SQ30120
Detected presence of software components with political protest messages.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | fail | medium | high | 2 | malware: fail Reason: protestware components found |
About the issue
Authors of open source software may decide to use their projects to spread political messages. Running software packages that include protestware code may trigger protest-related functions when executed in the targeted environments or geographies. Protest-motivated code is commonly implemented as a simple display of harmless messages that call for peace. However, over time protestware may evolve to include code that performs excessive logging, issues denial of service, or even deletes user files. Software packages that contain protestware code are considered to be potentially unwanted applications. When political activism escalates to inclusion of destructive code, additional malware detection policies trigger to flag malicious intent.
How to resolve the issue
- Inspect behaviors exibited by the detected software components.
- If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.
- Revise the use of components that raise these alarms. If you can't deprecate those components, make sure they are well-documented.
- Avoid using this software package until it is vetted as safe.
Recommended reading
- Protestware threats: How to protect your software supply chain (External resource - Gitlab)
- Protestware list (External resource - GitHub)
- The Fragile Open Source Ecosystem Isn’t Ready for ‘Protestware’ (External resource - Wired)