Keep bad packages out
Integrity alerts and quarantine
The digest a file is first seen with is the one it keeps. If the same file comes back from the same registry with different bytes, the original keeps being served and somebody is told.
Two kinds of alert. Published digest changed: a fresh npm packument lists a different sha512 for a version already cached, or a PyPI page lists a different sha256. Caught when the metadata is fetched, with nothing downloaded. Downloaded bytes changed: the file was fetched again and hashed to something else. The new bytes are kept aside. If the original is still on disk it keeps being served, otherwise the download is refused with a 502 until someone decides.
Nothing is swapped on its own. An admin keeps the original, or accepts the change, and the decision and the note land in the audit trail.
Quarantine
Quarantine holds back one exact file until an admin decides. Files get there from integrity alerts, from malware verdicts, from license enforcement, from INVALID provenance, from a fresh npm publish, twine upload, dotnet nuget push or pushed image (each held until its malware scan is clean, or an admin releases it), or because an admin pressed Hold. In permissive mode a held file is still served with a QUARANTINE notice in the npm output. In strict mode it is refused and left out of metadata, so a client resolving a range picks something else. Holds belong to the file, not the cached copy, so purging and downloading again does not get around them.
In short
- The first digest seen is the one that counts
- Changed bytes are held aside, the original keeps serving
- Permissive or strict quarantine, per box
- Release or reject, always with the audit trail
- Shown on the dashboard, in the hourly admin digest and as SIEM events
In the documentation
- Quarantine and integrity alerts Administrator Guide
Goes well with
- Malware scanning ClamAV, a hash blocklist, your own scanner and the OpenSSF known malicious feed, on every cached file. Optionally before the first download.
- Provenance verification npm SLSA provenance and PyPI PEP 740 attestations checked against Sigstore, offline, on the box.
- Kill switch Take a package, a version range, one file hash or a whole advisory away from everyone, at once.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.