Most supply chain security tools react. They scan your package-lock.json or go.sum, flag known vulnerabilities, and let you decide whether to upgrade. By the time Snyk or Dependabot alerts you, the dependency is already in your codebase. If it’s malicious, it’s too late.
I started testing supply-core. It’s an open-source tool that flips this logic. Instead of detecting vulnerabilities after installation, it prevents live CVEs from hitting production by quarantining new dependencies by default.
The problem with reactive detection
The standard workflow looks like this:
npm install <new-package>- Package is downloaded and executed (post-install scripts run).
- CI/CD pipeline runs a scanner.
- Scanner reports a CVE.
- Developer investigates and remediates.
Step 2 is the risk window. If a package contains a malicious payload or a critical zero-day that hasn’t been indexed yet, it executes in your environment before any scanner sees it. There is always a gap between publication and detection.
How supply-core works
supply-core inserts a gate before step 2 completes. It isolates rather than just scanning.
- Quarantine by Default: When you request a new dependency, it stays out of your main dependency tree. It goes into quarantine.
- Scan: The tool performs security checks on the quarantined artifact.
- Release: The dependency enters your active project only after passing the scan.
This moves security from detection to prevention. No unverified code enters your production build pipeline.
The trade-offs
This model adds friction. You need to know if it fits your workflow:
-
Slower Onboarding: You can’t blindly
installpackages. Every new dependency needs verification. This slows initial prototyping but speeds up long-term maintenance. - False Positives: Aggressive quarantine may block legitimate packages if scan rules are too strict. You will need to tune it.
- Workflow Change: Teams used to trusting the npm/pypi ecosystem must adapt to a zero-trust dependency model.
These aren’t bugs. They are features of a prevention-first system. You pay for convenience upfront with security.
Why this matters for platform engineers
For tech leads and AppSec engineers, the goal is simple: reduce the blast radius of supply chain attacks.
By quarantining dependencies by default, you eliminate vulnerabilities that slip through reactive scanners because they never executed in your production environment. It enforces security policies at the point of entry.
Try it out
The project is open source on GitHub. Review the code to understand the quarantine mechanism and see if the trade-offs match your team’s risk tolerance.
If you are tired of chasing CVEs after they land in your repo, this is a concrete alternative. It doesn’t catch everything. It stops the ones that matter most: the ones that never get the chance to run.
Top comments (0)