> None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities Sonatype does if you pay $$$ for Firewall, but that only catches

> None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities Sonatype does if you pay $$$ for Firewall, but that only catches things installed via a package manager.