> For the complete documentation index, see [llms.txt](https://docs.debricked.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.debricked.com/product/malicious-package-detection.md).

# Malicious package detection

Fortify SCA identifies malicious packages in your dependencies and separates them from standard security vulnerabilities. This helps you triage intentional compromise faster and prioritize response actions across repositories.

Fortify SCA uses malware intelligence sources, including OSV, to detect known malicious packages. Finding details can include advisory references and dependency context.

#### **See repositories with malware findings** <a href="#howdoiseerepositorieswithmalwarefindings" id="howdoiseerepositorieswithmalwarefindings"></a>

To get an overview of repositories with malware findings, click **Repositories** in the left side menu.

<figure><img src="/files/kxVkga32DipW4ovtLuxM" alt=""><figcaption></figcaption></figure>

In this view, Fortify SCA displays:

* Name: Repository name.
* Malware detected banner: Indicates when malware findings exist in the selected repository context.
* Malware finding count: Total malware findings detected in the repository.
* Malware Detected column: Malware indicator for repository or dependency rows.
* Review status: Current review state for findings in the repository.

> You can export the filtered and visible repository data in the table to a CSV file. To do so, click **Export Table** located at the top-right corner of the table. *For more information, refer to the* *Export table data* *topic.*

#### **See malware findings in a specific repository** <a href="#howdoiseemalwarefindingsinaspecificrepository" id="howdoiseemalwarefindingsinaspecificrepository"></a>

To show all malware findings in a specific repository:

1. Go to **Repositories** from the left side menu.
2. Click a specific repository.
3. In the repository view, click the **Malware** tab.

<figure><img src="/files/oDCHpDnyyTeahqEJUgo8" alt=""><figcaption></figcaption></figure>

In this view, you get detailed information regarding malware findings discovered in your repository:

* Name: Malware identifier, typically a MAL ID.
* Discovered: Date when Fortify SCA detects the finding in the repository.
* Dependencies: Dependency in which Fortify SCA detects the malicious package.
* Review status: Indicates whether the finding is marked as vulnerable, unaffected, paused/snoozed, or unexamined.

*For more information on review states, refer to the* [*Set a review status*](/product/vulnerability-management/set-a-review-status.md) *topic.*

#### **See information about a specific malware finding** <a href="#howdoiseeinformationaboutaspecificmalwarefinding" id="howdoiseeinformationaboutaspecificmalwarefinding"></a>

To get detailed information about a specific malware finding in a repository, click the malware ID.

This view contains links to advisories and malware intelligence references, along with a summary of impact.

The summary contains the following information:

* Affected dependency and version details.
* Discovery metadata for the finding.
* External references related to malware analysis and remediation.
* Classification metadata, including CWE where available (for example, CWE-506).

#### **See all malware findings across all projects** <a href="#howdoiseeallmalwarefindingsacrossallprojects" id="howdoiseeallmalwarefindingsacrossallprojects"></a>

To get an overview of all malware findings across scanned repositories:

1. Click **Vulnerabilities** in the left side menu.
2. Click the **Malware** tab.

<figure><img src="/files/AjKIzcYuUg7KgE9xYwwI" alt=""><figcaption></figcaption></figure>

This view is similar to the malware view for a specific repository, but it includes all malware findings across all projects.

> You can export the filtered and visible vulnerability data in the table to a CSV file. To do so, click **Export Table** located at the top-right corner of the table. *For more information, refer to the* [*Export table data*](/product/administration/repositories/export-table-data.md) *topic.*

#### **See dependencies affected by malware** <a href="#howdoiseedependenciesaffectedbymalware" id="howdoiseedependenciesaffectedbymalware"></a>

To view impacted dependencies in repository context:

1. Go to **Repositories**.
2. Click a specific repository.
3. Click the **Dependencies** tab.
4. Review the **Malware Detected** column.

<figure><img src="/files/aAa0UjeJ0dOBdnlKHZAW" alt=""><figcaption></figcaption></figure>

Use this view to connect malware findings directly to affected packages and prioritize remediation work.

#### **See malware entries in Vulnerability Database** <a href="#howdoiseemalwareentriesinvulnerabilitydatabase" id="howdoiseemalwareentriesinvulnerabilitydatabase"></a>

To review malware intelligence entries:

1. Open **Vulnerability Database**.
2. Click the **Malware** tab.
3. Search by malware ID or dependency.
4. Sort by **Published** to review the newest entries first.

<figure><img src="/files/7bkJH2IQxgKaXh8PCWxs" alt=""><figcaption></figcaption></figure>

This view helps you validate malware context and supports investigation.

#### **Use automation to respond to malware findings** <a href="#howdoiuseautomationtorespondtomalwarefindings" id="howdoiuseautomationtorespondtomalwarefindings"></a>

The automation engine helps you reduce manual response work by reacting immediately to malware findings.

You can configure automation rules to:

* Trigger notifications when Fortify SCA detects malware.
* Trigger webhooks for incident workflows.
* Fail pipeline checks when malware is present in a repository.

*For more information, refer to the* [*Automation*](/product/automation.md) *and* [*Policies*](/product/automation/policies.md) *topics.*

#### **Data sources for malicious package detection** <a href="#whatdatasourcesareusedformaliciouspackagedetection" id="whatdatasourcesareusedformaliciouspackagedetection"></a>

Fortify SCA continuously collects and refines malware intelligence data to identify malicious packages and map findings to dependencies.

*For more information on source processing and enrichment, refer to the* [*Data sources*](/product/vulnerability-management/data-sources.md) *topic.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.debricked.com/product/malicious-package-detection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.