SOFTWARE SUPPLY CHAIN SECURITY
By the time your scanner flags it, the code has already run.
Open-source package ecosystems are under sustained attack. Repository takeovers, typosquatting, dependency confusion, and compromised maintainer credentials introduce malicious code into packages that build pipelines pull automatically, without inspection, thousands of times a day. By the time a Software Composition Analysis tool flags the vulnerability, the post-install hook has already executed on your build node.
Why the threat is accelerating
Software supply chain attacks have grown faster than the security tooling designed to stop them:
Build pipelines pull automatically and at scale
CI/CD automation fetches third-party packages without human review on every build, across hundreds of concurrent runners. The attack surface is not a developer occasionally installing a package but thousands of automated pulls per day from ecosystems where any package can be published by anyone.
Zero-day windows are measured in hours
New package versions are published continuously. The window between a malicious package appearing in a public registry and automated pipelines pulling it can be minutes. Scanners that flag vulnerabilities after ingestion offer no protection during that window.
Namespace and typosquatting attacks exploit automation
Packages with names one character away from legitimate internal dependencies, or packages published under corporate namespace prefixes they don't own, are pulled automatically by pipelines that don't distinguish them from the real thing.
What post-ingestion security costs your teams
CISO and security director
Every hour between a malicious package being pulled and a scanner flagging it is an hour of undetected exposure across every build node that ran that pipeline.
Platform team lead
Existing compliance initiatives that slow delivery pipelines create friction that engineering teams work around. Security tooling that developers bypass is worse than no tooling because it creates a false assurance of coverage while leaving the actual gaps open.
Compliance director
Fragmented security enforcement across disconnected build environments makes unified auditing impossible. Proving what packages entered your environment, when, and whether they were evaluated against policy requires centralized, real-time logging at the ingestion point.
Why passive security tools leave exposure gaps
Challenge 1
Generic proxies pass packages without inspection
Standard reverse proxies and corporate firewalls have no awareness of package manifest schemas, namespace conventions, or ecosystem-specific attack patterns. They forward requests without evaluation.
Challenge 2
SCA scanners react after the threat has landed
Post-event scanning runs after packages are already on internal drives. Malicious post-install hooks and installation scripts execute during the pull, before any scanner sees the package. Flagging the vulnerability after execution is incident response, not prevention.
Challenge 3
Local developer configurations are easily bypassed
Restricting downloads via workstation config files requires every developer to maintain compliant configurations that can be modified, disabled, or accidentally misconfigured. Individual bypass is a permanent gap in perimeter enforcement.
Challenge 4
Signed and verified doesn't mean safe
Attackers no longer bypass trust controls, they abuse them instead. Compromised maintainer accounts and poisoned pipelines publish malicious versions through the expected, signed release path, so tools that act only on known threats let a brand-new malicious version walk straight into the build.
How Varnish Artifact Firewall secures the ingestion point
Varnish Artifact Firewall is a vendor-neutral runtime security layer governing dependency requests across npm, PyPI, Maven, and NuGet. It sits in front of Artifactory, Nexus, and GitHub Packages to evaluate every request the moment it is made, with no added latency, and stop non-compliant packages before they enter your environment:
01
Inline request evaluation at the moment of pull |
Dependency requests are evaluated in real time against hourly-refreshed OSV intelligence and scaling to hundreds of thousands of entries with zero added latency. Denied packages get an immediate 403; risky versions are hidden from "latest" so unpinned installs steer to safe versions. Direct artifact downloads are preflight-checked, so a denied version can't be pulled by hardcoding its URL. One single, un-bypassable enforcement path. |
02
Time-based quarantine windows for new releases |
Newly published package versions are held for a configurable quarantine window before pipelines resolve them, giving the open-source community time to flag malicious uploads before runners encounter them. Since 2024, 97% of attacks on trusted packages appeared on OSV within 48 hours; 100% of the high-profile ones. A short hold closes the zero-day window before your builds open it. |
03
Namespace shielding against dependency confusion |
Public registries are blocked from serving packages that use designated corporate namespace prefixes. Internal package scopes are isolated — no public package can masquerade as an internal dependency, regardless of how closely the name matches. |
04
Policy-as-code across every build environment |
Security rulesets are managed as declarative YAML files, versioned in Git, and distributed uniformly across every build environment in the enterprise. Updates sync on a defined interval and reload without interrupting service. Report mode lets you see what a ruleset would block before you enforce it. Audit logs record which packages were allowed, hidden, quarantined, or denied, across every ecosystem, every runner, every pipeline. |
Varnish Artifact Firewall
Supply chain enforcement without slowing down pipelines
Artifact Firewall is a vendor-neutral runtime security layer designed to protect your software supply chain by governing every dependency request. Sitting in front of the registries and repository managers you already run (such as Artifactory, Nexus, or GitHub), it evaluates requests across npm, PyPI, Maven, and NuGet the moment a package is requested.
By managing policies as declarative, Git-versioned YAML rulesets, security teams can easily extend standard OSV baselines with custom internal compliance rules. The engine can be deployed as a standalone security gateway or integrated natively with Varnish Virtual Registry to combine in-path policy enforcement with high-speed artifact caching.
Resources and media
-
Enforcing npm security across distributed CI/CD pipelines
How to enforce package version governance and pipeline security across distributed teams, before compromised packages spread
-
Rate-limit proofing your Kubernetes workflows
Software supply chains fail the moment a critical CI/CD pipeline stalls or a scaling event fails due to a 429 Too Many Requests error
-
How virtual registries secure, control and strengthen CI/CD artifacts
You’ve optimized your code. You’ve automated your tests. You’re using the latest CI/CD tools. So why are your builds still slow?
-
Accelerating secure CI/CD pipelines in highly regulated industries
A strategy guide for securing and accelerating software delivery in financial services, healthcare, critical infrastructure.
Read more →
Next steps
Talk to our team to learn more about Varnish Artifact Firewall.
