Sonatype Nexus Repository warns “1 Malware Component Found”

post by izaak on Oct 23, 2024

Izaak van Niekerk

Since upgrading our free local standalone version of Nexus Repository to version 3.73.0, we are seeing a Big Red Warning stating 1 Malware Component Found.

From the guide below, my understanding is that we would need the Sonatype Repository Firewall in order to remove the malware. I assume this means that we would need to upgrade Nexus to the paid for, Pro version.

Guide to Removing Malware

Is there a different way to remove the malware? Perhaps somebody could suggest another “free” route that we could take?

post by mfrost on Oct 23, 2024

Hi @izaak!

Sounds like you’ve already clicked the Contact Sonatype button on the banner to be directed to our dedicated Malware support page.

Someone from our account management team will reach out to answer any questions you may have, and discuss options. Let me know if you don’t get in touch with someone.

post by fredrik on Oct 31, 2024

We have the same issue and want to resolve it without contacting sales and buying more products.

Are there any ways to remove this (commercial) banner in the OSS-version of Nexus repo?

post by mfrost on Nov 1, 2024

Hi @fredrik!

Thanks for reaching out and sharing your concerns around our new malware banner feature. We view malware in any of our customer’s environments whether it be our free or paid repository as a very serious and active threat that needs to be addressed as soon as possible.

We are committed to supporting the safe development of software and therefore want to ensure you are aware of when malware is present. The malware must be removed in order for the banner to no longer be present.

If you’re looking for self-guided support, you can review our free online resources here to learn more about how best to secure your environments.

post by fredrik on Nov 4, 2024

Ok. So how do I find the infected files so I can take action upon them?

post by mfrost on Nov 4, 2024

The best way to identify and remove malware using a Sonatype-supported solution is to use Sonatype Repository Firewall. With Sonatype Nexus Repository Manager Pro, it allows you to see the risk of components in individual proxy repos, but it does not specify whether or not a component is malicious.

post by fredrik on Nov 5, 2024

How do I find it in the OSS-version of Nexus repository?

post by christoph.keller on Nov 5, 2024

Hi all,

I have the same issue, already contacted sonatype and just got the answer that I should buy the repository firewall. But as a small company, this is no option at all.

But I got no info about how I can find out the exact package or the exact file that is affected.

I also tried checking each package using ClamAV, without any match (so it seems that there is no malware in the packages).

This sounds more like a sales-banner than helpful information…

So sonatype, please either tell us how we find out the infected packag or file name, or provide us how you checked the packages to find the infected one (to manually reproduce the result), or just remove the unusable big red sales-banner.

Thank you and have a great day,

Chris

post by d.remke on Nov 6, 2024

Hello, this message is now also appearing for me and is unsettling my colleagues. It can’t be the solution that I have to buy the nexus firewall so that I can determine the affected components. Even if the solution would perhaps help us to manage our artifacts better, I am currently lacking the arguments to get a budget for it. I would need to know what is affected in order to assess the risk.

post by mfrost on Nov 7, 2024

@christoph.keller The banner indicates that open source malware is present within your proxy repos. This open source malware will not be detected with an anti-virus tool.

If you’re looking to take action within OSS, you could reconsider proxying high-risk ecosystems and delete those proxy repos. You run the risk of breaking builds if you do this but it is an option.

Even with removing those proxy repos, having open source malware at all is very risky as you know.

The only Sonatype-supported way to accurately identify, block, and remediate malware is through Sonatype Repository Firewall. You can also learn more about our data and intelligence here.

post by christoph.keller on Nov 8, 2024

@mfrost thank you for your message.

I know what this banner is trying to tell me. But it is just a worthless big red danger sign, as long as it does not tell me what package is affected.

Technically, either nexus knows exactly what package is affected and just will not tell me until I pay for it, or otherwise it just shows a random number.

I already spent 8+ hours to build a pipeline that checks the npm-proxy-repository for malware and viruses (using ClamAV), checked each package and specific version, if it is still listed on npmjs.org, without any luck. All packages seem legit.

So could you please tell me either the name of the affected package or the method how the packages are scanned to find the affected one?

And about the “proxying high-risk ecosystems”, I am using the official npmjs.org feed. So nothing unofficial or high-risk at all, I just want a convenient single package source for both our own npm packages and the official ones. Just to make our developers' lives a bit easier.

