Spectra Assure

failRisk: Vulnerabilities

Scanned:

C/C++ Advanced Lint

Artifact:

Top 1k

An advanced, modern, static analysis extension for C/C++ that supports a number of back-end analyzer programs.

License: unknown

Published:

Publisher: jbenden

Visit Github

See on Visual Studio Code

SAFE Assessment

Compliance

Licenses

1 software distribution restrictions

Secrets

No sensitive information found

Security

Vulnerabilities

20 severe vulnerabilities exploited

Hardening

No application hardening issues

Threats

Tampering

3 components with malware history

Malware

No evidence of malware inclusion

List of software quality issues with the number of affected components.

Policies

Info

Count

Problem

Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.

Prevalence in Visual Studio Code community

71 packages

found in

Top 100

568 packages

found in

Top 1k

3198 packages

found in

Top 10k

16595 packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

SQ31104

Detected presence of critical severity vulnerabilities.

Causes risk: critical severity vulnerabilities

vulnerabilities

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.

Prevalence in Visual Studio Code community

64 packages

found in

Top 100

445 packages

found in

Top 1k

2064 packages

found in

Top 10k

9214 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

SQ31105

Detected presence of high severity vulnerabilities.

Causes risk: high severity vulnerabilities

vulnerabilities

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in Visual Studio Code community

72 packages

found in

Top 100

583 packages

found in

Top 1k

3344 packages

found in

Top 10k

17282 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

TH17107

Detected presence of files containing URLs related to Bitcoin exchange services.

hunting

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Bitcoin (BTC) is a digital currency that uses peer-to-peer technology to facilitate instant payments on the web. Bitcoin exchanges allow their customers to trade cryptocurrencies or digital currencies for other assets, such as conventional fiat money or other digital currencies. Financially motivated actors often include references to cryptocurrency exchanges in their code. Ransomware victims are instructed to visit Bitcoin exchanges to acquire the digital currency. Bitcoin is the most common payment method accepted by attackers in exchange for decrypting the user-generated data that is held for ransom. While presence of Bitcoin exchange service references does not imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider keeping track of Bitcoin exchange websites.

Prevalence in Visual Studio Code community

11 packages

found in

Top 100

84 packages

found in

Top 1k

280 packages

found in

Top 10k

976 packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider removing all references to flagged network locations.

TH17127

Detected presence of files containing URLs that link to raw files on GitHub.

hunting

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing services URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverages the GitHub service to deliver malicious payloads.

Prevalence in Visual Studio Code community

78 packages

found in

Top 100

618 packages

found in

Top 1k

4203 packages

found in

Top 10k

27868 packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

TH30101

Detected presence of software components that had a recent malware or tampering incident.

Causes risk: components with malware history

hunting

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. Some open source projects have a history of security lapses that culminated with a publication of one or more malicious component versions. To ensure that repeated supply chain incidents do not occur, the open source project should be closely monitored for up to two years. All software package versions that are published within two years of the malware incident will convey a warning about the history of security incidents tied to the open source project.

Prevalence in Visual Studio Code community

24 packages

found in

Top 100

102 packages

found in

Top 1k

326 packages

found in

Top 10k

1057 packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.

Avoid using this software package until it is vetted as safe.

TH30106

Detected presence of software components that have low popularity or number of downloads.

hunting

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in Visual Studio Code community

12 packages

found in

Top 100

62 packages

found in

Top 1k

231 packages

found in

Top 10k

638 packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

SQ12405

Detected presence of licenses that place restrictions on software distribution.

Causes risk: software distribution restrictions

licenses

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.

Prevalence in Visual Studio Code community

28 packages

found in

Top 100

205 packages

found in

Top 1k

1199 packages

found in

Top 10k

6212 packages

in community

Next steps

Confirm that the software package references a component or a dependency with a restrictive license.

Consider replacing the software component with an alternative that offers a license compatible with organization policy.

