IDE workflow

Shift-left context

The IDE is the earliest enforcement point. Surfacing a malicious package in the IDE lets a developer avoid committing an unsafe dependency in the first place.

View malicious package warnings in the IDE

The Cortex Cloud IDE extension flags malicious packages in real time, in a dedicated Malicious Packages section. The finding sidecar includes the package name, package version, severity, Malicious ID (for example, MAL-2025-599), advisory link (for example, https://osv.dev/vulnerability/MAL-2025-160599), and the fixed version, if applicable.