Malware detection

Endor Labs detects malware in dependencies by scanning the packages used in the project and recognizing known malicious patterns. Monitoring for known malicious packages: Endor Labs scans dependencies to identify malware by cross-referencing findings with the Open Source Vulnerability (OSV) database and data from the proprietary malware feed. Suspicious code behavior: Endor Labs uses malware detection rules and SAST rules to scan open source package dependencies for suspicious code patterns and behaviors. These rules analyze code structures, detect anomalies, and identify potential threats.

Detect malware findings

Endor Labs provides a set of malware policies designed to identify and manage malicious or suspicious code in your project, ensuring that Endor Labs detects potential security risks early.

The OSS finding policy detects malicious code and findings in your project. You can edit the policy to change the severity and template parameters.
Configure malware action policy to specify how detected malware findings should be handled automatically, including notifications, blocking actions, and workflow triggers.
Configure malware exception policy to exclude malware findings under defined conditions. This filters out false positives and keeps the focus on critical risks.

View malware findings

You can view the malware findings, prioritize them, and take corrective action.

Select Projects from the left sidebar.
Select the project for which you want to view the malware.
Select Malware to view malware findings.
Select a finding to view the following information:
- Project: The name of the project where Endor Labs finds the malware, finding policy, categories, and attributes of the project.
- Risk Details:
  - Explanation of the finding.
  - Reasoning explains why Endor Labs classifies the package as malware.
  - Recommended remediation.
- Metadata: Contains details such as the vulnerability IDs, ecosystem, package release date, and advisory publication date.
- Dependency Path: Shows how upstream dependencies reach the malicious package version.
Click View Details, to view the details of the malware finding.

Check for malicious package versions

You can check whether specific package versions are flagged as malicious by querying the Endor Labs malware database. Run the following command to make an API query. The namespace must be oss, and you can pass one or more package versions in the names list.

endorctl api create -r QueryMalware -n oss -d '{"spec":{"package_version_names":{"names":["<ecosystem>://<package>@<version>"]}}}'

Restrictions on using the QueryMalware API

The API is restricted for use with certain conditions. See Permitted use of malware detection data for more information.

For example, run the following command to check whether the MailBee@12.3.3 package version is malicious.

endorctl api create -r QueryMalware -n oss -d '{"spec":{"package_version_names":{"names":["nuget://MailBee@12.3.3"]}}}'

The command returns a json response with details about the package version and the reasons for marking it as malicious.

{
  "meta": {
    "create_time": "2025-09-02T04:40:29.773434484Z",
    "kind": "QueryMalware",
    "name": "malware for ",
    "update_time": "2025-09-02T04:40:29.773434744Z",
    "version": "v1"
  },
  "responses": {
    "values": {
      "nuget://MailBee@12.3.3": {
        "list": {
          "objects": [
            {
              "meta": {
                "create_time": "2025-06-27T07:39:08.576Z",
                "index_data": {
                  "data": [
                    "@ancestor=oss"
                  ],
                  "tenant": "oss"
                },
                "kind": "Malware",
                "name": "Malicious code in MailBee (nuget)",
                "update_time": "2025-09-02T01:41:51.930710821Z",
                "upsert_time": "2025-09-02T01:41:51.930710821Z",
                "version": "v1"
              },
              "spec": {
                "additional_notes": [
                  "\n---\n_-= Per source details. Do not edit below this line.=-_\n"
                ],
                "advisory_last_updated": "2024-06-25T13:30:02Z",
                "advisory_published": "2024-06-25T13:30:02Z",
                "aliases": [
                  "MAL-2024-4540"
                ],
                "cwe_id": "CWE-506",
                "ecosystem": "ECOSYSTEM_NUGET",
                "malware_detected_on": "2024-06-25T13:30:02Z",
                "package_name": "MailBee",
                "purl": "pkg:nuget/MailBee",
                "source": "MALWARE_SOURCE_OSV",
                "status": "MALWARE",
                "summary": "Malicious code in MailBee (nuget)",
                "version": {
                  "osv_id": "MAL-2024-4540",
                  "version": "12.3.3"
                }
              },
              "tenant_meta": {
                "namespace": "oss"
              },
              "uuid": "685e4a9c9787b3b77c7ac0c0"
            }
          ],
          "response": {
            "next_page_id": "685e4a9c9787b3b77c7ac0c0",
            "next_page_token": 1
          }
        }
      }
    }
  },
  "spec": {
    "package_version_names": {
      "names": [
        "nuget://MailBee@12.3.3"
      ]
    }
  },
  "tenant_meta": {
    "namespace": "oss"
  },
  "uuid": "68b6753d19d009449113d065"
}

Permitted use of malware detection data

The following sections describe the permitted use of malware detection data across Endor Open Source Core (OSS Core), Open Source Pro (OSS Pro), and Package Firewall licenses.

