Engineering risk issues
Engineering risk issues identify maintenance and quality concerns in packages.
| Tag ID | Issue name | Issue description | Severity | Importance | Example |
|---|---|---|---|---|---|
| CE0046 | Deprecated package | Package has been deprecated | Critical | Deprecated packages no longer receive updates or patches for bugs and security vulnerabilities. This lack of maintenance can create significant security risks and compatibility issues with newer operating systems and dependencies. Threat actors often target deprecated packages by exploiting known vulnerabilities to gain unauthorized access or cause harm. For this reason, using deprecated packages presents substantial risk in any software environment. | |
| ME0016 | Secrets | Secrets or tokens found in package not in test or example file | Medium | Using open-source software that contains exposed secrets creates several security and compliance risks: - Reduced trust and software integrity: Leaked secret keys damage trust in the software and its development process and may indicate broader weaknesses in the organization's security posture. - Increased risk of supply-chain attacks: Leaked credentials can let attackers compromise developer accounts, CI/CD systems, or dependent applications, which can lead to injected malicious code, removal of legitimate software, or compromise of downstream users. - Legal and regulatory concerns: Depending on the exposed secret and applicable laws, using or distributing software with leaked credentials may cause noncompliance or legal liability. | In 2022, a hacker obtained hardcoded credentials to Uber’s privileged access management platform and used them to take over several internal applications and tools. Although the credentials did not come from published open-source software, this case highlights the importance of protecting sensitive credentials for every application. |
| IE0016 | Secrets | Secrets or tokens found in package in test or example file | Minimum | Using open-source software that contains exposed secrets creates several security and compliance risks: - Reduced trust and software integrity: Leaked secret keys damage trust in the software and its development process and may indicate broader weaknesses in the organization's security posture. - Increased risk of supply-chain attacks: Leaked credentials can let attackers compromise developer accounts, CI/CD systems, or dependent applications, which can lead to injected malicious code, removal of legitimate software, or compromise of downstream users. - Legal and regulatory concerns: Depending on the exposed secret and applicable laws, using or distributing software with leaked credentials may cause noncompliance or legal liability. | In 2022, a hacker obtained hardcoded credentials to Uber’s privileged access management platform and used them to take over several internal applications and tools. Although the credentials did not come from published open-source software, this case highlights the importance of protecting sensitive credentials for every application. |
| IE0023 | IP detection | This package may contain hardcoded IP addresses | Minimum | IP addresses can serve legitimate purposes, such as connecting to internal services or testing environments. However, they’re also commonly used in malware to communicate with command-and-control servers or to exfiltrate data. | While legitimate uses exist, it is uncommon to include direct IP addresses in source code. An example of a legitimate use is a developer directly including the IP address for a DNS server, such as Google at 8.8.8.8.On the other hand, direct IP addresses in source code can be indicative of malicious intent. Analysis of a 2017 malware campaign (see this report from US-CERT) revealed actors hard coding IP addresses that were used to connect victims to their malicious network infrastructure. IP addresses without a clear connection to the code's primary functionality should be treated with suspicion until their legitimacy is established. |
| IE0027 | Trivial package | Package may be too small to be worth the security risk | Minimum | Organizations should adopt external software only when the benefits outweigh the risks. If the functionality provided by a package can be easily developed in-house, doing so may reduce exposure to security risks. When a package can’t be inspected, the organization should carefully evaluate whether the functionality it provides justifies the potential security concerns. | In March 2016, a programmer removed all of his packages from the npm repository, including a trivial package called left-pad. Left-pad was used, either directly or indirectly, by several extremely popular packages, including Facebook's React, which is very widely used. When left-pad was removed from npm, all direct and indirect consumers were unable to build their software because the dependency package was no longer available. |
| IE0034 | Bus factor | A package that depends on a single person | Minimum | If a package is no longer maintained, security issues won’t be fixed, and the package won’t be updated as its environment changes. Over time, it may stop working as expected or become incompatible with newer systems. | core-js: Provides a standard library for JavaScript and is maintained by one person. As of early 2023, it was used by at least 75 of the top 100 websites. See the summary of the situation and the maintainer's request for help. cURL: The de facto standard program for making network requests in Linux environments. It is maintained by one person (see: https://onezero.medium.com/the-internet-relies-on-people-working-for-free-a79104a68bcc). left-pad: Was maintained by a single person, who deleted it because he felt companies had taken advantage of his work. Some of the most widely used JavaScript packages depended on left-pad and were blocked when it was removed. These projects have multiple contributors who have written code incorporated into the projects. However, each project has a single maintainer who owns the project, makes releases, and decides what to incorporate. If the maintainer stops working on the package, progress on the package also stops. |
| IE0049 | NPM URL dependency | Package lists a dependency specified as a URL | Minimum | ||
| IE1001 | Unmaintained | Package has been marked as unmaintained by RustSec | Minimum |