CWE-508 describes malicious code that resides only on the target system or product that is attacked. It does not try to spread to other systems. It is the counterpart of replicating code such as viruses and worms.
How it happens
The code arrives with a product or update and does its work in place. Backdoors, data stealers and logic bombs are typical examples of code that stays where it lands. MITRE does not tie this entry to one language or technology.
Not spreading does not make it mild. The harm is limited to one host, but that host may hold your credentials or your build.
What an attacker gains
MITRE lists the ability to execute unauthorized code or commands, affecting confidentiality, integrity and availability on the compromised system.
How to find it
The MITRE record gives no detection methods for this entry. Practical checks: inventory what is installed, review changes to build and install scripts, and look for software that behaves differently from its description.
How to fix it
- Antivirus software can help mitigate known malicious code.
- Verify the integrity of software before installing it.
For dependencies, run a scan before you adopt a package. The free scan runs in the browser with no login.
Quick check
Is non-replicating code harmless because it cannot spread?
No. It can still run unauthorized commands on the host it reached.
