policies

Info

Problem

Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.

Prevalence in Visual Studio Code community

67 packages

found in

Top 100

548 packages

found in

Top 1k

3078 packages

found in

Top 10k

17.39k packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Digital signatures are applied to applications, packages and documents as a cryptographically secured authenticity record. Signatures are made using digital certificates, which can either be purchased from certificate authorities or be self-issued. When purchased from a certificate authority, a certificate must conform to industry standards and best practices. One such requirement is that a certificate authority must be able revoke a certificate if its misuse was reported and independently confirmed. Software users rely on the certificate revocation process to defend from malicious actors that might be controlling a certificate issued to a trusted publisher. Operating systems periodically refresh local copies of certificate revocation lists. If the signature does not include a hyperlink to the certificate revocation server, its status cannot be checked. While a commercial certificate authority is unlikely to omit this information, some policy deviations can occur in practice.

Prevalence in Visual Studio Code community

6 packages

found in

Top 100

20 packages

found in

Top 1k

34 packages

found in

Top 10k

110 packages

in community

Next steps

Communicate the detected issue to your certificate issuer, and have a new certificate created to resolve it.

Use your newly issued certificate to re-sign the software component.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in Visual Studio Code community

68 packages

found in

Top 100

555 packages

found in

Top 1k

3086 packages

found in

Top 10k

17.47k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software components are typically distributed in standardized packaging formats. Software packages are built from instructions written within package manifests that act as blueprints for package assembly. A package manifest declares the most important software properties, such as the package name, its authors and license, external dependencies, and various actions that may occur during the package lifecycle. Package managers are specialized tools used by developers to manage software components. Package managers read these manifests to deploy software components along with their dependencies. The premise of the package management system is that software components are isolated from each other, and that they rely on the package manager to provide their dependencies. However, it was detected that a software component includes code capable of accessing or modifying directories that are maintained exclusively by package managers. This is unusual as it resembles tactics used by threat actors that tamper with installed software components and inject malicious code into trusted execution paths.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1554 - Compromise Host Software Binary.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software components sometimes need to interact with sensitive parts of the runtime environment, often requiring privileged access to accomplish a task. Build pipeline configuration includes high-value information such as CI/CD platform secrets and tokens, pipeline definition files and runner configuration, build-time environment variables containing signing keys or deploy credentials, and artifact registry and package publishing credentials. That information is used by continuous integration and delivery systems. Attackers often abuse access to build pipeline configuration to harvest secrets from build environments, which can later be exfiltrated to attacker-controlled infrastructure and used to tamper with software releases or publish malicious artifacts under trusted identities. While the presence of code that accesses build pipeline configuration does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select software components should consider using functions that read build pipeline configuration. One example of acceptable use for such functions is release tooling that reads publishing credentials to push artifacts.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1072 - Software Deployment Tools.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.

Prevalence in Visual Studio Code community

79 packages

found in

Top 100

622 packages

found in

Top 1k

4233 packages

found in

Top 10k

29.36k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Each of these components can have dozens or even hundreds of its own dependencies. When building applications, software developers download and install components from public repositories. For components to work properly, all of their dependencies also need to be installed. Some package repositories, like Node Package Manager (NPM), allow components to declare dependencies that are hosted remotely. Such dependencies are automatically downloaded from a specified location during software component installation. It was detected that a software component declares remote dependencies hosted outside commonly expected locations such as well-known code hosting platforms and official package registry content delivery networks. Threat actors often host malicious dependencies on attacker-controlled infrastructure, ephemeral file sharing services, or compromised legitimate sites to evade security review and retain control over the delivered content. It is uncommon to find open source components that resolve dependencies from such locations.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Review software component remote dependency locations.

Consult Mitre ATT&CK documentation: T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools.

If the software component resolves dependencies from unusual locations, investigate the build and release environment for software supply chain compromise.

Consider vendoring the software component with all of its dependencies.

Avoid using this software package until it is vetted as safe.

Problem

Security Development Lifecycle (SDL) is a group of enhanced compile-time checks that report common coding mistakes as errors, preventing them from reaching production. These checks minimize the number of security issues by enforcing strict memory access checks. They also prevent the use of hard-to-secure string and memory manipulation functions. To prove the binary has been compiled with these checks enabled, the compiler emits a special debug object. Removing the debug table eliminates this proof. Therefore, this check only applies to binaries that still have their debug tables.

