Software supply chain security company NetRise wants to eradicate what it calls “blind trust in software” by users in enterprise environments. The company has enhanced its NetRise Provenance toolset to bring “package trust enforcement” into the developer workflow via Visual Studio Code, the command line, and AI coding assistants.
In this context, the above-referenced package trust enforcement means being able to automatically verify software dependencies directly within developer environments to ensure untrusted (or tampered) packages of code are vetted before they enter enterprise codebases.
NetRise’s new release is designed to enable software engineering teams to detect and block malicious or policy-violating open source packages before they enter software projects.
Three new enforcement mechanisms
The release introduces three new enforcement mechanisms designed to extend package trust decisions across developer workflows:
- Provenance Package Firewall CLI: This function enforces organisational policy at code package install time in the command line interface (CLI), blocking malicious or non-compliant packages before they are downloaded.
- Provenance Extension for Visual Studio Code: Evaluates dependency manifests as developers write them, identifying malicious or non-compliant packages directly in the editor with contextual guidance and one-click remediation.
- AI Coding Assistant Plugins: Extends Provenance enforcement to AI coding assistants, including Claude Code, Gemini, and Codex, applying the same package trust decisions and policy enforcement to AI-initiated dependency installs.
The two streams of supply chain attacks
For the uninitiated, software supply chain attacks have become a much more prevalent part of the cyber landscape over the last 18 months (if not since the start of the decade) as they have the potential ability to circumvent otherwise robust enterprise protection systems by coming in under the radar, without using the front door.
While we talk about operational software supply chain attacks (for example, a big retailer has robust systems, but it orders napkins for the staff restaurant and so connects with the billing system of a supplier who has been compromised), we also talk about code-level software supply chain attacks, such as the recent LiteLLM and Axios compromises, which share similar characteristics i.e. a code package or one of its dependencies is compromised.
The malicious release stays published and is pulled into every project that requests it, until it is detected. Each compromise was quickly discovered and fixed, with the window of exposure being merely hours.
“The problem is everything that happens while [the compromised live production codebase] is still up,” said Michael Scott, co-founder and CTO of NetRise. “Builds run, releases go out, containers deploy, all automatically. AI tools pull dependencies into projects for people who aren’t even developers. By the time an advisory is published and the package is quarantined, the compromised version has already spread.”
Shift left on package trust decisions
Scott and team say that the company’s new mechanisms move package trust decisions earlier in the software development lifecycle by evaluating dependencies as they are introduced into a project and enforcing the same policy at install time. A shared policy engine ensures the same trust decision is applied in the editor, at the command line, in AI coding assistants, and in continuous integration (CI).
“NetRise Provenance blocks the package at every point of install – the developer machine, the software and firmware build pipeline, the AI assistant working on a user’s behalf. It shifts the approach of CISOs and Product Security leaders into one of proactive defence rather than reactive response. When the next attack makes headlines, they have the confidence that the affected packages never got in,” said CTO Scott.
One-click remediation
In terms of use, developers receive immediate feedback while they edit dependency manifests, including plain-language explanations for flagged packages, one-click remediation and options to record policy exceptions. The Package Firewall enforces those same decisions during package installation.
“The oldest problem in cybersecurity isn’t malicious code – it’s trusting software before you know where it came from or whether it deserves that trust,” said Thomas Pace, co-founder and CEO of NetRise.
Pace says malicious packages are “just the latest example of a much older problem” i.e. that software engineering teams and the organisations they work for continue to rely on software and components they haven’t truly validated.
“That model has to end,” stated Pace. “Software should prove its origin, integrity, and lineage before it ever runs, and when something does slip through, you should immediately understand where it came from and everywhere it exists. With Provenance integrated into the developer workflow and Turbine continuously validating software in production, that becomes the foundation of how software is built and trusted.”
Dependency authoring to software delivery
The new enforcement capabilities build on Provenance’s existing software supply chain intelligence, extending the same package trust decisions from dependency authoring through software delivery.
The Provenance Package Firewall CLI and the Provenance extension for Visual Studio Code are available to NetRise Provenance customers, with initial support for the Python (PyPI) ecosystem and additional ecosystems planned.
What should developers think next?
We almost don’t need to say it, really do we? What developers should think next is that, yes, it’s time to end blind trust in code provenance as a software engineering strategy. What they should also think about on the road to cleaning up their use of third-party dependencies and AI coding assistants that pull external packages into builds with increasing autonomy is that security is (obviously, but let’s still say it out loud again) no longer a downstream post-release concern.
NetRise is refreshingly light on pushing its brand into its messaging, but developers should also remember competitors do exist in this space, such as Snyk, Sonatype, Finite State, ReversingLabs, Aqua Security, JFrog, Veracode, Mend.io and Chainguard.
It’s time to end blind trust, but you’re still allowed to enjoy blind faith if you want to.