Your lockfile trusts a moving target.
One poisoned release or repointed CI tag can inherit your developer credentials and pipeline tokens. Supply Core quarantines fresh packages, verifies integrity, and rejects mutable references before they reach the build.
THE RECORD / 2025–2026
This is not hypothetical. It is quarterly.
Every incident below bypassed the defenses teams were told were enough. Each row names the control that closes it.
- MAY 2026
Mini Shai-Hulud / TanStack
42 packages, 84 artifacts. @tanstack/react-router at ~12M weekly downloads. PR → cache poisoning → OIDC token pulled from runner memory → publish. First npm attack carrying valid SLSA provenance.
Source: StepSecurity postmortem
SLSA alone is dead as a defense.
Age quarantine blocks the fresh publish; provenance on a poisoned artifact changes nothing.
- 2025–2026
Shai-Hulud v1 / v2 / v3
Self-replicating npm worm spreading through pre/postinstall scripts. Destructive payload triggers on token revocation — a naïve “revoke first” incident response burns the host.
Source: Public incident writeups
Install-time execution is the blast radius.
Frozen fallback installs a known-good version instead of the fresh, worm-carried release.
- 2026
PyTorch Lightning / axios / LiteLLM
Compromised releases were being pulled within 6–42 minutes of publish. Registry-side detection and takedown cannot move faster than CI.
Source: Public incident writeups
Publish-to-pull windows are measured in minutes.
Publish-age policy treats every too-fresh release as hostile until it clears quarantine.
- NOV 2025
shanhai666 / NuGet
9 packages, ~9.5k downloads, ~99% functional cover, time bombs scheduled for 2027 and 2028. Sharp7Extend typosquats the Siemens S7 PLC library. A slow-burn class that defeats install-time scanning.
Source: Public disclosure writeup
Malware that waits years looks clean today.
OSV advisory checks and contentHash verification on packages.lock.json catch drift when the record catches up.
- MAR–APR 2026
Trivy + Bitwarden CLI / TeamPCP
Same actor as the TanStack attack. Entry was pull_request_target plus a tag force-push — not a dependency at all. The defense surface is bigger than dependencies.
Source: StepSecurity postmortem
Mutable CI references are a supply chain too.
scan-actions and scan-pipelines reject anything not pinned to a full 40-character SHA.
EVIDENCE / CLI POLICY
A risky reference reaches CI. The build stops.
FLOW / PACKAGE QUARANTINE
- 01A new dependency release appears on the public registry.
- 02Supply Core checks publish age, integrity, and OSV advisories.
- 03A release outside policy is quarantined before install.
- 04A known-good version satisfying the range keeps the build moving.
SCOPE / SUPPORTED MATRIX
The controls are specific. So is the coverage.
| Target | Input | Checks | Command |
|---|---|---|---|
| npm | package.json | age quarantine · integrity · OSV · frozen fallback | snapshot-npm |
| PyPI | requirements.txt exact pins | age · sha256 · hash validation · OSV | snapshot-pip |
| NuGet | packages.lock.json | age · contentHash verification · OSV | snapshot-nuget |
| GitHub Actions | .github/workflows/* | full 40-character SHA pinning | scan-actions |
| Azure Pipelines | azure-pipelines*.yml | task and external checkout pinning | scan-pipelines |
| Docker | Dockerfile and compose | static sha256 digest pinning | scan-docker |
TRUST / LOCAL-FIRST
Your machine is the firewall.
- Package policy runs through a local caching proxy.
- A daily macOS radar inventories lockfiles and checks OSV.dev with a local 24-hour cache.
- No SaaS account, cloud dashboard, agent daemon, or telemetry.
- An optional self-hosted service supports remote scans and a minimal quarantine dashboard.
HONEST LIMITS
No dynamic malware analysis. No registry age or CVE lookup for Docker images. Cargo, Go modules, Maven/Gradle, RubyGems, pnpm, bun, and Yarn Berry are not yet covered. The repository describes the current release as an MVP, not a production-hardened fleet platform.
POSTURE / DEFENSE IN DEPTH
One tool is a control. A posture is layers.
Supply Core owns the quarantine-proxy layer. The rest of the stack ships free today — every v1 option below is a standalone CLI or self-hosted open source, with no SaaS account and nothing leaving your perimeter. Commercial fall-backs are named for the day your re-evaluation data justifies them.
| Layer | v1 — free, ship now | Commercial fall-back |
|---|---|---|
| Quarantine proxyTHIS PROJECT | Supply Core — age quarantine, integrity, OSV, frozen fallback. Azure Artifacts upstream + feed retention + OSV-Scanner daily diff. Evaluate Nexus Repository OSS if Azure Artifacts controls aren't enough. | Sonatype Firewall — best NuGet coverage, EU/IE fintech references. |
| Behavioral scanner | GuardDog on lockfile PRs + OSV-Scanner malicious-packages feed, daily + Supply-Chain Firewall (scfw) on dev machines. Standalone CLIs — no SaaS, no vendor account, despite Datadog maintainership. | Socket — broadest coverage, install-time gate, reachability analysis. |
| Runtime monitoring | Falco (CNCF open source). | No commercial layer needed. |
| AI PR review | Metis (self-hosted open source) + local Ollama models. No per-token cost, nothing leaves the perimeter — clean against IS 04.1 since the model is local. | Datadog AI-SAST / GitHub Advanced Security AI. |
Security software should survive your inspection.
Read the source, review the threat model, and run the checks locally. Trust is earned in code, not a dashboard badge.