# Find vulnerable and malicious dependencies

Large and complex projects usually have a number of third-party dependencies that enhance productivity by extending the functionality of common libraries and frameworks.

However, relying on third-party code raises security concerns, as it may involve the use of vulnerable dependencies in your project.

The bundled IntelliJ IDEA Package Checker plugin is powered by [https://www.mend.io/](https://www.mend.io/jetbrains-lp/?utm_source=JetBrains) The plugin analyzes Gradle, Maven, NPM, PyPI, and sbt dependencies for known vulnerabilities. It allows you to handle such cases by retrieving information about a vulnerable dependency and updating it to the latest released version.

Procedure: Enable the Package Checker plugin

This functionality relies on the [Package Checker](https://plugins.jetbrains.com/plugin/18337-package-checker)  plugin, which  is bundled and enabled in IntelliJ IDEA   by default. If the relevant features are not available, make sure that you did not disable the plugin.

1. Press `Ctrl+Alt+S` (Windows), `⌘ Comma` (macOS), `⌘ Comma` (IntelliJ IDEA Classic (macOS)), `⌘ Comma` (macOS System Shortcuts), `Ctrl+Alt+S` (XWin), `Ctrl+Alt+S` (GNOME), `Ctrl+Alt+S` (KDE), `Ctrl+Alt+S` (Emacs), `Ctrl+Alt+S` (Sublime Text), `⌘ Comma` (Sublime Text (macOS)), `Ctrl+Alt+S` (NetBeans), `Ctrl+Alt+S` (Visual Studio), `⌘ Comma` (Visual Studio (macOS)), `Ctrl+Alt+S` (Eclipse), `⌘ Comma` (Eclipse (macOS)) to open settings and then select `Plugins`.

2. Open the Installed tab, find the Package Checker plugin, and select the checkbox next to the plugin name.

[Video](https://www.youtube.com/v/RWtN4WNQsX4)

## Vulnerable dependencies

Procedure: Fix vulnerable dependencies in the editor

1. Open  `pom.xml` or `build.gradle`   in the editor.

The IDE highlights packages that are considered vulnerable.

2. Place the caret at a highlighted package and press `Alt+Enter` (Windows), `⌥ ⏎` (macOS), `⌥ ⏎` (IntelliJ IDEA Classic (macOS)), `⌥ ⏎` (macOS System Shortcuts), `Alt+Enter` (XWin), `Alt+Enter` (GNOME), `Alt+Enter` (KDE), `Alt+Enter` (Emacs), `Alt+Enter` (Sublime Text), `⌥ ⏎` (Sublime Text (macOS)), `Alt+Enter` (NetBeans), `Alt+Enter` (Visual Studio), `⌥ ⏎` (Visual Studio (macOS)), `Ctrl+1` (Eclipse), `⌘ 1` (Eclipse (macOS)) to see the suggested fixes. They may suggest updating to a safe version, visiting the [Mend.io](https://www.mend.io/) website to learn more about a particular vulnerability, or [ignoring](#ignore-vulnerabilities) the vulnerability.

![Change dependency](https://resources.jetbrains.com.cn/help/img/idea/2026.2/change_dependency.png)

Procedure: Analyze code to find all vulnerable dependencies

In addition, you can run an inspection to display the list of all declared and imported vulnerable dependencies in the project.

* In the main menu, navigate to `Code | Analyze Code | Vulnerable Dependencies`.

* Alternatively, right-click a folder or a file in the Project tool window `Alt+1` (Windows), `⌘ 1` (macOS), `⌘ 1` (IntelliJ IDEA Classic (macOS)), `⌘ 1` (macOS System Shortcuts), `Alt+1` (XWin), `Alt+1` (GNOME), `Alt+1` (KDE), `Alt+1` (Emacs), `Alt+1` (Sublime Text), `⌘ 1` (Sublime Text (macOS)), `Ctrl+1` (NetBeans), `Ctrl+Alt+L` (Visual Studio), `⌘ ⌥ L` (Visual Studio (macOS)), `Alt+1` (Eclipse), `Alt+1` (Eclipse (macOS)) (for example,  `pom.xml` or `build.gradle`  ) and select `Analyze | Vulnerable Dependencies`.

