Plugin Supply Chain Security: What Every Team Should Enforce

--
title: "Plugin Supply Chain Security: What Every Team Should Enforce"
description: "Every DSH plugin install is a trust decision. Here are the six controls every team should enforce to stay safe."
tags: [plugin, supply-chain, security, devops]

canonical_url: https://dshquality.com/blog/plugin-supply-chain-security-team-enforcement

Every DSH plugin you install is a trust decision. The question isn't whether you'll trust someone else's code — it's whether your team has the controls in place to make that trust informed rather than reckless.

The Supply Chain Reality

The DSH plugin ecosystem has grown to 4,300+ plugins in under a year. That growth brings real risks:

• Abandoned plugins: Last push 18 months ago, but still installed
• Typosquatted packages: Names that look legitimate but belong to malicious actors
• Dependency confusion: A plugin depends on a package that doesn't exist on the official registry, so it pulls from a malicious source
• Compromised maintainers: A legitimate plugin author's account gets hacked, and the new owner pushes malicious code

These aren't theoretical. The npm ecosystem has seen dozens of supply chain attacks in the past two years alone.

What Every Team Should Enforce

1. Plugin allowlisting
Only install plugins from a pre-approved list. If it's not on the list, it doesn't get installed — period. This is the single most effective control.

2. Quality gate scoring
Use DSH Quality's scoring system to require a minimum score (e.g., B or higher) before any plugin can be installed in your environment.

3. Install script scanning
Every plugin's install script should be scanned for dangerous operations: rm -rf, curl | bash, access to sensitive paths. DSH Quality flags these automatically.

4. Dependency auditing
Check what your plugins depend on. A plugin that depends on 50 packages carries more risk than one that depends on 3.

5. Version pinning
Don't install the latest version by default. Pin to a specific version and update only after review.

6. Regular inventory audits
Quarterly reviews of all installed plugins. Remove anything that's unused, unmaintained, or below your quality threshold.

The DSH Quality Advantage

DSH Quality was built specifically to address these concerns. Our heuristic scanning checks:

• Install script safety
• Documentation quality
• Maintenance signals (last push, release frequency)
• Dependency health
• Ecosystem reputation (GitHub stars, npm metrics)

The result is a score you can trust — and a policy you can enforce.

FAQ

What score should my team require?
We recommend B or higher for production environments. A for critical infrastructure plugins. C may be acceptable for internal-only tools.

Can I automate the allowlist check?
Yes. DSH Quality provides a CLI that can be integrated into CI/CD pipelines to block installations that don't meet your criteria.

Visit dshquality.com to check any DSH plugin's quality score before installing.