Skip to main content

​
Overview

  • What it Does: As part of dependency scanning, Corgea flags known malicious and compromised packages in your project’s dependencies. Unlike a typical vulnerability, a malicious package is one that has been intentionally crafted or tampered with to harm the systems that install it — for example through data exfiltration, credential theft, backdoors, or cryptocurrency mining.
  • Who it’s For: Security teams and developers who want to protect their software supply chain from malicious open-source packages.

​
What It Detects

Malicious package detection covers packages that are known to be harmful, including:
  • Typosquats: Packages named to imitate popular libraries so they get installed by mistake
  • Hijacked releases: Legitimate packages whose maintainer account or pipeline was compromised to publish a malicious version
  • Backdoored versions: Package versions that contain intentionally hidden malicious functionality
  • Protestware and sabotage: Packages modified to intentionally disrupt or damage the systems that install them

​
How It Works

Malicious package detection runs as part of Dependency Scanning (SCA). Corgea resolves your direct and transitive dependencies and checks them against authoritative databases of known-malicious packages, including the OpenSSF Malicious Packages database and related advisory feeds. When a match is found, Corgea reports it alongside your other dependency findings.

​
Supported Ecosystems

Malicious package detection applies to the same package ecosystems as dependency scanning, including npm, PyPI, RubyGems, Maven, and more. See the full list in Dependency Scanning (SCA).

​
How It Surfaces

  • Malicious packages appear in your scan results alongside other dependency findings.
  • They are treated as high-priority issues because a confirmed malicious package represents an active threat rather than a potential weakness.
  • The affected package, version, and the manifest that introduced it are shown so you can trace where it came from.

​
Remediation

A confirmed malicious package should be treated as an urgent issue. Remove it as soon as possible.
  • Remove or replace the malicious package with a trusted alternative.
  • If the malicious behavior was introduced in a specific version, pin to a known-good version that predates the compromise.
  • For transitive dependencies, identify the parent package that pulled it in and upgrade or replace that parent. See transitive dependencies for how to trace the dependency path.
  • Rotate any secrets or credentials that may have been exposed while the package was installed.