Sonatype Nexus Repository warns “1 Malware Component Found”

post by izaak on Oct 23, 2024

Izaak van Niekerk

Since upgrading our free local standalone version of Nexus Repository to version 3.73.0, we are seeing a Big Red Warning stating 1 Malware Component Found.

From the guide below, my understanding is that we would need the Sonatype Repository Firewall in order to remove the malware. I assume this means that we would need to upgrade Nexus to the paid for, Pro version.

https://help.sonatype.com/en/guide-to-removing-malware.html

Is there a different way to remove the malware? Perhaps somebody could suggest another “free” route that we could take?

post by mfrost on Oct 23, 2024

Maura Frost

Hi @izaak!

Sounds like you’ve already clicked the Contact Sonatype button on the banner to be directed to our dedicated Malware support page.

Someone from our account management team will reach out to answer any questions you may have, and discuss options.

Let me know if you don’t get in touch with someone.

post by fredrik on Oct 31, 2024

Fredrik W

We have the same issue and want to resolve it without contacting sales and buying more products.

Are there any way to remove this (commercial) banner in the OSS-version of Nexus repo?

post by mfrost on Nov 1, 2024

Maura Frost

Thanks for reaching out and sharing your concerns around our new malware banner feature.

We view malware in any of our customer’s environments whether it be our free or paid repository as a very serious and active threat that needs to be addressed as soon as possible.

We are committed to supporting the safe development of software and therefore want to ensure you are aware of when malware is present. The malware must be removed in order for the banner to no longer be present.

If you’re looking for self-guided support, you can review our free online resources here to learn more about how best to secure your environments.

Please reach out if you would like further support.

post by fredrik on Nov 4, 2024

Fredrik W

Ok. So how do I find the infected files so I can take action upon them?

post by mfrost on Nov 4, 2024

Maura Frost

The best way to identify and remove malware using a Sonatype-supported solution is to use Sonatype Repository Firewall. With Sonatype Nexus Repository Manager Pro, it allows you to see the risk of components in individual proxy repos, but it does not specify whether or not a component is malicious.

post by fredrik on Nov 5, 2024

Fredrik W

How do I find it in the OSS-version of Nexus repository?

post by christoph.keller on Nov 5, 2024

Christoph Keller

Hi all,

I have the same issue, already contacted sonatype and just got the answer that I should buy the repository firewall. But as small company, this is no option at all.

But I got no info about how I can find out the exact package or the exact file that is affected.

I also tried checking each package using ClamAV, without any match (so it seems that there is no malware in the packages).

This sounds more like a sales-banner than a helpful information…

So sonatype, please either tell us how we find out the infected packag or file name, or provide us how you checked the packages to find the infected one (to manually reproduce the result), or just remove the unusable big red sales-banner.

Thank you and have a great day,

Chris

post by d.remke on Nov 6, 2024

Daniel Remke

Hello, this message is now also appearing for me and is unsettling my colleagues. It can’t be the solution that I have to buy the nexus firewall so that I can determine the affected components. Even if the solution would perhaps help us to manage our artifacts better, I am currently lacking the arguments to get a budget for it. I would need to know what is affected in order to assess the risk.

post by mfrost on Nov 7, 2024

Maura Frost

@christoph.keller The banner indicates that open source malware is present within your proxy repos. This open source malware will not be detected with an anti-virus tool.

If you’re looking to take action within OSS, you could re-consider proxying high-risk ecosystems and delete those proxy repos. You run the risk of breaking builds if you do this but it is an option.

Even with removing those proxy repos, having open source malware at all is very risky as you know.

The only Sonatype-supported way to accurately identify, block, and remediate malware is through Sonatype Repository Firewall. Firewall is supported by our best-in-class malware identification capabilities. You can also learn more about our data and intelligence here.

post by christoph.keller on Nov 8, 2024

Christoph Keller

@mfrost thank you for your message.

I know what this banner is trying to tell me. But it is just a worthless big red danger-sign, as long as it does not tell me what package is affected.

Technically, either nexus exactly knows what package is affected and just will not tell me until I pay for, or otherwise it shows just a random number.

I already spent 8+ hours to build a pipeline that checks the npm-proxy-repository for malware and viruses (using ClamAV), checked each package and specific version, if it is still listed on npmjs.org, without any luck. All packages seems legit.

So could you please tell me either the name of the affected package, or the method how the packages are scanned to find the affected one?

And about the „proxying high-risk ecosystems“, i am using the official npmjs.org feed. So nothing inofficial or high-risk at all, I just want a convenient single package-source for both our own npm-packages and the official ones. Just to make our developers life a bit easier.

Thank you for your answers and have a great day,

Chris

post by sebastien_picavet on Nov 8, 2024

Sebastien PICAVET

Same here.

This banner sounds like an advertisement. Like many tools/scams how warn users about malwares/virus on theirs computers.

The form is not very good. The only way to get rid of this message is to pay. We should be able to deactivate it or Nexus should name the components.

Paid business model could be: OSS = warn/show components (passive) / Pro = actively block components to be downloaded (active).

It sounds more fair and less commercial.

Kind regards

post by bjorns on Nov 8, 2024

Bjorn S

Make sure none of your packages are listed in GitHub Advisory Database · GitHub this was the case with someone I know who experienced this notification.

post by christoph.keller on Nov 12, 2024

Christoph Keller

Hi @mfrost,

Are there any news on this issue? Is there any way to get rid of the banner, without buying the Repository Firewall?

Thank you for your help.

Best regards and have a great day,

Chris

post by mfrost on Nov 12, 2024

Maura Frost

@christoph.keller, thanks for checking back in. If you click on the banner, it will take you to an updated page that includes some new resources as of Monday, including an FAQ guide that answers these questions.