Skip to main content
Miscellaneous Malware detection in open-source dependencies

Malware detection in open-source dependencies

When you connect your code repositories to Aikido, it will automatically scan for known vulnerabilities (CVE) in your dependencies. Aikido learns about your dependencies using lockfiles, such as a yarn.lock file for the javascript ecosystem.

Aikido goes one step further and also scans all installed packages for malware, such as obfuscated code, code that unexpectedly exfiltrates data to an unknown server, code that attempts to execute commands during installation on the developer's machine or installs bitcoin miners.

This functionality is automatically enabled on the Pro plan. Aikido discovers up to 200 malicious packages in the ecosystems per day. To view the latest statistics, click here.

Supported ecosystems include:

  • NPM

  • Python

  • RubyGem

  • Nuget

  • Golang

  • Maven

  • Rust