Omni Line
Blog
Latest posts.
-
Guides
A package in your inventory just went malicious—what you do in the first hour
When a MAL advisory or compromised publish hits a version you already cache, the registry is your containment point. A first-hour runbook: block, attribute, revoke, communicate, harden.
Adriano Ferreira 6 min read -
Blog
Install protection is a policy, not a scanner checkbox
A vulnerability dashboard does not stop a bad install. How to design registry install-protection policy—malicious vs CVE classes, severity thresholds, mark-fixed ownership, and the failure modes that kill adoption.
Adriano Ferreira 6 min read -
Guides
Your coding agent still talks to the public registry
Registry-side install controls only protect traffic that hits your registry. How to inventory agent and IDE install paths, force one URL per ecosystem, and catch bypasses in CI.
Adriano Ferreira 7 min read -
Guides
The outage you didn't cause: budgeting for public registry downtime
Your deploy pipeline's availability is the product of every public registry it touches. How to measure that exposure, cache against it, and run through an upstream outage.
Jessé Cruz 5 min read -
Guides
Surviving Docker Hub rate limits with a pull-through cache
Anonymous pulls share one per-IP budget, and ephemeral CI runners burn it fast. How pull accounting works, and how to put a cache you control in front of it.
Jessé Cruz 5 min read -
Guides
Death by a thousand tokens: designing least-privilege registry credentials for CI
Most CI registry tokens can publish when the job only needs to install. How to inventory, scope, and rotate registry credentials without breaking Friday's deploy.
Jessé Cruz 8 min read -
Product
C++ package management is still fragmented—what a Conan registry actually fixes
C++ never standardized on one package manager. How recipes, binary matrices, and remotes differ from npm—and how a self-hosted Conan 2 registry fits a polyglot stack.
Adriano Ferreira 7 min read -
Blog
Dependency confusion: how package resolvers choose the attacker's version
A public package with the right name can outrank your internal one. How npm, pip, and friends resolve names—and how to make resolution deterministic.
Jessé Cruz 5 min read -
Product
Supply-chain controls matter more when agents install your dependencies
Coding agents add and resolve packages at machine speed. Registry-side vulnerability checks and install blocking turn known CVEs and malicious advisories into a choke point—not a spreadsheet after the fact.
Adriano Ferreira 5 min read