Malicious code risk issues

Malicious code risk issues identify packages that contain suspicious or harmful code.

Tag ID	Issue name	Issue description	Severity	Importance	Example
CM0001	IP detection	Package contains suspicious IP addresses	Critical	IP addresses can serve legitimate purposes, such as connecting to internal services or testing environments. However, they’re also commonly used in malware to communicate with command-and-control servers or to exfiltrate data.	While legitimate uses exist, it is uncommon to include direct IP addresses in source code. An example of a legitimate use is a developer directly including the IP address for a DNS server, such as Google at 8.8.8.8. On the other hand, direct IP addresses in source code can be indicative of malicious intent. Analysis of a 2017 malware campaign (see this report from US-CERT) revealed actors hard coding IP addresses that were used to connect victims to their malicious network infrastructure. IP addresses without a clear connection to the code's primary functionality should be treated with suspicion until their legitimacy is established.
CM0003	Landing binary	Package is using living off the land binaries in a known malicious way	Critical
CM0007	NPM hooks	Package executes shell commands in installation hooks	Critical	While NPM scripts are a powerful tool for package management and automation, they can also be exploited to execute malicious commands without the user’s knowledge. Review and validate any commands in the scripts section of package.json before installation to ensure they do not perform unsafe or unauthorized actions.	In October 2022, Phylum detected a typosquatting attack on the NPM ecosystem that targeted over 120 high profile packages including tslib, ignore, and anymatch. At the time of the attack these packages accounted for over 1.2 Billion weekly downloads--a gigantic attack surface targeting a huge number of developers. Once installed, the packages, whose index.js file contained the malicious code, would be automatically triggered to execute via a preinstall hook in the package.json file.
CM0011	Hostname detection	Package contains suspicious hostnames	Critical	Hostnames can serve legitimate purposes, such as accessing APIs or internal services. However, they can also be used by malware to communicate with command-and-control servers or retrieve malicious payloads.	Legitimate use of hostnames can sometimes be obvious. For example, MathJax is a popular JavaScript engine for displaying math formulas in a browser, so seeing the mathjax.org hostname in the package contents is expected. On the other hand, a 2020 ransomware attack used a hardcoded hostname for its target. Hostnames without a clear connection to a package's functionality should be treated with suspicion until their legitimacy is established.
CM0014	Masquerade	Package contains binaries masquerading as other file types	Critical
CM0024	Remote executable	Package runs remote executable	Critical	Executable files are not inherently malicious. Most software running on a computer is an executable program. However, open-source packages rarely reference URLs that point to executable files. This behavior can indicate a potential malware dropper. A package that downloads an executable from a remote URL, writes it to disk, and executes it is highly suspicious. This activity might signal an attempt to install or run unauthorized software. Developers and security teams should treat this pattern as a serious warning and investigate the package’s source and behavior before using it.	In August 2022, researchers discovered about a dozen malicious packages on PyPI that attempted a typosquatting attack. If installed, these packages downloaded an executable payload from a malicious URL, saved it to disk, and executed file--all from within setup.py. In one observed case, the executable recruited the host machine into a DDoS campaign against a Russian Counter-Strike server.
CM0037	Malware bazaar check	Package contains a file whose hash is in Malware Bazaar	Critical	Detecting a file that matches a known malware sample from MalwareBazaar is a critical security finding. Developers can use MalwareBazaar to investigate the file and review community intelligence to understand the nature and behavior of the identified malware.
CM0038	Triaged malware (through threat feed)	Manually reviewed and confirmed to contain malware	Critical
CM0039	Depends on malware	Package has dependency found in triaged malware table	Critical	Using a package that depends on another package identified as malware poses the same risk as directly installing the malicious package.
CM0045	npm security holding package	Package removed by npm as a security holding package	Critical	The presence of an npm security holding package indicates that the original package has been deprecated due to critical security concerns and should not be used. Developers who discover that their projects depend on such a package should assume that the system might be compromised. Immediate action should be taken to remove the package, review dependency chains, and perform a thorough security audit to ensure no residual malicious code remains.
CM1002	Malware (via OSSF MAL)	Determined to be malware by contributors to the OpenSSF malicious packages project	Critical
HM0002	Eval blob	Package contains calls to eval with high-entropy arguments	High
HM0008	Typosquatting	Package appears to be typosquatted	High	Even a small typographical error in a package name can install a malicious dependency and introduce critical security threats. To mitigate this risk, always verify package names, versions, and sources before installation, and consider using tools or registries that flag potential typosquatted packages.	Typosquatted packages are routinely removed from open-source ecosystems. High-profile incidents in NPM, PyPI, and other registries have increased in recent years. In December 2019, researchers uncovered a malicious Python package called Jeilyfish. It contained a backdoored implementation of the legitimate Jellyfish package that stole SSH and GPG keys. That package existed for over a year before detection and averaged several hundred downloads per month.
