> ## Documentation Index > Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt > Use this file to discover all available pages before exploring further. # Malware detection > Understand how malware is detected, classified, and scored in Endor Labs. Endor Labs detects malware in dependencies by scanning the packages used in the project and recognizing known malicious patterns. **Monitoring for known malicious packages:** Endor Labs scans dependencies to identify malware by cross-referencing findings with the Open Source Vulnerability (OSV) database and data from the proprietary malware feed. **Suspicious code behavior:** Endor Labs uses malware detection rules and SAST rules to scan open source package dependencies for suspicious code patterns and behaviors. These rules analyze code structures, detect anomalies, and identify potential threats. ## Detect malware findings Endor Labs provides a set of malware policies designed to identify and manage malicious or suspicious code in your project, ensuring that Endor Labs detects potential security risks early. * The [OSS finding policy](/platform-administration/policies/finding-policies/oss-policies) detects malicious code and findings in your project. You can edit the policy to change the severity and template parameters. * Configure [malware action policy](/platform-administration/policies/action-policies/templates#malware) to specify how detected malware findings should be handled automatically, including notifications, blocking actions, and workflow triggers. * Configure [malware exception policy](/platform-administration/policies/exception-policies/templates#malware) to exclude malware findings under defined conditions. This filters out false positives and keeps the focus on critical risks. ## View malware findings You can view the malware findings, prioritize them, and take corrective action. 1. Select **Projects** from the left sidebar. 2. Select the project for which you want to view the malware. 3. Select **Malware** to view malware findings. Malware findings 4. Select a finding to view the following information: * **Project**: The name of the project where Endor Labs finds the malware, finding policy, categories, and attributes of the project. * **Risk Details**: * Explanation of the finding. * Reasoning explains why Endor Labs classifies the package as malware. * Recommended remediation. * **Metadata**: Contains details such as the vulnerability IDs, ecosystem, package release date, and advisory publication date. Malware findings side panel * **Dependency Path**: Shows how upstream dependencies reach the malicious package version. Malware finding dependency path tab 5. Click **View Details**, to view the details of the malware finding. Malware findings view details ## Check for malicious package versions You can check whether specific package versions are flagged as malicious by querying the Endor Labs malware database. Run the following command to make an API query. The namespace must be `oss`, and you can pass one or more package versions in the `names` list. ```bash theme={null} endorctl api create -r QueryMalware -n oss -d '{"spec":{"package_version_names":{"names":["://@"]}}}' ```

Restrictions on using the QueryMalware API

The API is restricted for use with certain conditions. See [Permitted use of malware detection data](#permitted-use-of-malware-detection-data) for more information. For example, run the following command to check whether the `MailBee@12.3.3` package version is malicious. ```bash theme={null} endorctl api create -r QueryMalware -n oss -d '{"spec":{"package_version_names":{"names":["nuget://MailBee@12.3.3"]}}}' ``` The command returns a json response with details about the package version and the reasons for marking it as malicious. ```json expandable theme={null} { "meta": { "create_time": "2025-09-02T04:40:29.773434484Z", "kind": "QueryMalware", "name": "malware for ", "update_time": "2025-09-02T04:40:29.773434744Z", "version": "v1" }, "responses": { "values": { "nuget://MailBee@12.3.3": { "list": { "objects": [ { "meta": { "create_time": "2025-06-27T07:39:08.576Z", "index_data": { "data": [ "@ancestor=oss" ], "tenant": "oss" }, "kind": "Malware", "name": "Malicious code in MailBee (nuget)", "update_time": "2025-09-02T01:41:51.930710821Z", "upsert_time": "2025-09-02T01:41:51.930710821Z", "version": "v1" }, "spec": { "additional_notes": [ "\n---\n_-= Per source details. Do not edit below this line.