FrontGate: a Lightweight Package Proxy for Supply Chain Security

<p>GitLab introduced Dependency Firewall in early access at its Transcend event. It is a policy layer that blocks malicious, vulnerable and non-compliant packages before they

<p>A few months ago, I was doing something completely normal. I needed a small Python library. So, I did what every Python developer does:<br /> </p> <div class="highlight

<p>In May 2026, a worm called Shai-Hulud compromised 42 TanStack packages — including <code>@tanstack/react-router</code>, a library sitting in millions of JavaScript projects. It

<h2> Introduction </h2> <p>AI coding assistants like GitHub Copilot, Cursor, Codeium, and Amazon CodeWhisperer now power a significant portion of modern software development and

<p>Bitwarden serves over 10 million users and 50,000 businesses. On April 22, 2026, for exactly 93 minutes, its CLI was shipping malware.</p> <p>This was not a phishing campaign.

<h2> The risk in one paragraph </h2> <p>Every time your team deploys software to AWS, a pipeline authenticates with credentials that can modify production infrastructure. In most

<p>Three incidents landed in five days this week. Different attack surfaces, different techniques, different threat actors. What they have in common is that none of them required

<h2> Which software artifact should we trust? </h2> <p>Software package registries are open to the public, they essentially allow anyone really to share there libraries and code.