HM0015	Encrypted binaries	Package contains encrypted binaries	High
HM0023	Strange Python imports	Package imports things in a strange way	High	Code that obfuscates imports is difficult to review and may hide dangerous functionality. Code that uses these strange imports often tries to hide malicious behavior. Review any package that contains these imports and reconsider its use in your project.	In 2022, several packages on PyPI used imports like these. The typosquatted package pyquest contained such imports hidden in an otherwise benign file.
HM0025	Environment variable enumeration	Package enumerates sensitive system environment variables	High	Environment variables sometimes contain sensitive information such as access tokens (for example, AWS API keys) or local file paths (for example, LocalAppData). Malicious software running on a system may attempt to enumerate environment variables to locate and steal this data. This behavior poses a security risk, especially when environment variables are used to store credentials or other confidential information.	In April 2022, researchers discovered a set of malicious packages on PyPI that would search through environment variables looking for the location of local browser storage folders. Once found, the aim of the malware was to steal AWS or other user credentials.
HM0029	Obfuscated Python	Package contains obfuscated Python	High	Finding obfuscated code in the open source ecosystem is noteworthy because it is atypical and goes against the grain of the spirit and purpose of the open source software community. If found, it should be treated with caution because it could be hiding malicious intent.	In the fall of 2022, Phylum published details of a supply-chain attack on the PyPI ecosystem in which threat actors made sophisticated attempts to deploy W4SP Stealer onto Python developers’ machines. In this campaign, the attackers used typosquatting to distribute malicious and highly obfuscated Python packages. Once installed, these packages stole login credentials, cryptocurrency wallets, browser cookies, and other sensitive data. Even though the source code for these packages was publicly available, the obfuscation prevented users from recognizing its malicious intent.
HM0032	Execute on remote URL	Package executes code from a remote URL	High	Executing code hosted at a remote URL is fragile and unsafe for several reasons: - The remotely executed code isn't part of the package's codebase, making it difficult for users to review or verify what is being executed. - Because the code isn't shipped with the package, it often isn't subject to code review or maintained in source control. - The actual author of the remote code may be unknown or unverified. - The remote code can change at any time without requiring updates to the package itself. - The code requires an active internet connection to download and run, which can fail in restricted or offline environments.	In January 2023, Phylum witnessed a known prolific malware author group changing tactics to use the remote code execution technique. One of the many techniques this group previously used involved shipping highly obfuscated malware in the package itself. This is easy to spot because of the large chunk of obfuscated code. Shifting to the simple remote code execution technique not only greatly reduced the size of their malware footprint in the open source ecosystems, but it also greatly reduced the ability to identify the malware through visual inspection alone.
HM0033	Sensitive data enumeration	Package enumerates, writes, and POSTs sensitive data locations	High
HM0036	Webhook exfil	Package exfiltrates data through a webhook	High	The presence of a hard-coded webhook within an open-source software package is a strong indicator of potential malicious intent. When a webhook is combined with a POST request, it can exfiltrate sensitive data. For example, credentials, tokens, or environment variables - to an external destination. Most malware that uses webhook exfiltration executes during package installation. For example, running a command such as pip install <package> (for PyPI) can trigger automatic exfiltration. Treat any package that contains webhook references with caution and review its code for data-exfiltration mechanisms before installation.	Using a Discord webhook for data exfiltration is relatively new but has been widely observed and documented in publications. Often, these stealers activate during package installation and are visible on a cursory code review. However, in March 2023, Phylum released an article outlining how attackers are now utilizing this method in a more subtle manner by concealing the stealer code deep within existing packages.
HM0099	Basic JavaScript obfuscation	Package contains obfuscated Javascript	High	While there are a few legitimate use cases worthy of code obfuscation, finding obfuscated code in the open source ecosystem is noteworthy because it is atypical and goes against the grain of the spirit and purpose of the open source software community. If found, it should be treated with caution because it could be hiding malicious intent.	In the summer of 2022, researchers published details of a supply-chain attack on the NPM ecosystem that dated back to December 2021. In this campaign, dubbed IconBurst, threat actors used typosquatting to distribute malicious and obfuscated JavaScript packages. Once installed, these packages stole login credentials from embedded website forms. Even though the source code for these packages was publicly available, the obfuscation prevented users from recognizing its malicious intent.
