Malware Detection in Open-Source Dependencies and Containers

Malware Detection in Open-Source Dependencies

When you connect your code repositories to Aikido, it will automatically scan for known vulnerabilities (CVE) in your dependencies. Aikido learns about your dependencies using lockfiles, such as a yarn.lock file for the javascript ecosystem.

Aikido goes one step further and also scans all installed packages for malware, such as obfuscated code, code that unexpectedly exfiltrates data to an unknown server, code that attempts to execute commands during installation on the developer's machine or installs bitcoin miners.

This functionality is automatically enabled on the Pro plan. Aikido discovers up to 200 malicious packages in the ecosystems per day. To view the latest statistics, click here.

Supported ecosystems include:

• NPM

• Python

• RubyGem

• Nuget

• Golang

• Maven

• Rust

Malware Detection in Containers

As an extra measure, we also scan for malware in your containers. This is important as there is not always a code-related Lockfile that would flag the malware or when your organization pulls from public or private registries before they ever reach production.

Container malware scanning is automatically enabled on the Pro plan and runs continuously as new container images are introduced into your environment.