Author risk issues

Author risk issues identify threats related to package maintainers and their trustworthiness.

Tag ID	Issue name	Issue description	Severity	Importance	Example
CA0001	Bad author	Author is known malicious	Critical	Software from this author shouldn’t be trusted.	In July 2021, NPM removed a package published by an author using the name chrunlee. The package included a remote shell and password-stealing functionality. Over about two and a half years, users downloaded this and similar packages thousands of times.
CA0026	Expired author domain	Author's email domain is not currently registered	Critical	Using a software package from outside your organization involves a trade-off between control, security, and development efficiency. Because it’s not practical to review every line of external code, trust in the package’s authors is critical. If a malicious actor gains control of an author’s expired email domain, they can impersonate the original author and insert malicious code into the author’s packages. This risk makes domain ownership continuity an important factor in maintaining software supply chain security.	In May 2022, a security researcher noticed that the NPM package foreach was controlled by a single maintainer, whose email domain had expired. The researcher bought the domain and thus gained control of foreach. Further, because 36,826 other NPM projects used foreach as a dependency, the researcher could have inserted malware into foreach and transitively affected 36,826 other projects.
HA0026	Author domain expiring	Author's email domain will expire soon	High
.A0023	Ephemeral author domain	A disposable domain was used by a maintainer	Situation-dependent severity	Disposable email services have legitimate uses, such as temporary communication or signing up for low-risk websites or applications. However, using a disposable email address to register a public Git repository or distribute code may indicate an attempt to conceal malicious activity.	In July 2022, a malicious cryptomining campaign was attempted by leveraging the NPM ecosystem. The threat actor created more than 1,200 JavaScript packages on NPM with more than 1,000 user accounts. Each of the accounts listed a different email address with a known disposable domain.