StepSecurity Launches Secure Registry for Install-Time npm Supply-Chain Controls
Summary
StepSecurity introduced Secure Registry, an authenticated upstream registry that evaluates npm metadata and package downloads against install-time controls. Its available cooldown feature filters recent versions; compromised-package and typosquatting controls are in the
Key points
- StepSecurity says Secure Registry is available to Enterprise customers, with npm support generally available and PyPI support planned.
- The authenticated registry proxy evaluates npm metadata requests and package downloads against configured controls before returning a response.
- The available Cooldown Period control filters out package versions published within a configurable window; the default is 10 days.
- Controls for blocking packages flagged as compromised and for preventing typosquatting are listed as coming soon.
- The service can be configured for CI runners, developer machines, or artifact managers including JFrog Artifactory and Google Artifact Registry.
- StepSecurity positions Secure Registry as a complement to its GitHub Checks, covering installs that bypass pull-request review.
Article Details
- Event Type
- StepSecurity product launch following npm supply-chain worm activity
- Impact
- StepSecurity announced Secure Registry, an install-time control that evaluates npm metadata requests and package downloads and can block or modify responses according to configured controls. The announcement follows malicious @tanstack package releases attributed to TeamPCP: the self-propagating Mini Shai-Hulud worm reportedly stole CI/CD credentials and used them to publish infected packages controlled by compromised maintainers, including packages from UiPath and DraftLab. The article says the malicious packages carried valid SLSA Build Level 3 provenance attestations. Secure Registry is available to Enterprise customers with npm support; PyPI support is described as coming soon.
Threat Actors
Malware
ChainDropto publish infected versions of every package the compromised maintainer controls. The worm, called Mini Shai-Hulud, then spread to packages from UiPath, DraftLab, and other maintainers. In an unusually severeShai-Huludpublish infected versions of every package the compromised maintainer controls. The worm, called Mini Shai-Hulud, then spread to packages from UiPath, DraftLab, and other maintainers. In an unusually severe
Vendors
Products
GitHub ChecksHow Secure Registry compares to GitHub ChecksPackage Compromised Updatesreplaces, StepSecurity's existing GitHub Checks controls, specifically Package Cooldown and Package Compromised Updates, which scan pull requests for the same risks. The two enforce at different points in thePackage Cooldowncomplements, rather than replaces, StepSecurity's existing GitHub Checks controls, specifically Package Cooldown and Package Compromised Updates, which scan pull requests for the same risks. The two enforce atStepSecurity Secure RegistryToday we're announcing Secure Registry, a new StepSecurity product that closes this gap.