All Collections
Setting up code scanning
Malware detection in open-source dependencies
Malware detection in open-source dependencies
Willem Delbare avatar
Written by Willem Delbare
Updated over a week ago

When you connect your code repositories to Aikido, it will automatically scan for known vulnerabilities (CVE) in your dependencies. Aikido learns about your dependencies using lockfiles, such as a yarn.lock file for the javascript ecosystem.

Aikido goes one step further and also scans all installed packages for malware, such as obfuscated code, code that unexpectedly exfiltrates data to an unknown server, code that attempts to execute commands during installation on the developer's machine or installs bitcoin miners.

This functionality is automatically enabled on any paid plan. Aikido discovers up to 200 malicious packages in the ecosystems per day. To view the latest statistics, click here.

Supported ecosystems include:

  • NPM

  • Python

  • RubyGem

  • Nuget

  • Golang

  • Maven

  • Rust

Did this answer your question?