A package appears in a registry. The name looks familiar. The version number is plausible. The install script runs before anyone reads the code. That’s not a vulnerability. That’s a trap.

Software Composition Analysis was initially invented as a way of detecting any existing CVEs present within packages. This task remains critical for ensuring application security.

However, packages without CVEs are not necessarily safe to use, as they might be malicious, stealing credentials or installing backdoors. In this respect, one should note that according to Snyk’s official documentation, malicious packages rarely receive any CVE ID and, hence, are not found in databases of advisories.

The tools below take different approaches to this problem. Some watch package behavior. Some block installs at the proxy. Some try to combine both.

The gap between a CVE and a backdoor

A vulnerability is a mistake. A malicious package is a decision. It is important because the difference lies in their nature.…