List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.
Prevalence in Visual Studio Code community
67 packages
found in
Top 100
548 packages
found in
Top 1k
3078 packages
found in
Top 10k
17.39k packages
in community
Next steps
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.
Prevalence in Visual Studio Code community
60 packages
found in
Top 100
453 packages
found in
Top 1k
2271 packages
found in
Top 10k
12.07k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.
Prevalence in Visual Studio Code community
68 packages
found in
Top 100
555 packages
found in
Top 1k
3086 packages
found in
Top 10k
17.47k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software components are typically distributed in standardized packaging formats. Software packages are built from instructions written within package manifests that act as blueprints for package assembly. A package manifest declares the most important software properties, such as the package name, its authors and license, external dependencies, and various actions that may occur during the package lifecycle. Package managers are specialized tools used by developers to manage software components. Package managers read these manifests to deploy software components along with their dependencies. The premise of the package management system is that software components are isolated from each other, and that they rely on the package manager to provide their dependencies. However, it was detected that a software component includes code capable of accessing or modifying directories that are maintained exclusively by package managers. This is unusual as it resembles tactics used by threat actors that tamper with installed software components and inject malicious code into trusted execution paths.
Prevalence in Visual Studio Code community
No prevalence information at this time
Next steps
Investigate reported detections as indicators of software tampering.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Bitcoin (BTC) is a digital currency that uses peer-to-peer technology to facilitate instant payments on the web. Bitcoin exchanges allow their customers to trade cryptocurrencies or digital currencies for other assets, such as conventional fiat money or other digital currencies. Financially motivated actors often include references to cryptocurrency exchanges in their code. Ransomware victims are instructed to visit Bitcoin exchanges to acquire the digital currency. Bitcoin is the most common payment method accepted by attackers in exchange for decrypting the user-generated data that is held for ransom. While presence of Bitcoin exchange service references does not imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider keeping track of Bitcoin exchange websites.
Prevalence in Visual Studio Code community
11 packages
found in
Top 100
82 packages
found in
Top 1k
289 packages
found in
Top 10k
1.01k packages
in community
Next steps
Investigate reported detections.
If the software should not include these network references, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider removing all references to flagged network locations.
Problem
Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.
Prevalence in Visual Studio Code community
79 packages
found in
Top 100
622 packages
found in
Top 1k
4233 packages
found in
Top 10k
29.36k packages
in community
Next steps
Investigate reported detections.
If the software should not include these network references, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider an alternative delivery mechanism for software packages.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.
Prevalence in Visual Studio Code community
25 packages
found in
Top 100
151 packages
found in
Top 1k
793 packages
found in
Top 10k
3.71k packages
in community
Next steps
Check the software component behaviors for anomalies.
Consider exploratory software component testing within a sandbox environment.
Consider replacing the software component with a more widely used alternative.
Avoid using this software package until it is vetted as safe.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Each of these components can have dozens, or even hundreds, of its own dependencies. When building applications, software developers download and install components from public repositories. For components to work properly, all of their dependencies also need to be installed. Some package repositories, like Node Package Manager (NPM), allow components to declare dependencies that are hosted remotely. Such dependencies are automatically downloaded from a specified location during software component installation. Since remotely hosted dependencies are not immutable, that enables a threat actor to change the dependency contents even after a component was published and vetted by security solutions. It is uncommon to find open source components that use remotely hosted dependencies residing outside the official project source code repository.
If the software component resolves dependencies from unusual locations, investigate the build and release environment for software supply chain compromise.
Consider vendoring the software component with all of its dependencies.
Avoid using this software package until it is vetted as safe.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Each of these components can have dozens or even hundreds of its own dependencies. When building applications, software developers download and install components from public repositories. For components to work properly, all of their dependencies also need to be installed. Some package repositories, like Node Package Manager (NPM), allow components to declare dependencies that are hosted remotely. Such dependencies are automatically downloaded from a specified location during software component installation. It was detected that a software component declares remote dependencies hosted outside commonly expected locations such as well-known code hosting platforms and official package registry content delivery networks. Threat actors often host malicious dependencies on attacker-controlled infrastructure, ephemeral file sharing services, or compromised legitimate sites to evade security review and retain control over the delivered content. It is uncommon to find open source components that resolve dependencies from such locations.
Consult Mitre ATT&CK documentation: T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools.
If the software component resolves dependencies from unusual locations, investigate the build and release environment for software supply chain compromise.
Consider vendoring the software component with all of its dependencies.
Avoid using this software package until it is vetted as safe.
Problem
Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.
Prevalence in Visual Studio Code community
34 packages
found in
Top 100
245 packages
found in
Top 1k
1626 packages
found in
Top 10k
8.95k packages
in community
Next steps
Confirm that the software package references a component or a dependency with a restrictive license.
Consider replacing the software component with an alternative that offers a license compatible with organization policy.