Malicious open-source package detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_MAL_1
Category - Subcategory	SCA - Malicious Packages
Severity	CRITICAL
Framework	SCA

Impact

A malicious open-source package was detected in the codebase. Malicious packages are intentionally harmful software components distributed through package registries such as npm, PyPI, RubyGems, NuGet, Go, crates.io, and Maven. These include typosquatting attacks, backdoored libraries, credential-theft packages, and hijacked packages. Unlike vulnerabilities (CVEs), malicious packages are always CRITICAL severity and require immediate removal — there is no safe version to upgrade to.

How to Fix

Remove the malicious package immediately from your project dependencies. Review all access logs and credentials that may have been exposed. Audit your dependency tree for any other suspicious packages.