MM0012	Native code	Package contains calls used to load native code	Medium	Function calls that load native code can have legitimate uses. However, packages that invoke native code may also load malicious binaries or perform actions associated with living off the land. The term living off the land was introduced by Christopher Campbell and Matthew Graeber in their 2013 DerbyCon talk. It describes the use of legitimate, built-in binaries or scripts known as LOLBins to perform malicious actions. Such binaries may offer undocumented functionality that can be exploited by attackers, advanced persistent threats (APTs), or red teams. A list of known LOLBins, libraries, and scripts is available at the LOLBAS project. Open-source packages that call native code should be carefully reviewed. If the use of native code doesn't align with the package's intended functionality, the package should be considered untrustworthy and avoided.	In Java, functions such as load, loadLibrary, and loadLibraryFromJar dynamically link a library to a process.
MM0024	Remote executable	Package references remote executable	Medium	Executable files are not inherently malicious. Most software running on a computer is an executable program. However, open-source packages rarely reference URLs that point to executable files. This behavior can indicate a potential malware dropper. A package that downloads an executable from a remote URL, writes it to disk, and executes it is highly suspicious. This activity might signal an attempt to install or run unauthorized software. Developers and security teams should treat this pattern as a serious warning and investigate the package’s source and behavior before using it.	In August 2022, researchers discovered about a dozen malicious packages on PyPI that attempted a typosquatting attack. If installed, these packages downloaded an executable payload from a malicious URL, saved it to disk, and executed file--all from within setup.py. In one observed case, the executable recruited the host machine into a DDoS campaign against a Russian Counter-Strike server.
IM0007	NPM hooks	Package runs the software immediately after installation	Minimum	While NPM scripts are a powerful tool for package management and automation, they can also be exploited to execute malicious commands without the user’s knowledge. Review and validate any commands in the scripts section of package.json before installation to ensure they do not perform unsafe or unauthorized actions.	In October 2022, Phylum detected a typosquatting attack on the NPM ecosystem that targeted over 120 high profile packages including tslib, ignore, and anymatch. At the time of the attack these packages accounted for over 1.2 Billion weekly downloads--a gigantic attack surface targeting a huge number of developers. Once installed, the packages, whose index.js file contained the malicious code, would be automatically triggered to execute via a preinstall hook in the package.json file.
IM0006	NPM hooks	Package uses install hooks to ask for donations	Minimum	While NPM scripts are a powerful tool for package management and automation, they can also be exploited to execute malicious commands without the user’s knowledge. Review and validate any commands in the scripts section of package.json before installation to ensure they do not perform unsafe or unauthorized actions.	In October 2022, Phylum detected a typosquatting attack on the NPM ecosystem that targeted over 120 high profile packages including tslib, ignore, and anymatch. At the time of the attack these packages accounted for over 1.2 Billion weekly downloads--a gigantic attack surface targeting a huge number of developers. Once installed, the packages, whose index.js file contained the malicious code, would be automatically triggered to execute via a preinstall hook in the package.json file.
IM0009	Unicode detection	Package uses suspicious Unicode characters	Minimum
IM0013	Dynamic code	Package contains calls used to run dynamic classes	Minimum
IM0017	Compiled binaries	Package contains compiled binaries	Minimum	Binary files pose potential security risks because their contents can’t be easily inspected. Many legitimate source packages include compiled binaries for valid reasons, but binaries from unknown or untrusted sources should be treated with caution. They may contain malicious code or perform unauthorized actions.	Anaconda is a popular Python distribution of scientific computing packages. Anaconda distributes binary files that are pre-compiled for common computing environments such as Windows, macOS, and Linux, and each of these binaries can be validated against a cryptographic hash provided by Anaconda. This is possible because the source code for each package is based on a specific release version which fixes that package's source code at a specific point in time. This is more than merely a great convenience for users who do not need to spend time and power compiling source code just to end up with the exact same binary file as Anaconda distributes. At any time a user can download a package's source code, compile it themselves, and compare the cryptographic hash of their binary with the hash from Anaconda's distribution to verify that the binary package distributed by Anaconda is the exact result of compiling the source code of the package.
IM0019	Eval function calls	Package contains files with eval calls	Minimum
IM0020	Odd dependencies	Package contains non-standard dependencies	Minimum
IM0040	Decodes hardcoded base64 strings	Package decodes hardcoded Base64 strings	Minimum	Using Base64 decoding to execute encoded scripts poses a serious security risk. Attackers can use it to inject and run malicious code within trusted environments without immediate detection.
