Skip to main content

SQ30252

Detected presence of software components developed using malicious dependencies.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
failhighhigh1malware: fail
Reason: malicious develop dependencies

About the issue​

Proprietary ReversingLabs malware detection algorithms have determined that the software package has one or more malicious development dependencies. Development dependencies may be optional, and could be installed or downloaded only if a certain pre-defined condition is met. Development dependencies are used by software developers during application production. Presence of malicious development dependencies could be an indication of a software build pipeline compromise. When software dependencies are confirmed to be found within the software package, additional issues might also be reported. The detection was made by either a static byte signature, software component identity, or a complete file hash. This malware detection method is considered highly accurate, and can typically attribute malware to previously discovered software supply chain attacks.

How to resolve the issue​

  • Inspect behaviors exhibited by the detected software components.
  • If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.
  • Revise the use of components that raise these alarms. If you can't deprecate those components, make sure they are well-documented.
  • Avoid using this software package until it is vetted as safe.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

This section is updated when new data becomes available.

Total amount of packages analyzed

  • RubyGems: 203K
  • Nuget: 735K
  • PyPi: 838K
  • NPM: 5.12M
  • VS Code: 113K
  • PS Gallery: 17K
Statistics are not collected for the SQ30252 policy at this time, or not applicable to this type of issue.