Cycode today revealed it is providing early access to an extension of its platform for securing software supply chains that prevents developers from downloading malicious or suspicious software packages onto their workstations.
A Workstation Protection capability that has been added to that platform enables DevSecOps teams to apply policies and controls that prevent developers from downloading potentially malicious instances of software packages from a software repository.
Specifically, the Cycode agentic development lifecycle (ADLC) Protection platform applies two controls in real time. The first inspects software packages against a threat intelligence feed to prevent downloads of known malicious software packages. The second will automatically prevent the download of any software package that has been too recently updated on the assumption that there has not been enough time to properly vet it, otherwise known as a cool down period.
Devin Maguire, senior product marketing manager for Cycode, said that now cybercriminals are more aggressively poisoning upstream sources of code, the need to apply controls at the workstation level has become critical. Designed to be installed as part of the Mobile Device Management module that Cycode already provides, those controls can be applied with no additional console needing to be added to an existing DevSecOps workflow based on the Cycode platform, he added.
Most application developers routinely download software components from multiple software repositories. Cybercriminals are now targeting those repositories in the hopes of injecting malware into a downstream application that they can later activate. That tactic has become even more pernicious because cybercriminals are also now starting to use malicious prompts to trick AI coding agents into downloading malicious software packages.
Unfortunately, application developers don’t always scan each package for malware before incorporating it into their codebase. Hopefully, that malware will be discovered at some point before that code is incorporated into an application running in a production environment. Cycode, however, is making a case for applying controls that prevent malicious software packages from ever entering the software supply chain in the first place, said Maguire.
Mitch Ashley, vice president and practice lead for software lifecycle engineering at The Futurum Group, said package policy is now an agent governance decision. There is no doubt coding agents increase software supply chain risks on the developer workstation, he added. When an agent installs packages on its own, install time becomes the first control point, well before a scanner sees the code, noted Ashley.
It’s not clear how aggressively DevSecOps teams are now moving to lock down software supply chains but as the number of attacks aimed at upstream repositories continues to increase it’s now more a question of how soon they will revisit those workflows. Cybersecurity teams, in particular, have become more acutely aware of the fact that the software supply chain created to build applications has become a soft underbelly that adversaries now regularly target. As such, they are asking more pointed questions about how applications are actually constructed.
Hopefully, the poisoning of the software repositories that house software packages will eventually be resolved at the source. In the meantime, it’s up to each DevSecOps team to lock down their software supply chain in a way that doesn’t wind up slowing down the pace at which applications are being built by, for example, trying to limit access to any and all software packages that were developed outside the organization.