The result is displayed on the Vulnerable Dependencies tab of the Problems tool window (`View | Tool Windows | Problems` or `Alt+6` (Windows), `⌘ 6` (macOS), `⌘ 6` (IntelliJ IDEA Classic (macOS)), `⌘ 6` (macOS System Shortcuts), `Alt+6` (XWin), `Alt+6` (GNOME), `Alt+6` (KDE), `Alt+6` (Emacs), `Alt+6` (Sublime Text), `⌘ 6` (Sublime Text (macOS)), `Alt+6` (NetBeans), `Alt+6` (Visual Studio), `⌘ 6` (Visual Studio (macOS)), `Alt+6` (Eclipse), `⌘ 6` (Eclipse (macOS))) .

![Vulnerable Dependencies](https://resources.jetbrains.com.cn/help/img/idea/2026.2/ij_vulnerable_dependencies_tab.png)

For each vulnerability, you can see an indication of the severity. Click a specific dependency to see more information about the vulnerabilities that were found in that dependency.

> **Tip:**
> To see all project dependencies regardless of whether they are vulnerable or not, click the ![](https://resources.jetbrains.com.cn/help/img/idea/2026.2/app-client.expui.general.inspections.inspectionsEye.svg) button on the left panel of the Vulnerable Dependencies tab and select Show Safe Dependencies.

Procedure: Ignore vulnerabilities

Ignored vulnerabilities are added to a list in inspection settings. If required, you can share the profile with this list with other members of your team.

1. Open  `pom.xml` or `build.gradle`   in the editor, place the caret at a highlighted package, and press `Alt+Enter` (Windows), `⌥ ⏎` (macOS), `⌥ ⏎` (IntelliJ IDEA Classic (macOS)), `⌥ ⏎` (macOS System Shortcuts), `Alt+Enter` (XWin), `Alt+Enter` (GNOME), `Alt+Enter` (KDE), `Alt+Enter` (Emacs), `Alt+Enter` (Sublime Text), `⌥ ⏎` (Sublime Text (macOS)), `Alt+Enter` (NetBeans), `Alt+Enter` (Visual Studio), `⌥ ⏎` (Visual Studio (macOS)), `Ctrl+1` (Eclipse), `⌘ 1` (Eclipse (macOS)).

2. From the list of suggestions, select Ignore vulnerable <package name and version>, and in the dialog that opens, select a reason for ignoring the dependency. Click Ignore.

![Ignoring vulnerability](https://resources.jetbrains.com.cn/help/img/idea/2026.2/ij-ignore-vulnerability.png)

To access the list with ignored vulnerabilities, press `Ctrl+Alt+S` (Windows), `⌘ Comma` (macOS), `⌘ Comma` (IntelliJ IDEA Classic (macOS)), `⌘ Comma` (macOS System Shortcuts), `Ctrl+Alt+S` (XWin), `Ctrl+Alt+S` (GNOME), `Ctrl+Alt+S` (KDE), `Ctrl+Alt+S` (Emacs), `Ctrl+Alt+S` (Sublime Text), `⌘ Comma` (Sublime Text (macOS)), `Ctrl+Alt+S` (NetBeans), `Ctrl+Alt+S` (Visual Studio), `⌘ Comma` (Visual Studio (macOS)), `Ctrl+Alt+S` (Eclipse), `⌘ Comma` (Eclipse (macOS)) to open the IDE settings and then select `Editor | Inspections`. Expand the Security node and click Vulnerable declared dependency. The list is located in the Options section in inspection details.

Learn how to share inspection profiles from [Synchronize profiles between computers](customizing-profiles.html#sync-inspection-profiles).

