This article covers Supply Chain Defense, which detects malicious or compromised files inside the software packages your applications rely on, and remediates them automatically when protection is enabled.
What Is Supply Chain Defense?
Modern applications are built on code written and published by other people (or other agents). A single Node.js application can pull in hundreds of npm packages. If one of those packages ships malware, through a hijacked maintainer account or a tampered release, every application that installs it inherits the threat.
Supply Chain Defense brings those package-related threats into the same on-disk malware detection you already use. Monarx scans the files on your server, our Threat Research team classifies package-related threats through the same process as all other malware, and matching findings are labeled Supply Chain Defense so you can find and investigate them separately.
đĄ Initial focus: npm / Node.js package files. Coverage grows as additional files are ingested and classified.
What It Does (and Doesn't Do)
Supply Chain Defense looks for malware in package files. It does not look for vulnerable versions.
Detects malicious or compromised files inside installed packages, whatever their version number.â
Keeps the normal classification. A finding is still Malicious or Compromised; Supply Chain Defense is an additional designation.
Records detections even when remediation is off, so you always have visibility.
Remediates individual files: malicious files are quarantined and eligible compromised files are cleaned.
Supply Chain Defense does not:
Check packages against CVEs or tell you which packages are out of date.
Produce a package inventory, dependency graph, or SBOM.
Upgrade packages, edit
package.jsonor lockfiles, or remove whole package directories.Block
npm install, deployments, or CI/CD pipelines.
For more on this, see Does Supply Chain Defense Check for Vulnerable Packages?
How Remediation Works
Detection and automatic remediation are separate. Automatic remediation of Supply Chain Defense findings requires both Active Protection and Supply Chain Defense remediation to be enabled for the affected account.
Active Protection | Supply Chain Defense remediation | What happens |
Off (detect only) | On or off | Detected and recorded. No automatic remediation. |
On | Off | Detected and recorded. No automatic remediation of Supply Chain Defense findings. |
On | On | Eligible files are remediated automatically. |
Malicious files are quarantined.
Compromised files are cleaned. If a file can't be cleaned safely, it stays detected without automatic action so you can review it.
This is file-level remediation. It removes the threat from the file on disk, but it does not update the package itself. The application owner may still need to reinstall or upgrade the affected package.
To change the setting, see How Do I Enable Supply Chain Defense Remediation?
Where to Find Supply Chain Defense Findings
Monarx Web App: Dashboard
The Supply Chain Defense card on the Dashboard shows the number of files detected and a detection trend for the selected scope. Click through to Files to investigate.
đˇ Review note: screenshot shows the previous "Supply Chain Poisoning" label and sample data. Replace after the rename ships.
đĄ The count is the number of files detected. It is not a count of packages, vulnerabilities, or attacks prevented.
Monarx Web App: Files
On the Files page, the Feature column identifies Supply Chain Defense findings, while the Classification column still shows Malicious or Compromised. Use the path, user, and other filters to investigate as you would any other detection.
đˇ Review note: screenshot shows the previous "Supply Chain Poisoning" label and sample data. Replace after the rename ships.
Plugin / iframe View
In the end-user plugin and iframe view, the Supply Chain Defense card shows Detected files, the malicious/compromised breakdown, and a status banner. View All opens the list of individual files with their filename, path, owner, timestamp, and classification.
đˇ Review note: screenshots show the previous "Supply Chain Poisoning" label and sample data. Replace after the rename ships.
Understanding the Status Banner
The status banner in the plugin/iframe view reflects all malware findings, from both the Malware card and the Supply Chain Defense card. It does not, by itself, tell you which card has outstanding findings.
Action required / attention needed: There are unremediated findings in Malware, Supply Chain Defense, or both. Review the file lists to see what needs attention.
No action required: All malware findings have been remediated, including Supply Chain Defense findings. Detection history may still be shown.
No Supply Chain Defense detections: No Supply Chain Defense findings are reported. This says nothing about findings in the Malware card.
Unavailable or missing data: Status is unknown. Missing data does not mean everything is clean.