Find vulnerable and malicious dependencies
Large and complex projects usually have a number of third-party dependencies that enhance productivity by extending the functionality of common libraries and frameworks.
However, relying on third-party code raises security concerns, as it may involve the use of vulnerable dependencies in your project.
The bundled GoLand Package Checker plugin is powered by application security leader Checkmarx. The plugin analyzes dependencies for known vulnerabilities and lets you manage such cases by getting the information about a vulnerable dependency and update it to the newly released version.
Vulnerable dependencies
Show vulnerable dependencies in the editor
Open go.mod in the editor.
The IDE highlights dependencies that are considered vulnerable.
Place the caret at a highlighted dependency and press Alt+Enter to see the suggested fixes. They may suggest updating to a safe version, visiting the Checkmarx website to learn more about a particular vulnerability, or ignoring the vulnerability.
Analyze code to find all vulnerable dependencies
In addition, you can run an inspection to display the list of all declared and imported vulnerable dependencies in the project.
In the main menu, navigate to .
The result is displayed on the Vulnerable Dependencies tab of the Problems tool window ( or Alt+6) .
For each vulnerability, you can see an indication of the severity. Click a specific dependency to see more information about the vulnerabilities that were found in that dependency.
Ignore vulnerabilities
Ignored vulnerabilities are added to a list in inspection settings. If required, you can share the profile with this list with other members of your team.
Open go.mod in the editor, place the caret at a highlighted dependency, and press Alt+Enter.
From the list of suggestions, select Ignore vulnerable <dependency name and version>, and in the dialog that opens, select a reason for ignoring the dependency. Click Ignore.
To access the list with ignored vulnerabilities, press Ctrl+Alt+S to open the IDE settings and then select . Expand the Security node and click Vulnerable declared dependency. The list is located in the Options section in inspection details.
Learn how to share inspection profiles from Synchronize profiles between computers.
Report false positives
If you believe that a dependency identified as vulnerable is safe, you can report a false positive.
Click a dependency on the Vulnerable Dependencies tab of the Problems tool window ( or Alt+6) to open its description.
Locate the vulnerability that you want to report and click Report false positive.
You will see a notification with confirmation.
Malicious dependencies
The Package Checker plugin features the Malicious dependency inspection that detects malicious NPM and PyPI dependencies declared in your project. Fixing the reported problems stops your software from being compromised by an attacker.
Show malicious dependencies
Open a file in which NPM or PyPI dependencies are declared.
The IDE highlights the dependencies that are considered malicious.
It is recommended that you remove the detected dependencies. Malicious dependencies data is provided by OSV.dev.
Find malicious dependencies on commit
Press Alt+0 to open the Commit tool window and click Show Commit Options
.Enable the Check malicious dependencies option.
Configure Security inspections
You can change the severity of the Security inspections, enable and disable them, and configure problem highlighting in settings.
Press Ctrl+Alt+S to open settings and then select .
From the options on the right, select the Security node and select the name of the inspection.
Change the severity, scope, and highlighting as needed. Click OK to save the changes.