## Find vulnerable APIs

The Vulnerable API usage inspection automatically highlights vulnerable APIs and open-source libraries right in your code. You can also [run the inspection manually](#find-all-vulnerable-apis) to get a report about all vulnerable APIs and open-source libraries in your project.

Procedure: Show vulnerable APIs in the editor

1. Hover over the detected problem in the editor.

A popup with vulnerability details appears.

2. Place the caret at the problem, press, and select Go to file with declared dependency.

You will be taken to the file in which the dependency is defined.

3. Place the caret at a highlighted package and press `Alt+Enter` (Windows), `⌥ ⏎` (macOS), `⌥ ⏎` (IntelliJ IDEA Classic (macOS)), `⌥ ⏎` (macOS System Shortcuts), `Alt+Enter` (XWin), `Alt+Enter` (GNOME), `Alt+Enter` (KDE), `Alt+Enter` (Emacs), `Alt+Enter` (Sublime Text), `⌥ ⏎` (Sublime Text (macOS)), `Alt+Enter` (NetBeans), `Alt+Enter` (Visual Studio), `⌥ ⏎` (Visual Studio (macOS)), `Ctrl+1` (Eclipse), `⌘ 1` (Eclipse (macOS)) to see the suggested fixes. They may suggest updating to a safe version, visiting the [Mend.io](https://www.mend.io/) website to learn more about a particular vulnerability, or [ignoring](#ignore-vulnerabilities) the vulnerability.

Procedure: Analyze code to find all vulnerable APIs

1. Press `Ctrl+Alt+Shift+I` (Windows), `⌘ ⌥ ⇧ I` (macOS), `⌘ ⌥ ⇧ I` (IntelliJ IDEA Classic (macOS)), `⌘ ⌥ ⇧ I` (macOS System Shortcuts), `Ctrl+Alt+Shift+I` (XWin), `Ctrl+Alt+Shift+I` (GNOME), `Ctrl+Alt+Shift+I` (KDE), `Ctrl+Alt+Shift+I` (Emacs), `Ctrl+Alt+Shift+I` (Sublime Text), `⌘ ⌥ ⇧ I` (Sublime Text (macOS)), `Ctrl+Alt+Shift+I` (NetBeans), `Ctrl+Alt+Shift+I` (Visual Studio), `⌘ ⌥ ⇧ I` (Visual Studio (macOS)), `Ctrl+Alt+Shift+I` (Eclipse), `⌘ ⌥ ⇧ I` (Eclipse (macOS)) or go to `Code  | Analyze Code | Run Inspection by Name…` in the main menu.

2. Type `Vulnerable API usage` and double-click the inspection to open the dialog with settings.

3. Select the scope of files that you want to analyze.

The File mask(s) option helps you narrow down the files to process. Specify one or more file name patterns using wildcards to match the files you want to include. Separate multiple file masks with commas.  Learn more from [Search in the specific file types](finding-and-replacing-text-in-project.html#exclude_type).

4. Click OK to run the inspection.

The result appears in the Problems tool window (`View | Tool Windows | Problems` or `Alt+6` (Windows), `⌘ 6` (macOS), `⌘ 6` (IntelliJ IDEA Classic (macOS)), `⌘ 6` (macOS System Shortcuts), `Alt+6` (XWin), `Alt+6` (GNOME), `Alt+6` (KDE), `Alt+6` (Emacs), `Alt+6` (Sublime Text), `⌘ 6` (Sublime Text (macOS)), `Alt+6` (NetBeans), `Alt+6` (Visual Studio), `⌘ 6` (Visual Studio (macOS)), `Alt+6` (Eclipse), `⌘ 6` (Eclipse (macOS))) from which you can navigate to the file with declared vulnerable dependencies, suppress the inspection, or [generate a report](resolving-problems.html#export-inspection-results).

## Report false positives

Procedure:

If you believe that a dependency identified as vulnerable is safe, you can report a false positive.

