Risk detection

Malware scanning

In artifact management, malware scanning is the process of inspecting software packages, container images, and dependencies for malicious code before they are stored in a repository or used in a build. This is a critical step in securing the software supply chain.

How it works

Cloudsmith uses ClamAV, a signature-based detection engine that compares your artifacts against a library of known malware “fingerprints”.

Each piece of malware has unique characteristics, or "signatures", that can be used to identify it. A signature might be:

• A specific byte sequence from the malware's code
• A cryptographic hash of a malicious file
• Another distinct pattern unique to the malware

Before an artifact is synchronized, its files are scanned. If the scanner detects a match in the malware signature database:

• The artifact is flagged as malicious
• Synchronization fails, and the package status is set to FAILED
• The package is blocked from being downloaded, copied, moved, or otherwise used

For example, trying to upload a malicious file from a terminal will result in the following output:

Even if you retry synchronization, it will fail until the issue is resolved, effectively eliminating the risk.

Supported formats

Updated 6 hours ago