Automated Malware Detection

Overview

Automated malware detection finds dependencies that have been identified as malicious, so you can catch supply-chain compromises before they reach production. Unlike a vulnerability, which is an unintentional security flaw, malware is code published with intent to harm, for example a hijacked package release or a typosquatted lookalike.

FOSSA flags malicious dependencies as a Quality issue and can fail your CI/CD checks when one is found, acting as a hard gate against compromised packages entering your codebase.

How it works

Every time FOSSA analyzes a project, the quality scanner cross-references each direct and transitive dependency against known malware reports drawn from multiple data sources. When a package version matches a report, FOSSA raises a Malware quality issue for it. Because the underlying data is updated continuously, a dependency can be flagged on a later scan even if an earlier scan was clean.

A malware issue carries the report that identified it:

Enabling malware detection

Malware detection is a rule on your quality policy and runs as part of quality scanning. For enterprise organizations with quality enabled, it is turned on automatically.

1. 1

   Turn on quality scanning

   Enable the quality scanner so FOSSA evaluates your dependencies. Organization-level defaults live at Organization Settings > Projects > Issues; you can override them per project at Project Settings > Issue Policies. See Quality Scanning.

2. 2

   Enable the Malware Detection rule

   On the quality policy applied to your projects, enable Malware Detection. This rule "detects dependencies identified as malicious by cross-referencing packages against known malware reports."

   Expand

3. 3

   Gate your builds (optional)

   Turn on Fail CI/CD checks for the quality scanner so a detected malicious dependency fails the project's status check and fossa test, blocking the change from merging.

Reviewing malware issues

Malicious dependencies appear alongside your other findings in the Issues tab:

1. Open the Issues tab and select the Quality issue category.
2. In the Issue Type filter, select Malware.
3. Open an issue to see the malware report's name, description, and a link to read more.

Expand

Expand

A flagged dependency also shows a Malicious Dependency banner in its details drawer on the project's dependencies view, linking directly to the issue.

To resolve a malware issue, remove or replace the affected dependency. See Reviewing Quality Issues for triage workflows shared across quality issue types.

How it differs from vulnerability detection

Further reading

• Quality Scanning: how the quality scanner runs and gates CI/CD.
• Quality Policies: configure the Malware Detection rule and other quality rules.
• Reviewing security issues: triage known vulnerabilities.