Risks, emerging when developing or using open-source software
Source Kaspersky Security Blog
United States
Germany
United Kingdom
France
India
China
Japan
Brazil
Russia
South Korea
Australia
Canada
Netherlands
Italy
Mexico
Israel- rce
Description
How the popularization of AI and the simplification of development are creating new risks for corporate security.
Impact
Organizations worldwide face increased risk of supply chain attacks, data breaches, and operational disruptions due to unpatched or malicious open-source components embedded in their software. The lack of reliable vulnerability data and delayed reporting prolong exposure windows, increasing the likelihood of exploitation. Legacy OSS components that cannot be patched create persistent vulnerabilities that attackers can exploit to gain unauthorized access or execute remote code. The surge in malicious OSS packages threatens the integrity of development pipelines and production environments, potentially leading to credential theft, infrastructure compromise, and espionage. AI-generated code vulnerabilities and dependency confusion attacks further amplify these risks, potentially allowing attackers to introduce backdoors or disrupt services. The complexity and opacity of dependency chains hinder detection and remediation efforts, increasing the attack surface. These impacts can lead to significant financial losses, reputational damage, regulatory penalties, and erosion of customer trust. Small and medium businesses, often lacking dedicated security resources, are particularly vulnerable. The threat also challenges existing security tools and processes, necessitating investment in advanced security solutions and expertise.
Defensive guidance
1. Implement comprehensive software composition analysis (SCA) tools capable of deep dependency mapping, including transitive dependencies, to gain full visibility into OSS components and versions used. 2. Integrate multiple threat intelligence feeds specialized in open-source vulnerabilities and malicious package detection to enhance vulnerability prioritization and reduce false positives. 3. Establish strict open-source package usage policies, including vetting, approval workflows, and restrictions on unmaintained or legacy components. 4. Regularly audit and systematically remove or replace obsolete and unsupported OSS components to eliminate unpatchable vulnerabilities. 5. Enforce security controls and operational guidelines for AI-assisted development, including validation of AI-generated code, dependency version verification, and restricting AI agents’ access to sensitive credentials. 6. Employ runtime protection and cloud workload security solutions to detect and mitigate exploitation attempts in production environments. 7. Train development and security teams on OSS supply chain risks and AI-related vulnerabilities to improve awareness and response capabilities. 8. Collaborate with OSS communities and vendors to encourage timely vulnerability disclosures and patching. 9. Use multi-source vulnerability databases and cross-reference CVSS scores to compensate for inconsistencies and gaps in public data. 10. Monitor for signs of dependency confusion and implement namespace and package name verification controls in CI/CD pipelines.
References
Community reviews
Related threats
- php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability
- ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool