Checkmarx, has launched the Checkmarx Supply Chain Security solution to identify suspicious and potentially malicious open source packages across the modern application development lifecycle.

 Attackers are shifting their attention to the software supply chain by abusing open source software ecosystems, which have traditionally been trusted by the worldwide developer community. Checkmarx is bringing a developer-first approach to detecting supply chain attacks in code packages, leveraging a comprehensive suite of threat intelligence, behavioral intelligence and machine-learning models.

Supply chain security research and thought leadership

Over the past few months, the Checkmarx security research team has identified hundreds of malicious open source packages. Research articles highlighting three main types – dependency confusion, typosquatting and chainjacking – are available in the Checkmarx blog.

Working in concert with Checkmarx Software Composition Analysis (SCA), Checkmarx Supply Chain Security identifies anomalies in the health and security of open source projects, analyses contributor reputation and also directly interrogates the behaviour of packages via analysis within a detonation chamber.

The result is full-spectrum software supply chain insight and analysis that closes a significant gap in organisations’ application security.

Current solutions in the market are reactive in that they rely on community feedback to detect vulnerable code and analyse the code, but not the person behind it.

The Checkmarx Supply Chain Security solution is built on the principle of ‘don’t take code from strangers’.

Checkmarx Supply Chain Security enables organisations to accelerate modern application development using open source software safely and securely through a full suite of critical capabilities:

• Health and Wellness and Software Bill of Materials (SBOM):Provides knowledge of the open source package and community, combined with SBOM creation.
• Malicious Package Detection:Detects dependency confusion, typosquatting, chainjacking and other malicious activities and packages.
• Contributor Reputation: Restores trust in the provenance of open source packages by eliminating the need to manually analyse contributor activity across all projects that could impact an organisation.
• Behaviour Analysis: Incorporates static and dynamic analysis to observe how the code runs. The Checkmarx Supply Chain Security detonation chamber provides deep analysis of code packages and removes ambiguity to defend against stealthy threats.
• Continuous Results Processing: Delivers constant updates on Checkmarx security research and threat hunting, maintaining a reputation and vulnerability database for customer usage.