SQ25103

Detected packages with content that could only be partially analyzed.

integrity

Problem

Proprietary ReversingLabs analysis engine supports a wide range of commonly used archive and software packaging formats. Using automated static file decomposition technologies, the engine recursively analyzes complex software packages. Software analysis is typically conducted in multiple steps. Content identification, unpacking, validation, and classification are some of the steps performed on each analyzed file. The analysis engine may sometimes report file integrity problems while performing unpacking or validation steps. Some content was successfully extracted from the package before an analysis error was encountered. This issue is commonly reported for packages with content that may be incomplete or corrupted. In rare occurrences this issue may indicate a problem with the analysis engine's file format parsing functions.

Prevalence in Visual Studio Code community

19 packages

found in

Top 100

70 packages

found in

Top 1k

214 packages

found in

Top 10k

737 packages

in community

Next steps

Confirm that the software package contains incomplete or corrupted content.

Create a new version of the software package that resolves content integrity issues.

Contact the ReversingLabs support team if you suspect that the analysis engine may be causing the issue.

SQ31106

Detected presence of medium severity vulnerabilities.

Causes risk: medium severity vulnerabilities

vulnerabilities

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in Visual Studio Code community

70 packages

found in

Top 100

531 packages

found in

Top 1k

3115 packages

found in

Top 10k

16606 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

List of software quality issues with the number of affected components.

Policies

Info

Count

Problem

Prevalence in Visual Studio Code community

71 packages

found in

Top 100

568 packages

found in

Top 1k

3198 packages

found in

Top 10k

16595 packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

SQ31104

Detected presence of critical severity vulnerabilities.

Causes risk: critical severity vulnerabilities

vulnerabilities

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.

Prevalence in Visual Studio Code community

64 packages

found in

Top 100

445 packages

found in

Top 1k

2064 packages

found in

Top 10k

9214 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

SQ31105

Detected presence of high severity vulnerabilities.

Causes risk: high severity vulnerabilities

vulnerabilities

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in Visual Studio Code community

72 packages

found in

Top 100

583 packages

found in

Top 1k

3344 packages

found in

Top 10k

17282 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

TH17107

Detected presence of files containing URLs related to Bitcoin exchange services.

hunting

Problem

Prevalence in Visual Studio Code community

11 packages

found in

Top 100

84 packages

found in

Top 1k

280 packages

found in

Top 10k

976 packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider removing all references to flagged network locations.

TH17127

Detected presence of files containing URLs that link to raw files on GitHub.

hunting

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing services URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverages the GitHub service to deliver malicious payloads.

Prevalence in Visual Studio Code community

78 packages

found in

Top 100

618 packages

found in

Top 1k

4203 packages

found in

Top 10k

27868 packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

TH30101

Detected presence of software components that had a recent malware or tampering incident.

Causes risk: components with malware history

hunting

Problem

Prevalence in Visual Studio Code community

24 packages

found in

Top 100

102 packages

found in

Top 1k

326 packages

found in

Top 10k

1057 packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.

Avoid using this software package until it is vetted as safe.

TH30106

Detected presence of software components that have low popularity or number of downloads.

hunting

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in Visual Studio Code community

12 packages

found in

Top 100

62 packages

found in

Top 1k

231 packages

found in

Top 10k

638 packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

SQ12405

Detected presence of licenses that place restrictions on software distribution.

Causes risk: software distribution restrictions

licenses

Problem

Prevalence in Visual Studio Code community

28 packages

found in

Top 100

205 packages

found in

Top 1k

1199 packages

found in

Top 10k

6212 packages

in community

Next steps

Confirm that the software package references a component or a dependency with a restrictive license.

Consider replacing the software component with an alternative that offers a license compatible with organization policy.

SQ25103

Detected packages with content that could only be partially analyzed.

integrity

Problem

Prevalence in Visual Studio Code community

19 packages

found in

Top 100

70 packages

found in

Top 1k

214 packages

found in

Top 10k

737 packages

in community

Next steps

Confirm that the software package contains incomplete or corrupted content.

Create a new version of the software package that resolves content integrity issues.

Contact the ReversingLabs support team if you suspect that the analysis engine may be causing the issue.

SQ31106

Detected presence of medium severity vulnerabilities.

Causes risk: medium severity vulnerabilities

vulnerabilities

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in Visual Studio Code community

70 packages

found in

Top 100

531 packages

found in

Top 1k

3115 packages

found in

Top 10k

16606 packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.