Skip to content
CyberLens AI

Security guide

How to detect malicious code in project dependencies

Published by CyberLens AI. Last updated .

Malicious npm, pip, and other package-manager dependencies are a growing supply-chain risk — especially for AI-generated code that installs packages without manual review.

This guide covers five practical steps — from npm audit to secret scanning to site-level configuration review — so you can find and remove risky dependencies before they affect users.

Scan your site free Compare repo scanners

Step 1: npm audit (Node.js)

npm audit checks your lockfile against the npm advisory database and reports CVEs with severity levels and suggested fix paths.

  • Run npm audit after npm install in every CI pipeline
  • Use --audit-level=high to block builds on critical findings
  • npm audit fix handles non-breaking compatible updates automatically

Step 2: pip-audit (Python)

pip-audit scans installed Python packages against the OSV and PyPI advisory databases for known vulnerable versions.

  • pip install pip-audit to add it to any Python environment
  • pip-audit -r requirements.txt for file-based audits in CI
  • JSON output available for automated CI parsing

Step 3: Typosquatting and dependency confusion checks

Review top-level dependencies for names one character off from popular packages and verify lockfile integrity hashes.

  • Use npm ls --depth=0 to review direct dependencies
  • Check for unexpected packages and postinstall hooks
  • Pin versions in lockfiles and use a private mirror for internal packages

Step 4: Secret scanning with gitleaks

Scan the repository for embedded secrets that may have been introduced by malicious packages or AI-generated code.

  • gitleaks detect scans git history for tokens, keys, and credentials
  • Add gitleaks as a pre-commit hook or early CI step
  • Review node_modules install scripts for unexpected network calls

Step 5: Website configuration review

After auditing the dependency tree, scan the deployed site to catch configuration risks introduced by packages.

  • Missing security headers often arrive via framework defaults in dependencies
  • Insecure cookie settings may be set by third-party session libraries
  • Third-party script risks appear on the live site, not in the repo

Questions and answers

What is a malicious dependency?

A malicious dependency is an npm, pip, gem, or other package that contains intentionally harmful code — such as credential harvesting, backdoors, or data exfiltration logic. It may enter a project directly through installation, through typosquatting a legitimate package name, or as a transitive dependency.

How does AI-generated code increase dependency risk?

AI code generators sometimes suggest packages that are abandoned, renamed, or now registered by bad actors. Always review AI-suggested package names against the official registry and check recent download trends and maintainer activity before installing.

Does npm audit catch all malicious packages?

No. npm audit only reports packages with a published CVE or advisory entry. A newly malicious package may not yet appear in the database. Pair it with typosquatting checks and secret scanning for better coverage.

What is dependency confusion?

Dependency confusion is an attack where a malicious actor publishes a public package with the same name as an internal private package. Build tools that check the public registry first may pull the attacker-controlled version instead of the legitimate internal one. Mitigate with private registry scope and lockfile pinning.

How do I prevent malicious dependencies in CI/CD?

Pin all dependency versions in a lockfile, run npm audit or pip-audit at the start of every pipeline, block builds on high-severity findings, review install scripts before running npm install, and use a private package mirror or allowlist for internal dependencies.

Security references

CyberLens AI guidance is informed by established security standards and public vulnerability intelligence.