> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corgea.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Malicious Package Detection

> Malicious package detection flags known malicious and compromised packages in your dependencies, such as typosquats, hijacked releases, and backdoored versions, before they reach production.

## Overview

* **What it Does**: As part of dependency scanning, Corgea flags **known malicious and compromised packages** in your project's dependencies. Unlike a typical vulnerability, a malicious package is one that has been intentionally crafted or tampered with to harm the systems that install it — for example through data exfiltration, credential theft, backdoors, or cryptocurrency mining.

* **Who it's For**: Security teams and developers who want to protect their software supply chain from malicious open-source packages.

## What It Detects

Malicious package detection covers packages that are known to be harmful, including:

* **Typosquats**: Packages named to imitate popular libraries so they get installed by mistake
* **Hijacked releases**: Legitimate packages whose maintainer account or pipeline was compromised to publish a malicious version
* **Backdoored versions**: Package versions that contain intentionally hidden malicious functionality
* **Protestware and sabotage**: Packages modified to intentionally disrupt or damage the systems that install them

## How It Works

Malicious package detection runs as part of [Dependency Scanning (SCA)](/sca). Corgea resolves your direct and transitive dependencies and checks them against authoritative databases of known-malicious packages, including the **OpenSSF Malicious Packages** database and related advisory feeds.

When a match is found, Corgea reports it alongside your other dependency findings.

## Supported Ecosystems

Malicious package detection applies to the same package ecosystems as dependency scanning, including npm, PyPI, RubyGems, Maven, and more. See the full list in [Dependency Scanning (SCA)](/sca).

## How It Surfaces

* Malicious packages appear in your scan results alongside other dependency findings.
* They are treated as high-priority issues because a confirmed malicious package represents an active threat rather than a potential weakness.
* The affected package, version, and the manifest that introduced it are shown so you can trace where it came from.

## Remediation

<Warning>A confirmed malicious package should be treated as an urgent issue. Remove it as soon as possible.</Warning>

* **Remove or replace** the malicious package with a trusted alternative.
* If the malicious behavior was introduced in a specific version, **pin to a known-good version** that predates the compromise.
* For transitive dependencies, identify the parent package that pulled it in and upgrade or replace that parent. See [transitive dependencies](/sca#transitive-dependencies) for how to trace the dependency path.
* Rotate any secrets or credentials that may have been exposed while the package was installed.

## Related

* [Dependency Scanning (SCA)](/sca) — scan your application's third-party dependencies
* [Container Image Scanning](/container-scanning) — scan base images for vulnerabilities