Skip to main content
Semgrep’s Security Research team monitors the open source ecosystem and responds in real time when a package is compromised, publishing an Advisory as soon as an incident is confirmed. If you’ve configured the Early notification for Supply Chain incidents policy, Semgrep automatically posts to a Slack channel or webhook of your choosing within minutes of declaring the incident. Semgrep checks the compromised package versions against your projects’ most recent dependency data and tells you whether any of them are affected in the same notification. You are notified every time Semgrep declares a new supply chain incident, whether or not any of your projects use the affected packages. For eligible projects, Semgrep starts a new Supply Chain scan when it declares the incident. This ensures that the results in Semgrep AppSec Platform reflect the current state of your code. To reduce scan time, Semgrep runs only the rules associated with the incident, leaving your other Supply Chain findings unchanged.
A project is scanned automatically when it meets all of the following conditions:
  • The project is onboarded to Semgrep Managed Scans and set up to run Supply Chain scans.
  • At least one of the project’s dependencies belongs to an ecosystem affected by the incident. For example, during an npm compromise, projects with npm dependencies are rescanned.
Projects that don’t meet these conditions are still checked against your most recent dependency data for the notification itself. To scan them, see Initiate scans on potentially affected projects.

​
Prerequisites

Ensure that:

​
Set up incident notifications

The Early notification for Supply Chain incidents policy, showing its condition (Supply chain incident declared) and action (Send a Slack message)

The Early notification for Supply Chain incidents policy on the Policies page.

1
In Semgrep AppSec Platform, go to Rules & Policies > Policies.
2
Find the policy named Early notification for Supply Chain incidents. Click its icon, then select Edit policy.
3
Set up which Actions occur when a Supply Chain incident is declared by clicking on the Add action button. You can choose multiple Actions, including:

Send a Slack message

Call a webhook

4
Click Update.
5
You will be redirected back to the Remediation policies page. Click the policy’s icon, then select Enable policy.

​
What to do during an incident

Every notification includes a View incident advisories button that takes you to the Advisories page, filtered to that incident. A View blog post button appears when Semgrep has published a blog post about the incident.
1
Click View incident advisories to see the list of related advisories, including compromised packages and versions.
2
If your notification lists affected projects, initiate a scan on them to confirm and get up-to-date findings. Projects that are eligible for automatic rescanning are already being scanned, so you don’t need to start those scans yourself.
3
Remove or upgrade any compromised dependencies you find, then re-scan to confirm the findings clear. See Detect and remove malicious dependencies for remediation guidance.

Malware incident response with Semgrep Supply Chain

Detect and remove malicious dependencies