🧰 StepSecurity Secure Registry

The items that name it 8

• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeup2026-10-08

  Sits between developers/CI and public npm registry; blocks known malicious packages/versions at download time, including tensorlake@0.5.144, following the OSS Security Feed

• Control Which Package Registries Your CI Jobs and Developer Machines Use
  article2026-08-12

  Private/internal package registry that sits between developer machines, CI runners, and public registries, evaluating every metadata request and tarball download; provides Cooldown Period, Compromised Packages, and Typosquatting Protection controls per ecosystem

• Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It
  article2026-08-03

  Sits between public package registries and developer machines/CI, screening new and unvetted package versions before they are served, so newly published packages (e.g., an hour old) don't flow directly into builds.

• jscrambler npm package publishes malicious preinstall binary
  writeup2026-07-12

  Policy-enforced npm registry proxy sitting between existing package manager (e.g. JFrog Artifactory) and registry.npmjs.org, applying a configurable cooldown period before serving newly published versions

• Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
  writeup2026-07-01

  Provides a dedicated, policy-enforced npm registry sitting between existing package managers (e.g., JFrog Artifactory) and the public npm registry; enforces a cooldown period holding newly published package versions before serving them, which protected customers from the Miasma packages.

• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeup2026-06-18

  Dedicated, policy-enforced npm registry sitting between existing package managers and the public npm registry; applies a configurable cooldown period holding newly published versions before serving them, and a 'Compromised Packages' control, to prevent exposure to malicious packages

• StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
  writeup2026-05-19

  Dedicated, policy-enforced npm registry sitting between package manager and public npm registry; applies a cooldown period holding newly published versions before serving them, protecting customers from newly published malicious releases.

• Active Supply Chain Attack: Malicious node-ipc Versions Published to npm
  writeup

  Dedicated, policy-enforced npm registry sitting between existing package managers and the public npm registry; enforces a cooldown period holding newly published versions before serving them, preventing exposure to the compromised node-ipc versions