Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Veracode announced that it acquired technology from Phylum Inc. to help detect and block malicious open-source packages—not that it bought the entire Phylum company. Veracode said it planned to integrate the technology with its Software Composition Analysis (SCA) offering and policy controls, extending its defenses against harmful code in software dependencies.
What did Veracode acquire from Phylum?
The acquisition announcement describes the deal as the purchase of Phylum Inc.’s technology. It does not establish that Veracode acquired the whole company, and it does not state the purchase price, closing date or detailed transaction structure. Veracode framed the technology as a way to strengthen software-supply-chain security and add malicious-package analysis to its security capabilities. Veracode’s acquisition announcement
How is the technology intended to detect malicious packages?
Veracode describes Phylum’s technology as a package-management firewall backed by a database of malicious packages. Its stated approach is to scan and analyze third-party libraries when they are published, helping identify and block malicious packages before they enter development environments. The announcement cites potential harms including credential or personal-data theft and remote code execution.
Veracode said the capability would work with its customizable policy engine and integrate with its SCA offering. That combination is intended to let organizations apply policy controls to package risks as part of their development workflows. These are Veracode’s product descriptions; the announcement is not an independent evaluation of detection accuracy or effectiveness.
#1 Best Overall
What does Veracode Software Supply Chain Intelligence include?
Veracode’s Software Supply Chain Intelligence (SSCI) API documentation describes a curated view of malware in monitored open-source ecosystems. It says an automated risk-analysis platform identifies packages, which are then triaged and reviewed by researchers. The documentation describes two feeds:
- Threat feed: information about malicious packages.
- Reputation feed: information covering malicious packages, vulnerabilities and license data.
The same documentation says Veracode is transitioning infrastructure from Phylum to the Veracode Platform and will provide an update when that work is complete. It does not establish that the transition has finished. See the SSCI API documentation for the described API and feeds.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What figures has Veracode reported?
Veracode’s 2025 datasheet reports nearly half a million malicious packages and 2,500 targeted malware campaigns. It also claims that its technology detects 60% more malicious packages than competitors. That last figure is a vendor comparison; the datasheet figures do not independently validate the comparative claim or establish its methodology.
Veracode CTO Jens Wessling said the technology “will shorten the window of opportunity for attackers by automating the entire process of malicious code analysis.” This is Veracode’s stated rationale, not a measured outcome. Veracode’s 2025 SSCI datasheet
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Best Value
What remains unclear about the acquisition and product?
- The acquisition announcement does not disclose the price, closing date or detailed transaction structure.
- It describes an acquisition of technology, not a purchase of the entire Phylum company.
- The announcement’s plan to release capabilities through the first half of 2025 was a roadmap statement, not confirmation of an exact launch date or current availability.
- The cited materials do not establish current SSCI pricing or packaging, independent validation of the 60% comparative detection claim, or completion of the Phylum-to-Veracode infrastructure transition.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
