DEPENDENCY CONTROL
Do you know what your pipelines pulled this morning?
Every pipeline run pulls the latest versions of every dependency, from every public registry, without review. Thousands of requests per day, across every language ecosystem your engineers use.
Most of those packages are fine. Some carry unapproved licenses that create legal exposure. Some introduce deprecated code that breaks builds weeks later. Some are published under names close enough to internal packages that automated runners can't tell the difference. None of them were reviewed before they ran on your build infrastructure.
Why unmanaged dependency ingestion is a growing problem
Three trends are widening the gap between what pipelines pull and what organisations have approved:
Package ecosystems are growing faster than governance frameworks
npm, PyPI, Maven, and NuGet each publish thousands of new package versions daily. The volume of third-party code entering enterprise build pipelines has outpaced the capacity of manual review processes.
Dependency confusion attacks exploit namespace gaps
Attackers publish public packages under names that match internal corporate naming conventions. Automated build runners that check public registries before private ones pull the public package without any indication that something is wrong.
License sprawl creates legal liability that surfaces late
Packages with incompatible or unapproved open-source licenses enter production environments silently. The legal exposure accumulates over months or years before an audit surfaces it, at which point remediation is a significant engineering effort.
What uncontrolled dependency ingestion costs your teams
Security architect
Scanning tools that run after packages have already entered the network generate alerts rather than blocks. By the time a policy violation is flagged, the package has already been pulled onto build nodes, potentially executed post-install scripts, and been incorporated into a build artefact.
Platform lead
Client-side configuration files can be modified or commented out by any developer. Governance policies that depend on local configurations being maintained correctly are policies with a permanent bypass mechanism built in.
Compliance auditor
Proving to an external auditor which packages entered the production environment, when, under what policy, and whether any unapproved licenses were ingested requires a centralized, real-time audit log at the ingestion point.
Why default validation layers don't solve this
Challenge 1
Local configurations are easily bypassed
Desktop-level download restrictions inside local configuration scripts (such as .npmrc, pip.conf, or cargo/config.toml) are easily modified or commented out by developers, bypassing corporate governance.
Challenge 2
Late-stage scanning is purely reactive
Scanning platforms generate post-event alert tickets rather than executing live, path-based network blocking.
Challenge 3
Licensing seat costs are prohibitive
Scaling repository-specific curation tools linearly across large engineering teams and automated CI runners inflates platform spend.
Challenge 4
Metadata conflicts freeze pipelines
Aggressive caching serves stale package versions and breaks builds. Overly cautious caching causes repeated fetches of identical binaries.
How Varnish Artifact Firewall governs dependency ingestion
Varnish Artifact Firewall is an inline policy proxy that sits between your build runners and external registries, evaluating every dependency request against organizational policy the moment it is made.
It manages policies as declarative Git-versioned YAML rulesets and integrates natively with Varnish Virtual Registry to combine governance with artifact caching.
01
Inline manifest rewriting |
The policy engine intercepts metadata queries and evaluates each package request against organisational policy before responding. Manifests are dynamically rewritten to prune unapproved package versions or restrict access to specific dependencies — build runners receive a compliant response without knowing an intervention occurred. |
02
Namespace and scope isolation |
Pattern matching isolates corporate namespace prefixes. Any attempt to fetch a package matching a protected internal scope from a public registry is immediately blocked and build runners are forced to pull from your secure private repositories only. Dependency confusion attacks have no path through. |
03
Quarantine windows for new package versions |
Newly published package versions are held for a configurable quarantine period before automated pipelines can pull them. Engineering teams and the broader open-source community have time to evaluate new releases before they enter your builds. Zero-day ingestion risk is eliminated by design. |
04
Policy-as-code across every build environment |
Routing rules, license blocklists, and version constraints are managed as declarative YAML files, versioned in Git, and distributed uniformly across every build environment. Policy changes propagate instantly. Every package decision is logged with a complete audit trail for compliance review. |
Varnish Artifact Firewall
Stop malicious dependencies before they reach your builds.
An inline policy proxy that secures your software supply chain by governing every dependency request. Sitting between your build runners and external registries, it evaluates requests across npm, PyPI, Maven, and NuGet the moment a package is requested.
By managing policies as declarative, Git-versioned YAML rulesets, security teams can easily extend standard OSV baselines with custom internal compliance rules. The engine can be deployed as a standalone security gateway or integrated natively with Varnish Virtual Registry to balance airtight policy enforcement with blazing-fast artifact caching.
Resources and media
-
Enforcing npm security across distributed CI/CD pipelines
How to enforce package version governance and pipeline security across distributed teams, before compromised packages spread
-
How to protect your CI/CD pipelines
Most organizations already have some combination of repository controls, scanners, and policy lists in place. Those are important, but they tend to operate either before ingestion or after the fact.
-
Accelerating secure CI/CD pipelines in highly regulated industries
A strategy guide for securing and accelerating software delivery in financial services, healthcare, critical infrastructure.
Read more →
Next steps
Talk to our team to learn more about Varnish Artifact Firewall.
