{"id":110893,"date":"2023-10-17T09:10:18","date_gmt":"2023-10-17T07:10:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej"},"modified":"2023-10-17T09:10:18","modified_gmt":"2023-10-17T07:10:19","slug":"oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","title":{"rendered":"Assessment of issues with supporting open projects and using outdated dependencies","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Sonatype, a company specializing in protection against attacks manipulating software components and dependencies (supply chain), has published the results of a study (PDF, 62 pages) on the issues with dependencies and maintenance of open projects in Java, JavaScript, Python, and .NET languages found in the Maven Central, NPM, PyPl, and Nuget repositories. Over the past year, the number of projects in tracked open ecosystems has increased by an average of 29%. The number of package downloads from the examined repositories in 2023 rose by 33%, while in 2021, downloads increased by 73% for comparison. <\/p>\n
Malicious activity in repositories has significantly increased \u2014 since the beginning of the year, 245,000 malicious packages have been identified, and the number of recorded attacks aimed at dependency substitution has doubled.
<\/center> <\/p>\n
Many projects continue to use vulnerable versions; for instance, 23% of downloads of the Java package Log4j still consist of versions with critical vulnerabilities that were fixed in 2021. In the Maven Central repository, about 12% of all downloads involve components containing known vulnerabilities. On average, across all repositories, the share of downloads of older package versions classified as risky (for example, with unpatched vulnerabilities) is 20% (in 80% of cases, the latest version is downloaded). In 96% of cases, downloads of vulnerable components could have been avoided by selecting versions in which the issue has already been resolved. <\/p>\n
A major challenge in maintaining security is the quality of project support. In the ecosystems for Java and JavaScript, this is a significant issue \u2014 over the past year, support for one in five projects (18.6%) listed in Maven Central and NPM has ceased, which were supported in the previous year. Out of 1.176 million analyzed projects present in the Maven, NPM, PyPl, and Nuget repositories, only 11% (118,000) continue to receive active support. <\/p>\n
The study also included a survey of 621 professional developers from various companies. 67% of respondents believe their applications do not use vulnerable libraries, 10% have encountered security incidents in the past 12 months due to vulnerabilities in open-source software, and 20% are unsure. 28% of companies identify the presence of vulnerable components within 1 day of vulnerability disclosure, 39% \u2014 between 1 and 7 days, and 29% \u2014 more than a week. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Assessment](\"\/wp-content\/uploads\/2023\/10\/51959a6d676e0ad5ee98884567dd49ec.png\")
<\/center> <\/p>\n