1. Click a dependency on the Vulnerable Dependencies tab of the Problems tool window (`View | Tool Windows | Problems` or `Alt+6` (Windows), `⌘ 6` (macOS), `⌘ 6` (IntelliJ IDEA Classic (macOS)), `⌘ 6` (macOS System Shortcuts), `Alt+6` (XWin), `Alt+6` (GNOME), `Alt+6` (KDE), `Alt+6` (Emacs), `Alt+6` (Sublime Text), `⌘ 6` (Sublime Text (macOS)), `Alt+6` (NetBeans), `Alt+6` (Visual Studio), `⌘ 6` (Visual Studio (macOS)), `Alt+6` (Eclipse), `⌘ 6` (Eclipse (macOS))) to open its description.

2. Locate the vulnerability that you want to report and click Report false positive.

You will see a notification with confirmation.

![Report false vulnerable dependency](https://resources.jetbrains.com.cn/help/img/idea/2026.2/report-false-vulnerable-dependency.png)

## Malicious dependencies

The Package Checker plugin features the Malicious dependency [inspection](#configure_inspections) that detects malicious NPM and PyPI dependencies declared in your project. Fixing the reported problems stops your software from being compromised by an attacker.

Procedure: Show malicious dependencies

* Open a file in which NPM or PyPI dependencies are declared.

The IDE highlights the dependencies that are considered malicious.

It is recommended that you remove the detected dependencies. Malicious dependencies data is provided by [Mend.io](https://www.mend.io/).

Procedure: Find malicious dependencies on commit

> **Note:**
> This feature is only available for [Git](using-git-integration.html) and [Mercurial](using-mercurial-integration.html).

1. Press `Alt+0` (Windows), `⌘ 0` (macOS), `⌘ 0` (IntelliJ IDEA Classic (macOS)), `⌘ 0` (macOS System Shortcuts), `Alt+0` (XWin), `Alt+0` (GNOME), `Alt+0` (KDE), `Alt+0` (Emacs), `Alt+0` (Sublime Text), `⌘ 0` (Sublime Text (macOS)), `Alt+0` (NetBeans), `Alt+0` (Visual Studio), `Alt+0` (Visual Studio (macOS)), `Alt+0` (Eclipse), `⌘ 0` (Eclipse (macOS)) to open the Commit tool window and click Show Commit Options ![the Settings button](https://resources.jetbrains.com.cn/help/img/idea/2026.2/app.expui.general.settings.svg).

2. Enable the Check malicious dependencies option.

![advanced commit options popup](https://resources.jetbrains.com.cn/help/img/idea/2026.2/ij_VCS_advanced_commit_options.png)

## Configure Security inspections

Procedure:

You can change the [severity](configuring-inspection-severities.html) of the Security inspections, enable and disable them, and configure problem highlighting in settings.

1. Press `Ctrl+Alt+S` (Windows), `⌘ Comma` (macOS), `⌘ Comma` (IntelliJ IDEA Classic (macOS)), `⌘ Comma` (macOS System Shortcuts), `Ctrl+Alt+S` (XWin), `Ctrl+Alt+S` (GNOME), `Ctrl+Alt+S` (KDE), `Ctrl+Alt+S` (Emacs), `Ctrl+Alt+S` (Sublime Text), `⌘ Comma` (Sublime Text (macOS)), `Ctrl+Alt+S` (NetBeans), `Ctrl+Alt+S` (Visual Studio), `⌘ Comma` (Visual Studio (macOS)), `Ctrl+Alt+S` (Eclipse), `⌘ Comma` (Eclipse (macOS)) to open settings and then select `Editor | Inspections`.

2. From the options on the right, select the Security node and select the name of the inspection.

Change the [severity](configuring-inspection-severities.html), scope, and [highlighting](configuring-inspection-severities.html#change_highlighting) as needed. Click OK to save the changes.