Thank you for your answers and have a great day,

Chris

post by sebastien_picavet on Nov 8, 2024

Same here.

This banner sounds like an advertisement. Like many tools/scams that warn users about malware/viruses on their computers.

The form is not very good. The only way to get rid of this message is to pay. We should be able to deactivate it or Nexus should name the components.

Paid business model could be: OSS = warn/show components (passive) / Pro = actively block components from being downloaded (active).

It sounds more fair and less commercial.

Kind regards

post by bjorns on Nov 8, 2024

Make sure none of your packages are listed in GitHub Advisory Database · GitHub this was the case with someone I know who experienced this notification.

post by christoph.keller on Nov 12, 2024

@mfrost, Are there any news on this issue? Is there any way to get rid of the banner without buying the Repository Firewall?

Thank you for your help.

Best regards and have a great day,

Chris

post by mfrost on Nov 12, 2024

@christoph.keller, thanks for checking back in. If you click on the banner, it will take you to an updated page that includes some new resources as of Monday, including an FAQ guide that answers these questions.

post by christoph.keller on Nov 12, 2024

@mfrost, Thank you for the updated info page. I read all the info, but it is still unsatisfactory, as the only real “solution” provided is: delete and recreate the proxy repository…

With that, it is still a big guessing game and is still just a commercial banner rather than a helpful and honest information.

Also the note on why Sonatype is not able to report the exact component is insufficient:

How are you identifying the open source malware in my proxy repositories? We’re leveraging the existing Repository Health Check capabilities to identify and count every instance of malware. This evaluation will determine if a component found in your proxy repository has been identified to contain open source malware. The malware data being referenced is identified and supported by our malware intelligence. This analysis is run every 24 hours. Why can’t you tell me what the compromised components are? The analysis referenced above is only able to determine counts of open source malware. Exposing that malware data leaves your organization and Sonatype at risk as we require licenses or legal review to share and discuss the findings. Additionally, the specific details about the components containing malware would expose the ways your organization could be susceptible to exploits.

Again: please either publish the information on what component is affected, or remove the commercial banner (or implement it as dismissable).

Thank you in advance and have a great day,

Chris

post by christoph.keller on Nov 13, 2024

For all that suffer from this malware notification:

I found out that it is (perhaps) possible to disable this, by adding the following lines to the /nexus-data/etc/nexus.properties file (in case of a docker installation):

nexus.malware.risk.enabled=false
nexus.malware.risk.on.disk.enabled=false

WARNING: This just disables the malware warning banner and DOES NOT FIX the malware components (if any).

Can anyone confirm that this removes the banner? According to the source, this should be the feature flag for this.

Hope that helps anyone searching for a way to disable this warning.

post by izaak on Nov 15, 2024

Thank you Chris. This was very helpful and I can confirm that it removed the banner for us.

post by youngtristanza on Nov 15, 2024

Thank you for the help Christoph. I was able to remove the banner using the method you described.

post by sebastien_picavet on Nov 26, 2024

On our side, we have identified: Malware in fsevents · GHSA-xv2f-5jw4-v95m · GitHub Advisory Database · GitHub

Our malwares are all NPM/fsevents things.

Nexus gets its data from https://rhc.sonatype.com/rest/rhc/extras/maliciousContent/{NEXUS_ID} (can be found on logs) => it allows to identify the registry.

Then, we have scraped malware databases of GitHub: GitHub Advisory Database · GitHub

And for each entry, we have used Nexus API to check if we have one: https://it-dev-fr-nexus.intramatch.eu:8080/service/rest/v1/search?repository=npm-registry&name={MALWARE_COMPONENT}.

=> ~ 50 were identified (among 18000).

Finally, we have checked group/version one by one to identify fsevents.

post by christoph.keller on Dec 4, 2024

Follow-up for this topic:

The recently released version 3.75.0 introduces a dismiss button for the malware banner. Thank you, Sonatype, for listening to our feedback!

Details here: Release Notes.

post by jerryarn on Dec 5, 2024

Looks like the latest version (3.75.0) added the ability to suppress the banner for the current session only: Sonatype Nexus Repository 3.75.0 Release Notes.