Supply chain
Controls that run before the build
Scanning a build artefact tells you what you already shipped. These controls act at fetch time.
Provenance verification
npm sigstore attestations, PyPI PEP 740 attestations, Go checksum database, Maven GPG. A package whose attestation does not match its claimed source repository is quarantined and the team is told which dependency introduced it.
Quarantine window
Hold new versions for up to 72 hours while advisory feeds catch up. Most malicious releases are pulled within hours; a 24-hour hold removes most of the exposure at a cost of a day's delay on updates.
Typosquat detection
Names within a short edit distance of a package you already depend on are flagged before resolution, which catches the single most common attack shape.
Continuous inventory
Every dependency, every version, every repository that pulled it, with licences. Exportable as SPDX or CycloneDX, or queried through the API when an advisory lands.
Recent quarantine actions
Anonymised, across all customers, last 30 days.
| Package | Ecosystem | Reason | Held for | Outcome |
|---|---|---|---|---|
| •••-utils | npm | provenance mismatch | permanent | blocked |
| •••-parser | PyPI | advisory during hold | permanent | blocked |
| •••logger | npm | typosquat, distance 1 | review | flagged |
| •••-sdk | npm | quarantine window | 24 h | released |
| •••-core | Maven | unsigned artefact | review | flagged |
| •••crypt | RubyGems | advisory during hold | permanent | blocked |