SonarQube Advanced Security now supports detecting malicious packages

Sonar Updates
, ,
1

With the rise of developer account compromises and incidents such as the Shai-Hulud worm, there has been an increase in malicious software published to upstream software repositories.

SonarQube Advanced Security (on both SonarQube Cloud, and SonarQube Server 2026.1+) now supports detecting publicly known malicious packages, and raises new risks when they are found.

This allows organizations to quickly react when developers pull a malicious package to contain and eliminate the risk.

Learn more on the Sonar blog and in our documentation

8 Likes
3

For supply-chain security, this is a huge victory. Because SonarQube Advanced Security can detect known harmful packages directly, teams may halt dangerous deps during analysis rather than after they have shipped. exposing it as a potential danger inside SonarQube Cloud/Server 2026.Compared to a standalone tool that many overlook, 1+ suits actual CI use far better. Although it won’t detect zero-days, this fills a significant hole for corrupted or tainted packages.

1 Like