🧰 Secure Registry

The items that name it 8

• Binance’s $6.3 Billion Hack Puts Developer Machine Security in Focus
  article2026-10-30

  Checks package requests at install time between package clients and public registries, with cooldown periods for new versions, blocking of known compromised packages, and a Policy Evaluations log. Enterprise capability.

• Introducing deny list egress policies for Harden-Runner
  article2026-09-02

  StepSecurity package proxy through which package clients are configured to install, evaluating metadata requests and downloads against cooldown, compromised-package, and block-list controls.

• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
  writeup2026-08-28

  Referenced alongside Dev Machine Guard as protecting developer machines and keeping malicious packages out

• The State of Open Source Supply Chain Attacks
  article2026-08-23

  Sits between environment and public package registries, blocking compromised and typosquatted packages before they reach a laptop or CI runner.

• Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List.
  article2026-08-15

  StepSecurity feature that sits between CI/CD pipelines and public registries, blocking compromised or freshly published packages at download/runtime before they reach runners.

• Maven Support Comes to GitHub Checks and OSS Package Search
  article2026-07-01

  (Coming soon) Blocks compromised and freshly published Java packages at install time for Maven, extending cooldown and compromised-package controls to the registry layer

• New in the Threat Center: Compromised Components, Now Available via API
  article2026-06-09

  Sits between developers, CI runners, and public registries to enforce install-time controls against configured policies in CI or on developer laptops

• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleIt is written here as Secure Registry (Beta).

  Proxy between builds and public package registries (e.g. upstream for JFrog or Google Artifact Registry) that applies a cooldown policy to hold back freshly published package versions before they are consumed.