Package Checker downloads statistics

This plugin checks your third-party dependencies for known vulnerabilities. It suggests a safe version, if available, to make your code more secure. It also scans source code for vulnerable API calls to highlight the most critical problems.

The following package managers and build files are supported:

• Amper build system (module.yaml, module.amper, project.yaml, project.amper, and module template files) • Gradle (build.gradle, build.gradle.kts) • Maven (pom.xml, pom-4.0.0.xml, pom.*, .pom) • npm, pnpm and Yarn (package.json) • PyPI (setup.py, requirements.txt) • Poetry and Pipenv (pyproject.toml, Pipfile) • Go Modules (go.mod) • Composer (composer.json) • JPS - JetBrains Project System (.iml) • sbt (build.sbt), provided by the Scala plugin

The plugin provides the following security inspections:

• Vulnerable declared dependency scans packages defined in your code (such as packages added to a supported build file).

• Vulnerable imported dependency detects packages that are not defined in the source code (such as transitive dependencies).

• Vulnerable API usage shows vulnerable methods and functions in Java source code (out of the box) and in Kotlin source code (if you have the Kotlin plugin installed).

• Malicious dependencies detects malicious NPM and PyPI dependencies in your project to prevent your software from being compromised.

Vulnerable API inspections are language-specific and provided as part of the corresponding language plugins: JavaScript and TypeScript, Python, and Go.

Here is a list of the plugins required to support the related functionality: Gradle, Maven, JavaScript and TypeScript, Python, Go, PHP, and Scala.

Problems identified by Package Checker are reported on the Problems | Vulnerable Dependencies tab. The plugin also provides the Analyze | Vulnerable Dependencies action.

Package Checker doesn't send information about packages to the JetBrains server in cleartext form. It sends only hashed names of packages. We never log or process hashes we don't have in our database, and we don't analyze your proprietary or confidential packages.

Vulnerability data provided by Mend.io and OSV.dev.

Plugin source code © 2024, JetBrains s.r.o..