Spectra Assure

warningRisk: Secrets

Scanned:

Beyond Compare

Artifact:

latest

Top 10k

Launch Beyond Compare with comparisons of files, folders, clipboards, and git repositories

License: Permissive (MIT)

Published:

Publisher: ScooterSoftware

Visit GitHub

See on Visual Studio Code

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

1 debugging symbols found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

1 misconfigured toolchains detected

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

List of software quality issues with the number of affected components.

Policies

Info

Problem

Security Development Lifecycle (SDL) is a group of enhanced compile-time checks that report common coding mistakes as errors, preventing them from reaching production. These checks minimize the number of security issues by enforcing strict memory access checks. They also prevent the use of hard-to-secure string and memory manipulation functions. To prove the binary has been compiled with these checks enabled, the compiler emits a special debug object. Removing the debug table eliminates this proof. Therefore, this check only applies to binaries that still have their debug tables.

Prevalence in Visual Studio Code community

43 packages

found in

Top 100

257 packages

found in

Top 1k

754 packages

found in

Top 10k

3.7k packages

in community

Next steps

You should keep the debug table to prove that the SDL process has been followed.

To enable these checks, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable this feature by setting the compiler option /SDL to ON.

Problem

Program database (PDB) files are typically only used during software development. They contain private debug symbols that make it significantly easier to reverse engineer a closed source application. In some cases, having a program database file is equivalent to having access to the source code. Presence of program databases could indicate that one or more software components have been built using a debug profile, instead of the release.

Prevalence in Visual Studio Code community

8 packages

found in

Top 100

49 packages

found in

Top 1k

130 packages

found in

Top 10k

479 packages

in community

Next steps

Remove private debug database files from the software package before you release it.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign, some are commonly abused by malicious software with the intent to cause harm. When a software package shares behavior traits with malicious software, it may become flagged by security solutions. Any detection from security solutions can cause friction for the end-users during software deployment. While the behavior is likely intended by the developer, there is a small chance this detection is true positive, and an early indication of a software supply chain attack.

Prevalence in Visual Studio Code community

60 packages

found in

Top 100

434 packages

found in

Top 1k

2301 packages

found in

Top 10k

13.88k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Open source communities depend on the work of thousands of software developers that volunteer their time to maintain software components. Software developers build up their reputation by being transparent. The person behind the public-facing alias is just as important as the alias itself. Developers rarely opt to use anonymous email service accounts that hide the link between their alias and the person behind it. Software components published by anonymized developer accounts often relate to activities that are unsuited for enterprise consumption.

Prevalence in Visual Studio Code community

28 packages

found in

Top 100

217 packages

found in

Top 1k

1339 packages

found in

Top 10k

6.41k packages

in community

Next steps

Investigate reported detections.

You should consider delaying the software release until the investigation is completed, or until the issue is risk accepted.

Consider replacing the software component with an alternative.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in Visual Studio Code community

43 packages

found in

Top 100

257 packages

found in

Top 1k

754 packages

found in

Top 10k

3.7k packages

in community

Next steps

You should keep the debug table to prove that the SDL process has been followed.

To enable these checks, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable this feature by setting the compiler option /SDL to ON.

Problem

Prevalence in Visual Studio Code community

8 packages

found in

Top 100

49 packages

found in

Top 1k

130 packages

found in

Top 10k

479 packages

in community

Next steps

Remove private debug database files from the software package before you release it.

Problem

Prevalence in Visual Studio Code community

60 packages

found in

Top 100

434 packages

found in

Top 1k

2301 packages

found in

Top 10k

13.88k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Prevalence in Visual Studio Code community

28 packages

found in

Top 100

217 packages

found in

Top 1k

1339 packages

found in

Top 10k

6.41k packages

in community

Next steps

Investigate reported detections.

You should consider delaying the software release until the investigation is completed, or until the issue is risk accepted.

Consider replacing the software component with an alternative.

Beyond Compare

SAFE Assessment

Compliance

Security

Threats

SQ14138Detected Windows executable files that were compiled without following the recommended SDL process.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ34202Detected presence of private debug database files.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in Visual Studio Code community

Next steps

TH15103Detected presence of files with behaviors commonly used by malicious software.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH15405Detected presence of software components authored by developers with anonymous email service accounts.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

Did you know...

SQ14138Detected Windows executable files that were compiled without following the recommended SDL process.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ34202Detected presence of private debug database files.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in Visual Studio Code community

Next steps

TH15103Detected presence of files with behaviors commonly used by malicious software.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH15405Detected presence of software components authored by developers with anonymous email service accounts.hunting

Problem

Prevalence in Visual Studio Code community

Next steps