DEV Community

Discussion on: Watching RubyGems.org in Real Time

Collapse
 
automate-archit profile image
Archit Mittal

Real-time visibility into a package registry is one of those supply-chain signals that more ecosystems should surface publicly — npm's been the loudest cautionary tale but PyPI and gems both see the same typosquat / hijack patterns. Even a simple "first publish from a new maintainer on an existing gem" alert would catch a lot of attacks early. Are you correlating the firehose with historical maintainer patterns, or treating each event independently for now?

Collapse
 
cseeman profile image
christine

Good question Archit, and I think this is a good callout. This post was really about the roadmap announcement rather than any real-time monitoring work.

For what it's worth on the ecosystem side: RubyGems.org exposes activity endpoints (/api/v1/activity/just_updated.json and /latest.json) plus the public /releases page, but those are pull-based rather than a true firehose. I'm not aware of an official stream, and I don't see maintainer-pattern correlation called out on the public roadmap specifically, though "security tooling" is listed as longer-term work. That kind of "first publish from a new maintainer"
alert feels like the sort of thing adding on the GitHub project board if it's not already there.

There are some commercial supply-chain scanners (Socket, Phylum) that do some of this today, but having it surfaced publicly by the registry would be a different level of signal, and would be a good thing.