You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hey guys! HuskyCI is an amazing project, and I believe it could be further enhanced by adding support for Datadog's supply-chain-firewall. They recently open-sourced their CLI tool for preventing the installation of malicious PyPI and npm packages. It collects all package targets that would be installed by the command and checks them against reputable sources of data on open-source malware and vulnerabilities (like OSV.dev). The command is automatically blocked from running when any data source flags a target as malicious. It could increase building time but i believe this is a powerful tool that might be worth testing
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
Hey guys! HuskyCI is an amazing project, and I believe it could be further enhanced by adding support for Datadog's supply-chain-firewall. They recently open-sourced their CLI tool for preventing the installation of malicious PyPI and npm packages. It collects all package targets that would be installed by the command and checks them against reputable sources of data on open-source malware and vulnerabilities (like OSV.dev). The command is automatically blocked from running when any data source flags a target as malicious. It could increase building time but i believe this is a powerful tool that might be worth testing
What do you think? Cheers!
Beta Was this translation helpful? Give feedback.
All reactions