Skip to main content

SQ30206

Detected presence of software components with suspicious dependencies.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
passmediumhighNonemalware: warning
Reason: suspicious dependencies found

About the issueโ€‹

Proprietary ReversingLabs malware detection algorithms have determined that the software package has one or more suspicious dependencies. Some software dependencies may be optional, and could be installed or downloaded only if a certain pre-defined condition is met. When software dependencies are confirmed to be found within the software package, additional issues might also be reported. The detection was made by either a static byte signature, software component identity, or a complete file hash. This malware detection method is considered predictive, and can typically identify the malware family by name.

How to resolve the issueโ€‹

  • Suspicious detections are a lower confidence detection, so you should first review them for malicious intent.
  • If the software intent does not relate to malicious behavior, investigate the build and release environment for software supply chain compromise.
  • Proceed with increased caution when using this software package.

Incidence statisticsโ€‹

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

This section is updated when new data becomes available.

Total amount of packages analyzed

  • RubyGems: 183K
  • Nuget: 644K
  • PyPi: 628K
  • NPM: 3.72M
Statistics are not collected for the SQ30206 policy at this time, or not applicable to this type of issue.