Checkmarx Malicious Package Protection is the fetch-time guard among Checkmarx One's supply-chain products. It sits in the package-fetch path between the developer or CI build and the public registry (npm, PyPI, Maven Central, NuGet, Go modules, Gem, Cargo, Composer) and blocks typosquatting attacks, dependency-confusion attacks, and known-malicious packages before the build resolves them. The placement matters, because a tampered package that never reaches the build never executes anywhere.
Typosquatting is the dominant attack pattern. Attackers publish a package with a name one keystroke away from a popular library (lod4sh instead of lodash, requets instead of requests, electron-builder vs electron_builder) and wait for typo-driven installs. Once installed, the malicious package executes on developer machines, CI runners, and eventually production. Periodic SCA scanning catches these after the fact when the CVE database catches up; Malicious Package Protection blocks them at fetch time before the developer notices.
Dependency confusion is the second pattern. When an internal package and a public package share a name, package managers will fetch the public one if it has a higher version number. Attackers publish public packages with the same names as known internal packages and wait for the build to fetch theirs instead. Checkmarx maintains a list of known internal namespaces and blocks public packages that masquerade as them. Programs that have been hit by dependency confusion typically discover it weeks after the breach.
Placement decides whether Malicious Package Protection works. The product needs to sit in the actual fetch path, which means CI build agents, developer machines, and any artifact-proxying layer (Artifactory, Nexus Repository, ProGet) need to route through the Checkmarx checkpoint. Programs that turn it on for CI but skip developer machines miss the attack surface that hits engineering laptops first. A sound rollout maps the fetch path end to end, configures every checkpoint, and validates coverage before calling the rollout complete.
Ideal use cases
- Blocking typosquatting attacks at npm, PyPI, Maven Central, NuGet, and Go module fetch time
- Preventing dependency-confusion attacks against internal package namespaces
- Sourcing-time control complementing detection-time SCA scanning
- Supply-chain governance for SLSA, NIST SSDF, and EO 14028 compliance
- Hardening CI pipelines and developer machines against malicious package attacks