Skip to main content

SQ25104

Detected packages with content that failed integrity validation checks.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
failhighmedium4tampering: fail
Reason: checksum validation errors

About the issue​

Proprietary ReversingLabs analysis engine supports a wide range of commonly used archive and software packaging formats. Using automated static file decomposition technologies, the engine recursively analyzes complex software packages. Software analysis is typically conducted in multiple steps. Content identification, unpacking, validation, and classification are some of the steps performed on each analyzed file. The analysis engine may sometimes report file integrity problems while performing unpacking or validation steps. Failed integrity validation checks indicate that the content cannot be verified using its embedded checksums. This issue is commonly reported for packages with content that may be incomplete or corrupted. In rare occurrences this issue may indicate a problem with the analysis engine's file format parsing functions.

How to resolve the issue​

  • Confirm that the software package contains incomplete or corrupted content.
  • Create a new version of the software package that resolves content integrity issues.
  • Contact the ReversingLabs support team if you suspect that the analysis engine may be causing the issue.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

This section is updated when new data becomes available.

Total amount of packages analyzed

  • RubyGems: 183K
  • Nuget: 644K
  • PyPi: 628K
  • NPM: 3.72M
Statistics are not collected for the SQ25104 policy at this time, or not applicable to this type of issue.