Spectra Assure

failIncident: Malware

Scanned:

Azure Container Apps

Artifact:

latest

malicious

Top 1k

An Azure Container Apps extension for Visual Studio Code.

License: unknown

Published:

Publisher: ms-azuretools

Visit GitHub

See on Visual Studio Code

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

1 web service credentials found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

1 components with malware history

Malware

1 malicious dependencies found

INCIDENTS FOR THIS VERSION:

malware

Reported By: ReversingLabs (Automated)

Learn more about malware detection

List of software quality issues with the number of affected components.

Policies

Info

Problem

Proprietary ReversingLabs malware detection algorithms have determined that the software package has one or more malicious dependencies. Some software dependencies may be optional, and could be installed or downloaded only if a certain pre-defined condition is met. When software dependencies are confirmed to be found within the software package, additional issues might also be reported. The detection was made by either a static byte signature, software component identity, or a complete file hash. This malware detection method is considered highly accurate, and can typically attribute malware to previously discovered software supply chain attacks.

Prevalence in Visual Studio Code community

2 packages

found in

Top 100

14 packages

found in

Top 1k

70 packages

found in

Top 10k

219 packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure they are well-documented.

Avoid using this software package until it is vetted as safe.

Problem

Software as a Service (SaaS) platforms expose programmable interfaces to their authenticated users. These web services enable action automation and secure exchange of information. For authorization, web service users provide a unique token that confirms their access rights. These tokens are considered secrets. They should never be included in a software release package, even if they are obfuscated by encryption on the client-side.

Prevalence in Visual Studio Code community

3 packages

found in

Top 100

34 packages

found in

Top 1k

71 packages

found in

Top 10k

457 packages

in community

Next steps

You should securely store web service access tokens, and fully automate their management and periodic rotation.

If tokens were published unintentionally and the software has been made public, you should revoke exposed tokens and file a security incident.

Examples of service tokens that may have been detected include AWS, Facebook, JWT, SWT, Slack and others.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. Some open source projects have a history of security lapses that culminated with a publication of one or more malicious component versions. To ensure that repeated supply chain incidents do not occur, the open source project should be closely monitored for up to two years. All software package versions that are published within two years of the malware incident will convey a warning about the history of security incidents tied to the open source project.

Prevalence in Visual Studio Code community

25 packages

found in

Top 100

112 packages

found in

Top 1k

510 packages

found in

Top 10k

2.06k packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.

Avoid using this software package until it is vetted as safe.

Problem

Various network communication protocols allow including plaintext authentication credentials. Information such as user names and passwords could be passed through a non-encrypted channel, and therefore intercepted by malicious actors. Credentials are considered secrets, and should be kept encrypted until they are used. This policy control matches the following URI pattern protocol://username:password@domain within any software package component.

Prevalence in Visual Studio Code community

14 packages

found in

Top 100

112 packages

found in

Top 1k

273 packages

found in

Top 10k

1.71k packages

in community

Next steps

Review the reported matches. If the warning refers to a placeholder credential value, it can be safely ignored.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign on their own, some might become important for analysis when observed alongside other capabilities the component exhibits. This issue is reported for files that can enumerate user information and make HTTP requests. While presence of this behavior combination does not imply malicious intent, it is advised that the reported files are reviewed. One example of acceptable use for this type of data collection is the opt-in telemetry for software debugging purposes.

Prevalence in Visual Studio Code community

28 packages

found in

Top 100

137 packages

found in

Top 1k

348 packages

found in

Top 10k

1.67k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

Consider limiting the collection of user information to a minimum.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. A port number is associated with a network address of a host, such as an IP address, and the type of network protocol used for communication. Within URLs, the ports are optional. Ports can be specified in a URL immediately following the domain name. Each network protocol, or schema, has a set of standard ports on which the service operates. This issue is raised when a mismatch between a network protocol and its expected port number is detected. While the presence of non-standard ports does not imply malicious intent, all of their uses in a software package should be documented and approved.

Prevalence in Visual Studio Code community

79 packages

found in

Top 100

560 packages

found in

Top 1k

2912 packages

found in

Top 10k

17.75k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the port to one that is standard for the networking protocol.

