[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFLsk7xo1byhLG4IwvyqVRvAR4Eb-ojP9PrROQS5GQ-4":3},{"article":4,"iocs":50,"watch_terms":59,"solutions":60,"lesson":90},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"8c2c4acc-9dfd-45f0-a23d-8adeb3422f56","GitHub Package Firewall vs. StepSecurity Secure Registry: Protection beyond npm","github-package-firewall-vs-stepsecurity-secure-registry-protection-beyond-npm-26f75d","GitHub’s package firewall covers npm only. StepSecurity's Secure Registry protects 8 ecosystems, traces every install, and blocks malicious packages within an hour","GitHub has introduced a package firewall in public preview to check npm packages against enterprise policies before installation. StepSecurity's Secure Registry offers broader protection across eight ecosystems, logs package installations with source attribution, and blocks malicious packages within an hour via its threat intelligence team and SOC. Secure Registry also manages package version cooldowns and enforces its use on developer machines and CI runners.","GitHub launches package firewall for npm; StepSecurity Secure Registry offers broader ecosystem protection.","https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Fgithub-package-firewall-vs-stepsecurity-secure-registry-protection-beyond-npm","https:\u002F\u002Fcdn.prod.website-files.com\u002F673b71f0790aabf30bd30bf8\u002F6af3e062da9e8861d4a6f7d0_Covernew2_Artboard%20B.jpg","2026-11-11T03:34:49+00:00","2026-11-11T04:00:17.555123+00:00",7,[17,20,23,25,27,30],{"name":18,"type":19},"Package Firewall","product",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":19},"Secure Registry",{"name":26,"type":22},"StepSecurity",{"name":28,"type":29},"npm","technology",{"name":31,"type":29},"PyPI","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[51,55],{"type":52,"value":53,"context":54},"malware","litellm","Compromised release of litellm on PyPI stole credentials.",{"type":56,"value":57,"context":58},"domain","registry.npmjs.org","Example of a public registry that CI runners might bypass.",[21,26,18],{"controls":61,"vendors":89},[62],{"slug":63,"name":64,"problem":65,"products":66},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":84,"product_name":85,"url":87,"description":88},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[],{"slug":91,"title":92,"body":93,"framework_refs":94,"framework_notes":100},"open-source-package-registries-require-active-threat-filtering-not-just-policy-checks","Open-Source Package Registries Require Active Threat Filtering, Not Just Policy Checks","Organizations that rely on public package registries like npm expose themselves to supply chain attacks when malicious packages are published or when developers install unvetted dependencies without inspection. GitHub's new package firewall helps enforce enterprise policies, but policy-based checks alone are insufficient if they lack real-time threat intelligence and broad ecosystem coverage. StepSecurity's approach of combining SOC-backed threat intelligence, rapid blocking (within an hour), installation logging with source attribution, and coverage across eight ecosystems illustrates the depth of control required. Without proactive registry filtering and logging, a single malicious package pulled during a CI\u002FCD build or on a developer machine can compromise an entire software supply chain before the threat is even identified.",[95,96,97,98,99],"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools","CIS Control 16: Application Software Security (v8)","NIST SP 800-53 SR-4: Provenance","NIS2 Article 21(2)(d)","NIST CSF 2.0 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events",{"NIS2 Article 21(2)(d)":101,"NIST SP 800-53 SR-4: Provenance":102,"CIS Control 16: Application Software Security (v8)":103,"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools":104,"NIST CSF 2.0 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events":105},"NIS2's supply chain security point requires entities to address security risks arising from relationships with suppliers and service providers, including third-party software components pulled from public registries.","SR-4 requires organizations to document and verify the provenance of components in their supply chain, which registry logging with source attribution directly supports.","CIS Control 16 requires organizations to manage the security of software they use, including vetting third-party components and libraries before they are introduced into the environment.","This technique describes adversaries inserting malicious code into open-source packages, exactly the threat that registry firewalling and threat-intelligence blocking are designed to detect and prevent.","Logging every package installation with source attribution and triggering alerts on anomalous registry access is precisely the continuous monitoring this category mandates."]