Skip to main content

SCA Scanner - Supported Languages and Package Managers

All languages and package managers that are supported for the SCA standalone platform are also supported when running the SCA scanner in Checkmarx One.

Notice

To understand how supported languages and package managers effect the scan process, see Understanding the Scan Process.

Notice

If you are using Checkmarx SCA Resolver, then you need to install the relevant package managers locally. For installation info, see Installing Supported Package Managers for Resolver.

Supported Languages and Package Managers

Java

download.png

JVM Languages: Java, Kotlin, Android, Groovy, Scala

Additional Frameworks: Struts, Spring

Repository: Maven Central, Sonatype, Apache

File Types: .jar

Supported Languages for Exploitable Path: Java

Package Managers

Vulnerability Support

Malicious Package Support

Manifest Files

Maven

Check_New.png

Check_New.png

pom.xml

Gradle

Check_New.png

MicrosoftTeams-image__1_.png

build.gradle , build.gradle.kts

Ivy

Check_New.png

MicrosoftTeams-image__1_.png

ivy.xml,

build.xml

SBT

Check_New.png

MicrosoftTeams-image__1_.png

build.sbt

JavaScript/TypeScript

6413713542.png

Languages/Frameworks: JavaScript, TypeScript, NodeJS, React, Angular, Apex

Tip

Apex is only supported when running the scan using Checkmarx SCA Resolver with the --extract-archives resource argument, see Checkmarx SCA Resolver Configuration Arguments.

Repository: NPM

File Types: .js

Supported Languages for Exploitable Path: JavaScript

Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files (Packages marked with (blue star) are required)

NPM

Check_New.png

Check_New.png

package.json(blue star) , package-lock.json1]

Yarn (and Yarn 2)

Check_New.png

Check_New.png

package.json(blue star) , yarn.lock(blue star)1]

Bower

Check_New.png

Check_New.png

bower.json

1] When a lock file is present in the project, SCA may use it to resolve dependencies. Therefore, it is important to keep the lock file up-to-date with any changes that you make in the manifest file.

.NET

6414401614.png

Languages/Frameworks: C#, F#, .NET, .NET Core, WCF, WPF, ASP.NET

Repository: NuGet

File Types: .dll

Supported Languages for Exploitable Path: C#

Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files

NuGet

Check_New.png

Check_New.png

*.csproj , packages.config, project.assets.json, packages.lock.json

Python

6414073972.png

Languages/Frameworks: Python, Django, Flask

Repository: PyPi

File Types: .egg, .whl

Supported Languages for Exploitable Path: Python

Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files (Packages marked with (blue star) are required)

PIP

Check_New.png

Check_New.png

requirements.txt, requirements-*.txt, requirement.txt, requirement-*.txt

Poetry

Check_New.png

Check_New.png

pyproject.toml(blue star), poetry.lock

Setuptools 1]

Check_New.png

Check_New.png

Setup.cfg, Setup.py

1] Setuptools is supported only when running scans using SCA Resolver.

PHP

6412632402.png

Languages/Frameworks: PHP, Dupal

Repository: Packagist

File Types: none

Exploitable Path: Not supported

Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files (Packages marked with (blue star) are required)

Composer

Check_New.png

Check_New.png

composer.json(blue star) , composer.lock

iOS

6413779054.png

Languages/Frameworks: Swift, Objective c

Repository: GitHub

File Types: none

Exploitable Path: Not supported

Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files (Packages marked with (blue star) are required)

SwiftPm

Check_New.png

Check_New.png

Package.swift, Package.resolved

CocoaPods

Check_New.png

MicrosoftTeams-image__1_.png

Podfile(blue star), Podfile.lock

Carthage

Check_New.png

MicrosoftTeams-image__1_.png

Cartfile(blue star), Cartfile.private, Cartfile.resolved

Tip

At least one .private or .resolved file must be included.

Go

6413877449.png

Languages/Frameworks: Go

Repository: Golang

File Types: none

Exploitable Path: Not supported

Supported Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files (Packages marked with (blue star) are required)

GoModules

Check_New.png

Check_New.png

go.mod(blue star), go.sum

Ruby

ruby.png

Languages/Frameworks: Ruby

Repository: RubyGems

File Types: none

Exploitable Path: Not supported

Supported Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files (Packages marked with (blue star) are required)

RubyGems

Check_New.png

Check_New.png

Gemfile(blue star), Gemfile.lock

Bundler

Check_New.png

MicrosoftTeams-image__1_.png

C++

download__1_.png

Languages/Frameworks: C, C++

Repository: Conan

File Types: .cpp, .c, .h, .hpp, .a, .o, .so

Exploitable Path: Not supported

Tip

C++ is supported only for File Analysis (fingerprints), not for package resolution.

Supported Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files

none

Check_New.png

MicrosoftTeams-image__1_.png

none

Unity

Unity_logo_PNG10.png

Languages/Frameworks: Unity

Repository:Unity Technologies, Needle-mirror, Open UPM

File Types: none

Exploitable Path: Not supported

Supported Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files (Packages marked with (blue star) are required)

none

Check_New.png

MicrosoftTeams-image__1_.png

manifest.json(blue star), packages.json(blue star)

Perl

Perl_Programming_Language.png

Languages/Frameworks: Perl

Repository: Cpan

File Types: .pl, .pm

Exploitable Path: Not supported

Supported Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files

Cpan

Check_New.png

MicrosoftTeams-image__1_.png

cpanfile, spcanfile.snapshot

Dart

Picture1.jpg

Languages/Frameworks: Dart, Flutter

Repository: N/A

File Types: none

Exploitable Path: Not supported

Supported Package Manager

Vulnerability Support

Malicious Package Support

Manifest Files

Pub

MicrosoftTeams-image__1_.png 1]

Check_New.png

pubspec.lock

1] Support of Pub is only for identifying malicious packages. Non-malicious packages are not shown at all in the Packages or Risks tabs.

In this section: