# Scanning NIX packages with Sonatype (Nexus IQ) CLM scan tool

**URL:** https://discourse.nixos.org/t/scanning-nix-packages-with-sonatype-nexus-iq-clm-scan-tool/35583
**Category:** Security
**Created:** [November 16, 2023, 3:48pm UTC](https://discourse.nixos.org/t/scanning-nix-packages-with-sonatype-nexus-iq-clm-scan-tool/35583 "2023-11-16T15:48:43Z")
**Posts on this page:** 1
**Showing post:** 12

<div class="post-metadata">

### Author: ![fricklerhandwerk](https://discourse.nixos.org/user_avatar/discourse.nixos.org/fricklerhandwerk/32/2029_2.png) [@fricklerhandwerk](https://discourse.nixos.org/u/fricklerhandwerk)
#### Post date: [September 6, 2024, 3:05pm UTC](https://discourse.nixos.org/t/scanning-nix-packages-with-sonatype-nexus-iq-clm-scan-tool/35583/12 "2024-09-06T15:05:36Z")

</div>

This is not all that theoretical any more, and exactly what the security tracker started with the [Nixpkgs supply chain security project](https://discourse.nixos.org/t/nixpkgs-supply-chain-security-project/34345/) is supposed to enable.

> **[GitHub - Nix-Security-WG/nix-security-tracker: Web service for managing...](https://github.com/Nix-Security-WG/nix-security-tracker)**
>
> Web service for managing information on vulnerabilities in software distributed through Nixpkgs - Nix-Security-WG/nix-security-tracker

It already implements a basic workflow of tying CVEs to packages and maps maintainer status to write permissions. Progress is much slower than anyone likes it though, but I think we’ll get there eventually.

---

_[View the full topic](https://discourse.nixos.org/t/scanning-nix-packages-with-sonatype-nexus-iq-clm-scan-tool/35583)._