SQ30253

Detected presence of software components developed using suspicious dependencies.

priority	CI/CD status	severity	effort	SAFE level	SAFE assessment
	pass	medium	high	None	malware: warning Reason: suspicious develop dependencies

About the issue

Proprietary ReversingLabs malware detection algorithms have determined that the software package has one or more suspicious development dependencies. Development dependencies may be optional, and could be installed or downloaded only if a certain pre-defined condition is met. Development dependencies are used by software developers during application production. Presence of suspicious development dependencies could be an indication of a software build pipeline compromise. When software dependencies are confirmed to be found within the software package, additional issues might also be reported. The detection was made by either a static byte signature, software component identity, or a complete file hash. This malware detection method is considered predictive, and can typically identify the malware family by name.

How to resolve the issue

• Suspicious detections are a lower confidence detection, so you should first review them for malicious intent.

• If the software intent does not relate to malicious behavior, investigate the build and release environment for software supply chain compromise.

• Proceed with increased caution when using this software package.

Incidence statistics

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

This section is updated when new data becomes available.

Total amount of packages analyzed

• RubyGems: 203K
• Nuget: 735K
• PyPi: 838K
• NPM: 5.12M
• VS Code: 113K
• PS Gallery: 17K

Statistics are not collected for the SQ30253 policy at this time, or not applicable to this type of issue.

Recommended reading

• Defending software build pipelines from malicious attack (External resource - National Cyber Security Centre)

• Compromising the Code: Inside CI/CD Pipeline Attacks (External resource - Medium)