SQ30206
Detected presence of software components with suspicious dependencies.
| priority | CI/CD status | severity | effort | SAFE level | SAFE assessment |
|---|---|---|---|---|---|
 | pass | medium | high | None | malware: warning Reason: suspicious dependencies found |
About the issue
Proprietary ReversingLabs malware detection algorithms have determined that the software package has one or more suspicious dependencies. Some software dependencies may be optional, and could be installed or downloaded only if a certain pre-defined condition is met. When software dependencies are confirmed to be found within the software package, additional issues might also be reported. The detection was made by either a static byte signature, software component identity, or a complete file hash. This malware detection method is considered predictive, and can typically identify the malware family by name.
How to resolve the issue
- Suspicious detections are a lower confidence detection, so you should first review them for malicious intent.
- If the software intent does not relate to malicious behavior, investigate the build and release environment for software supply chain compromise.
- Proceed with increased caution when using this software package.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.
This section is updated when new data becomes available.
Total amount of packages analyzed
- RubyGems: 183K
- Nuget: 644K
- PyPi: 628K
- NPM: 3.72M
Recommended reading
- Threat detection in Spectra Assure
- Dependency management - Software supply chain security (External resource - Google Cloud)