TH15404
Detected presence of software components authored by developers with disposable email service accounts.
| priority | CI/CD status | severity | effort | SAFE level | SAFE assessment |
|---|---|---|---|---|---|
 | pass | medium | high | None | None |
About the issue
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Open source communities depend on the work of thousands of software developers that volunteer their time to maintain software components. Software developers build up their reputation by being transparent. The person behind the public-facing alias is just as important as the alias itself. Developers rarely opt to use short-lived email service accounts that hide the link between their alias and the person behind it. Software components published by anonymized developer accounts often relate to activities that are unsuited for enterprise consumption.
How to resolve the issue
- Investigate reported detections.
- You should consider delaying the software release until the investigation is completed, or until the issue is risk accepted.
- Consider replacing the software component with an alternative.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.
This section is updated when new data becomes available.
Total amount of packages analyzed
- RubyGems: 183K
- Nuget: 644K
- PyPi: 628K
- NPM: 3.72M
Recommended reading
- Disposable email address (External resource - Wikipedia)