Supply Chain Security

​

Overview

​

Out-of-the-Box Protection

​

Custom Organization Requirements

“All dependencies must be from our approved vendor list, no GPL licenses in production code, all packages must be internally mirrored, and any package from developers outside our organization requires security team approval.”

​

Example: Custom Vendor Requirements

// ❌ Zenable flags unapproved dependency
{
  "dependencies": {
    "random-utility": "^1.0.0",  // Not from approved vendor
    "community-lib": "^2.3.1"    // No support contract
  }
}

// ✅ Zenable ensures compliance
{
  "dependencies": {
    "@approved-vendor/utility": "^1.0.0",
    "@enterprise/supported-lib": "^2.3.1"
  }
}

​

Example: Internal Registry Enforcement

# ❌ Standard npm install
npm install express

# ✅ Zenable enforces internal registry
npm install express --registry=https://artifactory.company.com/npm

​

In Action

# First, get a more useful summary of the uv.lock file
uv export --format requirements-txt --no-hashes > temp-requirements.txt

# Then, check your dependencies for both standard and custom violations
zenable check package.json temp-requirements.txt

# Cleanup
git checkout HEAD -- temp-requirements.txt 2>/dev/null || rm -f temp-requirements.txt

​

Example Protection

​

Lookalike Package Detection

// ❌ Zenable detects typosquatting
{
  "dependencies": {
    "expresss": "^4.17.1",  // Extra 's' - likely typosquatting
    "momnet": "^2.29.1"     // 'momnet' instead of 'moment'
  }
}

​

Suspicious Behavior Detection

# ❌ Zenable flags unexpected behavior in dependencies
def innocent_function():
    # Hidden data exfiltration attempt
    import os
    send_to_external(os.environ)

​

Continuous Protection

• Changes in package behavior between versions
• New or modified dependencies in your codebase
• Suspicious patterns that could indicate compromise
• Lookalike packages that could be malicious

​

Benefits

• Protected Supply Chain - Comprehensive monitoring of all code changes and usage of new dependencies
• Reduced Insider Threat Risk - Detect and prevent malicious updates from compromised developers
• Prevent Lookalike Attacks - Catch typosquatting and similar attacks before they cause damage
• Monitor Unwanted Behavior - Identify when dependencies start behaving suspiciously

​

Real-World Custom Examples

​

Financial Services Requirements

​

Healthcare Requirements

​

Government Requirements

​

Related Use Cases

• Security Assessment - Identify vulnerabilities in your code
• Policy as Code - Define dependency policies programmatically
• Compliance Pre-Audit - Ensure license compliance