IM0041	High entropy blobs	Package contains high entropy blobs	Minimum	High entropy blobs can pose significant security risks. Threat actors often use them to hide malicious code within otherwise legitimate software packages. Because these blobs are designed to evade detection, they can prevent traditional security tools from identifying or analyzing the hidden content.
IM0042	Nuget install scripts	Package contains scripts that will run on install	Minimum	While NuGet install scripts provide significant convenience by automating complex installation processes, they also introduce security risks by executing arbitrary PowerShell code during package installation. This can be exploited by malicious actors to execute unauthorized code, potentially leading to system compromise or data breaches. Inspect the source and contents of any NuGet package that includes install scripts, ensuring that they come from trustworthy sources and do not contain malicious code.
IM0043	Cargo build file	Package contains build.rs file that will run on build and compile	Minimum	Although build.rs files are useful, they can introduce security risks similar to those in other ecosystems that allow arbitrary code execution during package installation. A malicious build.rs script can run unauthorized commands and compromise the user’s system or data. Review and verify the source of any crate that includes a build script before using it.	In August 2023, Phylum's automated risk detection identified a potential malware campaign leveraging the build.rs file in Rust packages. The scheme began with the release of several harmless, typosquatted packages which were later updated to include a mechanism for sending system information to a controlled Telegram channel. This early stage was crucial for uncovering the threat before it evolved into more harmful activities. For details on this campaign, see Phylum's blog post.
IM0044	Rubygems install hooks	Package contains Ruby pre or post install hooks	Minimum	Ruby install hooks provide flexibility and convenience but also introduce significant security risks. Because install hooks permit arbitrary code execution, attackers can exploit them to perform unauthorized actions during gem installation. Review and verify the source and integrity of any gem that uses install hooks before adding it to your environment. Use trusted repositories and scan gems for unexpected install behavior to reduce the risk of supply-chain attacks.
IM0047	Python build hook	Package contains Python build hook files	Minimum	Although build hooks are powerful, they can introduce significant security risks if misused. Because build-hook code executes automatically during package installation, an attacker could run unauthorized commands or distribute malware. Review build scripts carefully and validate the integrity and trustworthiness of any external packages that define them. For more information, see Modern Python Build Hooks.
IM0051	POST request behavior	Package contains code that performs a POST request	Minimum
.M0004	Landing binary	Package uses suspicious executables	Situation-dependent severity
.M0018	Dependency confusion	Package has unusual semver or not found in registry	Situation-dependent severity	Dependency confusion attacks can be difficult to detect because they don’t rely on typos, unlike typosquatting attacks. Instead, they exploit misconfigured build systems that install a package of the correct name from the wrong registry. Without a clear understanding of your build pipeline or registry configuration, you might not realize that the wrong package has been installed.	In early 2021, a bug bounty researcher built an early proof of concept of this type of attack and was able to successfully demonstrate execution of his code inside more than 35 different organizations.
.M0028	Suspicious URL references	Package references sites uncommon to legitimate software	Situation-dependent severity	Although the URLs and services listed above are not inherently malicious, their appearance in open-source software should prompt careful scrutiny. Evaluate each reference’s purpose to determine whether it serves a legitimate function or indicates possible malicious intent.	In 2020, researchers found that the Discord CDN hosted malicious software such as Epsilon ransomware, the RedLine stealer, and the XMRig cryptocurrency miner.
.M0031	Suspicious Python setup commands	Package contains unusual commands in setup.py	Situation-dependent severity	Because setup.py runs during installation, attackers can embed malicious code that executes automatically on the target system. A user can become compromised simply by installing a package, even if they never run it. Inspect setup.py files for dangerous commands, for example, file system modifications, network calls, or arbitrary code execution and install packages only from trusted sources. Review installation scripts before execution to help prevent inadvertent malware deployment.	One of the most prolifically distributed pieces of malware discovered so far in PyPI, the W4SP Stealer, resulted in publishing over 100 separate packages containing W4SP. Attackers often used setup.py as the first stage of a complex attack chain.
.M0048	Compiled Python files	Package contains compiled Python (.pyc) files	Situation-dependent severity
.M0048	YARA rule	Package contains files flagged by YARA rules	Situation-dependent severity	A YARA rule issue indicates that a package may contain malicious code or exhibit behaviors associated with malware.	YARA rules have helped detect malicious packages across open-source ecosystems. In August 2021, security researchers identified a compromised NPM package, ua-parser-js. YARA rules detected cryptocurrency-mining malware and password-stealing Trojans embedded in the package. The malicious version was downloaded more than one million times before it was removed, affecting many production systems. The YARA signatures matched patterns commonly found in cryptominers and credential harvesters, which triggered alerts and led to an investigation and the eventual removal of the package.