TH16506
Detected presence of package manifests that hijack common development tools.
| priority | CI/CD status | severity | effort | SAFE level | SAFE assessment |
|---|---|---|---|---|---|
 | fail | high | high | 1 | tampering: fail Reason: dangerous package manifests |
About the issue
Many popular programming languages use standardized software packaging formats to distribute reusable code components. Software packages are built from instructions written within package manifests that act as blueprints for package assembly. A package manifest declares the most important software properties, such as the package name, its authors and license, list of external dependencies, and various actions that may occur during the package lifecycle. Package manifests allow developers to register their own commands with the operating system. This package manager feature allows developers to simplify application consumption, making it easy to integrate software packages into development workflows. However, it was detected that the software package might abuse this feature to hijack common development tools. Attackers often hijack development commands to ensure that their malicious application gets executed before the intended one. This allows the attackers to modify application runtime parameters, or to collect sensitive information that gets passed to trusted applications.
How to resolve the issue
- Investigate reported detections as indicators of software tampering.
- Consider rewriting the package manifest without overriding development tool commands.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.
This section is updated when new data becomes available.
Total amount of packages analyzed
- RubyGems: 183K
- Nuget: 644K
- PyPi: 628K
- NPM: 3.72M