TH15401
Detected presence of software components authored by known threat actors.
| priority | CI/CD status | severity | effort | SAFE level | SAFE assessment |
|---|---|---|---|---|---|
 | fail | high | high | 1 | tampering: fail Reason: malicious author components |
About the issue
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. Open source communities use code repositories to facilitate project discovery and simplify software deployment. However, anyone with an email account can join a community and start publishing code to public repositories. Vetting users before they join a community is usually not done by repository maintainers. That makes public repositories popular among threat actors. Detected software component was authored by an email address, or an identity, that is known to publish malicious code in public repositories.
How to resolve the issue
- Investigate reported detections.
- Investigate your build and release environment for software supply chain compromise.
- You should delay the software release until the investigation is completed.
- Consider replacing the software component with an alternative.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.
This section is updated when new data becomes available.
Total amount of packages analyzed
- RubyGems: 183K
- Nuget: 644K
- PyPi: 628K
- NPM: 3.72M
Recommended reading
- Threat actor (External resource - Wikipedia)
- Groups (External resource - MITRE ATT&CK)