What’s included with OSS Core / OSS Pro vs. Package Firewall

The following table summarizes the capabilities available with each license.

You want to…	OSS Core / OSS Pro	Package Firewall
See malicious packages found in your scanned repositories	✓ Included	✓ Included
Pull those findings via API into Jira, SIEM, or a dashboard	✓ Included	✓ Included
Fail a build or PR check when a scan finds malware in your code	✓ Included	✓ Included
Query Endor Labs for a package before it enters your codebase	✕ Not licensed	✓ Included
Block or gate package installation based on Endor Labs data	✕ Not licensed	✓ Included
Bulk-retrieve or mirror the Endor Labs malicious-package corpus	✕ Not licensed ¹	✕ Not licensed ¹
Redistribute Endor Labs malware data to third parties	✕ Not licensed ¹	✕ Not licensed ¹

¹ Bulk export and redistribution are outside the scope of all standard SKUs. If you have a data-integration or OEM requirement, contact your account team.

Scope of the included capability

Malware detection is included with Endor Labs OSS Core and OSS Pro so that you can identify and remediate malicious packages that Endor Labs has detected in the dependencies of repositories you have onboarded and scanned. Findings for your scanned dependencies are yours to consume through the UI, the API, and CI/CD integrations, including exporting them into your own ticketing, SIEM, and reporting systems. Malware detection under OSS Core and OSS Pro is a detection capability. It is scoped to what your scans surface. It is not a license to the broader Endor Labs malicious-package intelligence corpus.

Restrictions

Accordingly, under OSS Core and OSS Pro you may not:

Retrieve, enumerate, or cache malware or malicious-package records that are not associated with a dependency identified in one of your own scanned repositories — including by iterating over package names, versions, ecosystems, registries, or record identifiers.
Build or operate an internal threat intelligence database, index, mirror, or replica of Endor Labs malicious-package data intended to be queried independently of your Endor Labs scan results.
Use Endor Labs malware data as the decision source for a pre-installation or pre-resolution allow/deny control — for example a proxy, registry mirror, package-manager plugin, resolver hook, or admission gate that consults Endor Labs data to decide whether a package may be fetched or installed.
Redistribute, resell, sublicense, or otherwise make available Endor Labs malware data to any third party, or expose it through a service, product, or feed offered to others.
Use Endor Labs malware data to develop, train, benchmark, or improve a competing product or service.

Pre-installation blocking requires Endor Labs Package Firewall

If your goal is to prevent malicious packages from being installed or resolved at all — rather than detecting them after they enter a repository — that capability is delivered by the Endor Labs Package Firewall SKU, which is purpose-built for it and licensed for that use. Contact your account team.

Enforcement

Endor Labs may apply rate limits, quotas, query-scoping, and entitlement checks to API endpoints that return malware data, and may adjust them without notice to enforce the scope described above. Use of the Endor Labs API is also subject to your agreement with Endor Labs and the Endor Labs Acceptable Use Policy, which control in the event of any conflict with this page.

Introduction

Setup & Deployment

Inventory & Insights

Scan with Endor Labs

Risk Remediation

Integrations

Secure AI Coding

Platform Administration

Best Practices

Research Open Source Risks

Trust & Compliance

Detect malware findings

View malware findings

Check for malicious package versions

Permitted use of malware detection data

What’s included with OSS Core / OSS Pro vs. Package Firewall

Scope of the included capability

Restrictions

Pre-installation blocking requires Endor Labs Package Firewall

Enforcement

​Detect malware findings

​View malware findings

​Check for malicious package versions

​Permitted use of malware detection data

​What’s included with OSS Core / OSS Pro vs. Package Firewall

​Scope of the included capability

​Restrictions

​Pre-installation blocking requires Endor Labs Package Firewall

​Enforcement

Detect malware findings

View malware findings

Check for malicious package versions

Permitted use of malware detection data

What’s included with OSS Core / OSS Pro vs. Package Firewall

Scope of the included capability

Restrictions

Pre-installation blocking requires Endor Labs Package Firewall

Enforcement