Prevalence in Visual Studio Code community

43 packages

found in

Top 100

257 packages

found in

Top 1k

754 packages

found in

Top 10k

3.7k packages

in community

Next steps

You should keep the debug table to prove that the SDL process has been followed.

To enable these checks, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable this feature by setting the compiler option /SDL to ON.

Problem

Buffer overrun protection on Linux is achieved in two ways. The most common solution is to use the stack canary (also called cookie). The stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. In most cases, compilers will apply the stack canary conservatively in order to avoid a negative performance impact. Therefore, stack canaries are often used together with another stack overrun mitigation - fortified functions. Fortified functions are usually wrappers around standard glibc functions (such as memcpy) which perform boundary checks either at compile time or run time to determine if a memory violation has occurred. The compiler needs additional context to generate such calls (for example, array size that needs to be known at compile time). Because of this, the compiler will virtually never substitute all viable functions with their fortified counterparts in complex programs. However, when combined with the stack canary, fortified functions provide a good measure of buffer overrun protection.

Prevalence in Visual Studio Code community

31 packages

found in

Top 100

180 packages

found in

Top 1k

449 packages

found in

Top 10k

1.78k packages

in community

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Visual Studio Code community

26 packages

found in

Top 100

153 packages

found in

Top 1k

262 packages

found in

Top 10k

950 packages

in community

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in Visual Studio Code community

67 packages

found in

Top 100

548 packages

found in

Top 1k

3078 packages

found in

Top 10k

17.39k packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in Visual Studio Code community

6 packages

found in

Top 100

20 packages

found in

Top 1k

34 packages

found in

Top 10k

110 packages

in community

Next steps

Communicate the detected issue to your certificate issuer, and have a new certificate created to resolve it.

Use your newly issued certificate to re-sign the software component.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in Visual Studio Code community

68 packages

found in

Top 100

555 packages

found in

Top 1k

3086 packages

found in

Top 10k

17.47k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1554 - Compromise Host Software Binary.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1072 - Software Deployment Tools.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Prevalence in Visual Studio Code community

79 packages

found in

Top 100

622 packages

found in

Top 1k

4233 packages

found in

Top 10k

29.36k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Review software component remote dependency locations.

Consult Mitre ATT&CK documentation: T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools.

If the software component resolves dependencies from unusual locations, investigate the build and release environment for software supply chain compromise.

Consider vendoring the software component with all of its dependencies.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in Visual Studio Code community

43 packages

found in

Top 100

257 packages

found in

Top 1k

754 packages

found in

Top 10k

3.7k packages

in community

Next steps

You should keep the debug table to prove that the SDL process has been followed.

To enable these checks, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable this feature by setting the compiler option /SDL to ON.

Problem

Prevalence in Visual Studio Code community

31 packages

found in

Top 100

180 packages

found in

Top 1k

449 packages

found in

Top 10k

1.78k packages

in community

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Visual Studio Code community

26 packages

found in

Top 100

153 packages

found in

Top 1k

262 packages

found in

Top 10k

950 packages

in community

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

GitHub Copilot

SAFE Assessment

Compliance

Security

Threats

SQ31102Detected presence of severe vulnerabilities with active exploitation.Causes risk: actively exploited vulnerabilitiesvulnerabilities

Problem

Prevalence in Visual Studio Code community

Next steps

SQ20128Detected digital signatures that do not contain a reference to a certificate revocation server.signatures

Problem

Prevalence in Visual Studio Code community

Next steps

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in Visual Studio Code community

Next steps

TH16129Detected presence of software components that can tamper with other installed software.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16131Detected presence of software components that can access sensitive build pipeline configuration.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH30114Detected presence of software components with uncommon remote dependency hosts.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14138Detected Windows executable files that were compiled without following the recommended SDL process.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Visual Studio Code community

Next steps

Did you know...

SQ31102Detected presence of severe vulnerabilities with active exploitation.Causes risk: actively exploited vulnerabilitiesvulnerabilities

Problem

Prevalence in Visual Studio Code community

Next steps

SQ20128Detected digital signatures that do not contain a reference to a certificate revocation server.signatures

Problem

Prevalence in Visual Studio Code community

Next steps

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in Visual Studio Code community

Next steps

TH16129Detected presence of software components that can tamper with other installed software.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16131Detected presence of software components that can access sensitive build pipeline configuration.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH30114Detected presence of software components with uncommon remote dependency hosts.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14138Detected Windows executable files that were compiled without following the recommended SDL process.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem