CWE-509 covers replicating malicious code, including viruses and worms. Once such code has compromised a target system or product, it attempts to attack other systems. That separates it from non-replicating malicious code, which stays where it lands.
How it happens
MITRE does not tie this entry to a language or technology. The defining trait is behavior: the code copies itself or pushes itself onward. A compromised build machine can infect the artifacts it produces. A poisoned package can run on every machine that installs it, and a worm can use the access it finds there to reach further.
For software teams this makes the supply chain the key place to look. Shared registries, shared CI runners and shared credentials all give replicating code somewhere to go next.
What an attacker gains
MITRE lists the ability to execute unauthorized code or commands, with impact on confidentiality, integrity and availability. Replication multiplies the reach. One foothold turns into many.
How to find it
The record gives no detection methods for this entry. Useful checks include:
- Keep an inventory of dependencies and installed software so you can tell what changed.
- Watch for unexpected writes to other repositories, unexpected publishing of packages, and unexpected outbound connections from build systems.
- Compare installed artifacts with their expected checksums.
How to fix it
MITRE gives two mitigations.
- In operation, antivirus software scans for viruses and worms.
- At installation, always verify the integrity of the software being installed.
Treat these as the start. Limit what any single credential can reach, so a compromised machine cannot publish or modify everything. Pin dependency versions so an unexpected new release does not install itself.
You can check the dependencies in a manifest right now with the free in-browser scan. It needs no login, the file stays on your machine, and it accepts up to 100 dependencies.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What makes a worm different from other malicious code in CWE terms?
It attempts to attack other systems after compromising the first one.
Which install-time step does MITRE repeat for every malicious code entry?
Verify the integrity of the software being installed.