Problem

Operating systems allow multiple user accounts to coexist on a single computer system. Each registered user has identity information associated with their account. At the very least, user accounts consist of a user name and an optional password. In some cases, user account data may also include personally identifiable information. Extended personal information may include user's given and last name, their email and mailing address, personal photo and their telephone number. Financially motivated attackers may seek to collect personal information for purposes of selling the private data to a third-party. Malicious code that typically exhibits these behavior traits is commonly referred to as an information stealer. While the presence of code that accesses identity information does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Accessing identity information is a very common behavior for software packages. One example of acceptable use for such functions is verifying that the active user has purchased a software license that allows them to run the application.

Prevalence in Visual Studio Code community

65 packages

found in

Top 100

419 packages

found in

Top 1k

1961 packages

found in

Top 10k

9.65k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in Visual Studio Code community

2 packages

found in

Top 100

14 packages

found in

Top 1k

70 packages

found in

Top 10k

219 packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure they are well-documented.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in Visual Studio Code community

3 packages

found in

Top 100

34 packages

found in

Top 1k

71 packages

found in

Top 10k

457 packages

in community

Next steps

You should securely store web service access tokens, and fully automate their management and periodic rotation.

If tokens were published unintentionally and the software has been made public, you should revoke exposed tokens and file a security incident.

Examples of service tokens that may have been detected include AWS, Facebook, JWT, SWT, Slack and others.

Problem

Prevalence in Visual Studio Code community

25 packages

found in

Top 100

112 packages

found in

Top 1k

510 packages

found in

Top 10k

2.06k packages

in community

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in Visual Studio Code community

14 packages

found in

Top 100

112 packages

found in

Top 1k

273 packages

found in

Top 10k

1.71k packages

in community

Next steps

Review the reported matches. If the warning refers to a placeholder credential value, it can be safely ignored.

Problem

Prevalence in Visual Studio Code community

28 packages

found in

Top 100

137 packages

found in

Top 1k

348 packages

found in

Top 10k

1.67k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

Consider limiting the collection of user information to a minimum.

Problem

Prevalence in Visual Studio Code community

79 packages

found in

Top 100

560 packages

found in

Top 1k

2912 packages

found in

Top 10k

17.75k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the port to one that is standard for the networking protocol.

Problem

Prevalence in Visual Studio Code community

65 packages

found in

Top 100

419 packages

found in

Top 1k

1961 packages

found in

Top 10k

9.65k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

Azure Container Apps

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: 14 days agoVersion: 0.11.0

INCIDENTS FOR THIS VERSION:

SQ30205Detected presence of software components with malicious dependencies.Causes risk: malicious dependencies foundthreats

Problem

Prevalence in Visual Studio Code community

Next steps

SQ34304Detected presence of web service access tokens.Causes risk: web service credentials foundsecrets

Problem

Prevalence in Visual Studio Code community

Next steps

TH30101Detected presence of software components that had a recent malware or tampering incident.Causes risk: components with malware historyhunting

Problem

Prevalence in Visual Studio Code community

Next steps

SQ34302Detected presence of plaintext credentials within network protocol strings.Causes risk: web service credentials foundsecrets

Problem

Prevalence in Visual Studio Code community

Next steps

TH16106Detected presence of files that collect and exfiltrate user information.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH17115Detected presence of files containing URLs that use non-standard ports.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16126Detected presence of software components that can access user identity information.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

Did you know...

SQ30205Detected presence of software components with malicious dependencies.Causes risk: malicious dependencies foundthreats

Problem

Prevalence in Visual Studio Code community

Next steps

SQ34304Detected presence of web service access tokens.Causes risk: web service credentials foundsecrets

Problem

Prevalence in Visual Studio Code community

Next steps

TH30101Detected presence of software components that had a recent malware or tampering incident.Causes risk: components with malware historyhunting

Problem

Prevalence in Visual Studio Code community

Next steps

SQ34302Detected presence of plaintext credentials within network protocol strings.Causes risk: web service credentials foundsecrets

Problem

Prevalence in Visual Studio Code community

Next steps

TH16106Detected presence of files that collect and exfiltrate user information.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH17115Detected presence of files containing URLs that use non-standard ports.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16126Detected presence of software components that can access user identity information.hunting

Problem

Prevalence in Visual Studio Code community

Next steps