Checkmarx Malicious Package Protection

Checkmarx Malicious Package Protection is a sourcing-time control inside the Checkmarx One Supply Chain pillar. It sits in the package-fetch path between the developer or CI build and the public registry (npm, PyPI, Maven Central, NuGet, Go modules, Gem, Cargo, Composer) and blocks typosquatting attacks, dependency-confusion attacks, and known-malicious packages before the build resolves them. The placement matters: a tampered package that never reaches the build never executes anywhere.

Typosquatting is the dominant attack pattern. Attackers publish a package with a name one keystroke away from a popular library (lod4sh instead of lodash, requets instead of requests, electron-builder vs electron_builder) and wait for typo-driven installs. Once installed, the malicious package executes on developer machines, CI runners, and eventually production. Periodic SCA scanning catches these after the fact when the CVE database catches up; Malicious Package Protection blocks them at fetch time before the developer notices.

Dependency confusion is the second pattern. When an internal package and a public package share a name, package managers will fetch the public one if it has a higher version number. Attackers publish public packages with the same names as known internal packages and wait for the build to fetch theirs instead. Checkmarx maintains a list of known internal namespaces and blocks public packages that masquerade as them. Programs that have been hit by dependency confusion typically discover it weeks after the breach.

What kills Malicious Package Protection adoption is misplacement. The product needs to sit in the actual fetch path, which means CI build agents, developer machines, and any artifact-proxying layer (Artifactory, Nexus Repository, ProGet) need to route through the Checkmarx checkpoint. Programs that turn it on for CI but skip developer machines miss the attack surface that hits engineering laptops first. Merito's engagement maps the fetch path end-to-end, configures every checkpoint, and validates the coverage before declaring rollout complete.

Merito has worked with programs that ran clean SCA reports for months while typosquatting and dependency-confusion attacks were already running on developer laptops. The reason is timing. SCA scans periodically and lights up after the CVE database catches up; by then the malicious package has executed every postinstall script it wanted to. Malicious Package Protection sits at fetch time and blocks the package before the build resolves it. The placement is the point.

Merito recommends Malicious Package Protection specifically when the program publishes internal packages alongside public dependencies (dependency-confusion exposure), when the engineering org is large enough that typosquatting risk is statistically real, and when SCA-only programs have already been audited against attack scenarios. Sonatype Repository Firewall and JFrog Xray are competitive at the proxy layer; Checkmarx is at the fetch layer. Mature programs run both as layered defense.

The pairing with Repository Health is the load-bearing move on sourcing-time governance. Malicious Package Protection blocks known-bad packages; Repository Health scores OSS project hygiene before the dependency enters the tree. Programs running one without the other are filtering downstream risk without screening upstream provenance.