Protect builds from malicious dependencies
Upcoming change (3 June 2026): Newly published packages (less than 7 days old) will be blocked, and Integrity Rating violations will change from Warn to Fail. See full details and preparation steps.
SHIP-HATS uses Nexus IQ and Nexus Repository proxies to help protect applications from malicious or suspicious open-source packages.
These protections detect risks such as:
- Malicious packages
- Dependency confusion attacks
- Namespace conflicts
- Suspicious package integrity ratings
How protection works
When dependencies are downloaded through Nexus Repository proxies, the components are evaluated using security policies and threat intelligence.
If a package is identified as malicious or suspicious:
- a warning may appear during scans
- the package may be blocked from download
- the dependency may appear as a policy violation in Nexus IQ reports
Namespace conflict protection
Namespace conflicts occur when malicious packages attempt to impersonate legitimate libraries.
For example:
- a package with a similar name to a popular library
- a malicious package published in a public registry
The FW-Security Namespaces Conflict policy helps detect these cases.
Suspicious package detection
Packages with suspicious behaviour may be flagged using the Integrity-Rating Suspicious policy.
These packages may show signs such as:
- unusual download patterns
- suspicious publishing activity
- untrusted package sources
What to do when a package is blocked
If a package is blocked during dependency resolution:
- Review the package name and version.
- Check the Nexus IQ evaluation report.
- Upgrade to a safer dependency version if available.
- Replace the dependency with a trusted alternative.
