The DevOps.com report recounts Cycode’s announcement; the source inventory contains no primary source.

Cycode, a supplier of software supply chain security software, has opened early access to Workstation Protection. The feature prevents developers from downloading malicious or suspicious packages from software repositories to their workstations.

The first of two controls checks packages against data on known threats in real time and blocks known malicious packages. The second automatically blocks a package that was updated too recently, until enough time has passed for review.

Claim check:

  • Cycode has opened early access to an extension of its software supply chain security platform that prevents developers from downloading malicious or suspicious packages to their workstations. (confirmed only by the carrying publication: evidence; «Cycode today revealed it is providing early access to an extension of its platform for securing software supply chains that prevents developers from downloading malicious or suspicious software packages onto their workstations.»)
  • The Workstation Protection feature lets DevSecOps teams apply policies and controls that prevent downloads of potentially malicious packages from a software repository. (confirmed only by the carrying publication: evidence; «A Workstation Protection capability that has been added to that platform enables DevSecOps teams to apply policies and controls that prevent developers from downloading potentially malicious instances of software packages from a software repository.»)
  • The first of two real-time controls checks packages against data on known threats and prevents downloads of known malicious packages. (confirmed only by the carrying publication: evidence; «The first inspects software packages against a threat intelligence feed to prevent downloads of known malicious software packages.»)
  • The second control automatically prevents the download of a package that was updated too recently, until enough time has passed for review. (confirmed only by the carrying publication: evidence; «The second will automatically prevent the download of any software package that has been too recently updated on the assumption that there has not been enough time to properly vet it, otherwise known as a cool down period.»)

Primary sources:

score 66.0 out of 100 · kind: announcement