Skip to main content

TH16127

Detected presence of software components that have code outside of the common screen width.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
passlowhighNoneNone

About the issue​

Diligent software developers audit the source code of a component before it gets included in the software project. This audit often includes reviewing key pieces of code hosted in a public source repository. Aiming to avoid detection through spot-checks, attackers often hide malicious payloads by placing the code outside the common screen width. Depending on how the code editor used for review is configured, the malicious code might never be shown to the developer during the audit. Since many programming languages allow multiple statements to be made in the same line of code, both visible and off-screen code will be executed. While presence of code outside the common screen width does not imply malicious intent, all of its uses in a software package should be documented and approved. When a software package has behavior traits similar to malicious software, it may become flagged by security solutions.

How to resolve the issue​

  • Investigate reported detections as indicators of software tampering.
  • Consult Mitre ATT&CK documentation: T1027 - Obfuscated Files or Information.
  • Consider rewriting the flagged code without using the marked behaviors.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

This section is updated when new data becomes available.

Total amount of packages analyzed

  • RubyGems: 183K
  • Nuget: 644K
  • PyPi: 628K
  • NPM: 3.72M
Statistics are not collected for the TH16127 policy at this time, or not applicable to this type of issue.