=-_\n" ], "advisory_last_updated": "2024-06-25T13:30:02Z", "advisory_published": "2024-06-25T13:30:02Z", "aliases": [ "MAL-2024-4540" ], "cwe_id": "CWE-506", "ecosystem": "ECOSYSTEM_NUGET", "malware_detected_on": "2024-06-25T13:30:02Z", "package_name": "MailBee", "purl": "pkg:nuget/MailBee", "source": "MALWARE_SOURCE_OSV", "status": "MALWARE", "summary": "Malicious code in MailBee (nuget)", "version": { "osv_id": "MAL-2024-4540", "version": "12.3.3" } }, "tenant_meta": { "namespace": "oss" }, "uuid": "685e4a9c9787b3b77c7ac0c0" } ], "response": { "next_page_id": "685e4a9c9787b3b77c7ac0c0", "next_page_token": 1 } } } } }, "spec": { "package_version_names": { "names": [ "nuget://MailBee@12.3.3" ] } }, "tenant_meta": { "namespace": "oss" }, "uuid": "68b6753d19d009449113d065" } ``` ## Permitted use of malware detection data The following sections describe the permitted use of malware detection data across Endor Open Source Core (OSS Core), Open Source Pro (OSS Pro), and Package Firewall licenses. ### What's included with OSS Core / OSS Pro vs. Package Firewall The following table summarizes the capabilities available with each license. | You want to… | OSS Core / OSS Pro | Package Firewall | | --------------------------------------------------------------- | ------------------ | ---------------- | | See malicious packages found in your scanned repositories | ✓ Included | ✓ Included | | Pull those findings via API into Jira, SIEM, or a dashboard | ✓ Included | ✓ Included | | Fail a build or PR check when a scan finds malware in your code | ✓ Included | ✓ Included | | Query Endor Labs for a package before it enters your codebase | ✕ Not licensed | ✓ Included | | Block or gate package installation based on Endor Labs data | ✕ Not licensed | ✓ Included | | Bulk-retrieve or mirror the Endor Labs malicious-package corpus | ✕ Not licensed ¹ | ✕ Not licensed ¹ | | Redistribute Endor Labs malware data to third parties | ✕ Not licensed ¹ | ✕ Not licensed ¹ | ¹ Bulk export and redistribution are outside the scope of all standard SKUs. If you have a data-integration or OEM requirement, contact your account team. ### Scope of the included capability Malware detection is included with Endor Labs OSS Core and OSS Pro so that you can identify and remediate malicious packages that Endor Labs has detected in the dependencies of repositories you have onboarded and scanned. Findings for your scanned dependencies are yours to consume through the UI, the API, and CI/CD integrations, including exporting them into your own ticketing, SIEM, and reporting systems. Malware detection under OSS Core and OSS Pro is a detection capability. It is scoped to what your scans surface. It is not a license to the broader Endor Labs malicious-package intelligence corpus. ### Restrictions Accordingly, under OSS Core and OSS Pro you may not: * Retrieve, enumerate, or cache malware or malicious-package records that are not associated with a dependency identified in one of your own scanned repositories — including by iterating over package names, versions, ecosystems, registries, or record identifiers. * Build or operate an internal threat intelligence database, index, mirror, or replica of Endor Labs malicious-package data intended to be queried independently of your Endor Labs scan results. * Use Endor Labs malware data as the decision source for a pre-installation or pre-resolution allow/deny control — for example a proxy, registry mirror, package-manager plugin, resolver hook, or admission gate that consults Endor Labs data to decide whether a package may be fetched or installed. * Redistribute, resell, sublicense, or otherwise make available Endor Labs malware data to any third party, or expose it through a service, product, or feed offered to others. * Use Endor Labs malware data to develop, train, benchmark, or improve a competing product or service. ### Pre-installation blocking requires Endor Labs Package Firewall If your goal is to prevent malicious packages from being installed or resolved at all — rather than detecting them after they enter a repository — that capability is delivered by the Endor Labs Package Firewall SKU, which is purpose-built for it and licensed for that use. Contact your account team. ### Enforcement Endor Labs may apply rate limits, quotas, query-scoping, and entitlement checks to API endpoints that return malware data, and may adjust them without notice to enforce the scope described above. Use of the Endor Labs API is also subject to your agreement with Endor Labs and the Endor Labs Acceptable Use Policy, which control in the event of any conflict with this page.