Securing the Software Supply Chain for a Code Marketplace

A marketplace for templates, plugins and starter kits is a software distribution channel. Buyers install what they download, often straight into production. That makes every upload a potential supply-chain entry point — through a malicious author, a compromised author account, or a vulnerable dependency nobody noticed. Here is how we think about the controls, from the moment code is uploaded to the moment it is downloaded.

Threat model first

• Malicious uploads: obfuscated payloads, install scripts that exfiltrate secrets, cryptominers.
• Account takeover: a trusted author's credentials used to push a poisoned update.
• Vulnerable dependencies: outdated packages with known CVEs, or typosquatted names.
• Tampering in transit or at rest: a download that is not the archive that was reviewed.

Verify who publishes

Identity verification for authors (KYC), mandatory two-factor authentication for publishing, and notifications to the author on every new version make account takeover harder and noisier.

Scan every archive

Every uploaded archive goes through automated checks before a human reviewer sees it:

• Malware and known-bad signature scanning.
• Secret scanning for committed keys and tokens.
• Detection of install-time scripts (postinstall and similar) that need justification.
• Dependency audit against vulnerability databases, with lockfiles required.

# CI step run against each submitted package (excerpt)
- run: npm ci --ignore-scripts                 # never execute install scripts during review
- run: npx osv-scanner --lockfile=package-lock.json
- run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json
- run: sha256sum package.zip > package.zip.sha256

Publish an SBOM and checksums

A software bill of materials (CycloneDX or SPDX) lets buyers check the package against their own policies and react quickly when a new CVE lands. A SHA-256 checksum, shown on the item page and stored with the version, lets anyone confirm the download is the reviewed artefact.

Protect the download path

• Store source archives privately; never on a public bucket URL.
• Issue short-lived, single-use signed download links only after a licence check.
• Keep every version immutable once approved; fixes ship as new versions.
• Support yanking a version and notifying every buyer when a security issue is found.

Review updates, not just first releases

Most supply-chain attacks arrive in an update to something already trusted. Updates should go through the same scanning and review, and changes in dependencies or install scripts between versions should be highlighted to the reviewer.

Warning: a clean review today says nothing about tomorrow's CVE. Re-scan published SBOMs against new vulnerability data on a schedule, not only at upload.

Key takeaways

• Treat the marketplace as part of every buyer's supply chain.
• Verify authors and require 2FA for publishing.
• Scan archives without executing them; require lockfiles.
• Ship SBOMs and checksums with every version.
• Serve downloads through signed, expiring links and keep versions immutable.