> None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities

Sonatype does if you pay $$$ for Firewall, but that only catches things installed via a package manager.