The window scanners miss in open source security
There's a risk window after a malicious package is published when nobody knows it's there. Scanners alone can't close that window.
Vulnerability scanners are critical tools, but they only catch packages that have already been flagged. Between the moment a malicious package lands in a public registry like npm, PyPI, or Maven Central, and the moment threat intelligence catches up, your developers can pull it in without any warning. Ralph McTeggart (Principal Engineer) and Nigel Douglas (Head of Developer Relations) walk through how a dependency firewall addresses this gap, and why it complements rather than replaces scanning.
What they cover:
- Why the first hours after a malicious package is published represent the highest-risk window
- How a cooldown policy (minimum release age) prevents developers from pulling newly published packages during that window
- The difference between a vulnerability scanner and a dependency firewall – and why you need both
- How proxying open source dependencies through a private registry adds a control layer that scanners don't provide
0:00 - The window scanners miss
0:30 - Why cooldown policies matter
0:54 - Dependency firewall vs. vulnerability scanner
1:26 - Blocking malicious packages at the earliest stage
2:10 - Minimum release age: how it works in practice
This video covers open source security, dependency firewall, software supply chain security, malicious package detection, minimum release age, and vulnerability scanning for DevSecOps and AppSec teams.
See how cooldown policies work with your tech stack. Book a demo: https://cloudsmith.com/book-a-demo
Subscribe for more on software supply chain security, artifact management, and DevSecOps.
#SoftwareSupplyChain #DevSecOps #Cloudsmith #OpenSourceSecurity