The OpenSourceMalware Show #8

What it is

Episode 8 of the OpenSourceMalware Show (recorded June 11) walks through four supply-chain items. Beyond the incident recap, the reusable engineering content is the comparison of package firewalls and the practical caveats on npm v12's defaults and the VS Code extension cooldown.

How it works

Package firewalls are a proactive endpoint control that blocks installation of known/suspected malicious packages before they reach a pipeline — distinct from EDR, which only detects after execution. Two categories:

• Alias-based: intercepts package-manager calls at install time. Simple, but bypassed by invoking the package manager's absolute path directly.
• Daemon-based: continuously proxies outbound calls to registries. Stronger coverage, but adds latency and complexity.

Both lean on OSV and GHSA as data sources, and both have coverage gaps. Tools that cache malicious-package lists locally can miss account-takeover events only hours old — data freshness is a real differentiator.

npm v12 will disable install lifecycle scripts (pre/post/install), direct Git dependencies, and remote tarball dependencies — all three together, by default. These are the mechanisms malware uses to execute at install time. Because this is a package-manager change, not a registry change, protection only applies once each workstation and CI runner upgrades to npm 12.

Preconditions / Affected

• The VS Code two-hour auto-update cooldown applies only to the Microsoft Marketplace, not OpenVSX (run separately by the Eclipse Foundation, with no equivalent proactive scanning or notification). The NX Console compromise was caught via a Marketplace email, not Microsoft detection; OpenVSX was pulled only after NX manually checked.
• Whether a package firewall fits depends on whether you already run an internal registry, how you manage endpoint policy, and how easily bypass is possible in your environment.

What to do

• If evaluating a package firewall, probe data freshness (how fast the malicious-package list updates for hours-old ATOs) and bypass difficulty (alias tools fall to absolute-path invocation).
• Don't rely on the VS Code cooldown for OpenVSX-sourced extensions; the two-hour window is also far shorter than the 3–7 day windows practitioners commonly request. Track the minimumReleaseAge extension setting (listed in resources).
• Expect npm v12's protections to take years to matter in practice, given per-endpoint upgrade adoption, and plan for breakage in packages relying on install scripts (e.g. native builds via node-gyp).

Caveats

As of the episode date, Microsoft had issued no official statement on the 73-repo takedown. Paul notes an unresolved wrinkle: whoever open-sourced Miasma used an account showing no signs of compromise — unlike TeamPCP's MiniShai Hulud release — and is still investigating.