SafeDep Documentation

PMG in CI blocks a malicious package and fails the job. One failed job shows one block. SafeDep Cloud shows the blocks from every pipeline in one place.

This guide needs the SafeDep Cloud Team or Enterprise plan. See pricing.

Prerequisites

PMG runs in your pipelines and syncs to your tenant:
- In GitHub Actions, set the api-key and tenant-id inputs of the PMG action. See PMG in GitHub Actions.
- In other CI systems, run pmg cloud sync at the end of the job. See Package Guard. To find these jobs later, set PMG_CLOUD_ENDPOINT_ID as shown in Other CI systems.

Review one pipeline

Open the endpoint list

Sign in to app.safedep.io and select Endpoints. In GitHub Actions, each repository is one endpoint by default. Set the endpoint-id input of the PMG action to change it.

Open the endpoint

Select the endpoint, then select Package Events. Each session shows the install command and its outcome, such as Blocked or Success. Each package row shows its action, such as Blocked or Cooldown.

Filter the events

Use Package action or Session outcome to show only the blocks.

Package Events of a GitHub Actions endpoint in SafeDep Cloud with blocked, cooldown, and successful installs

Review all pipelines

PMG records the CI provider for GitHub Actions jobs. This query lists the malicious package blocks and the cooldown holds in all GitHub Actions jobs:

SELECT endpoints.identifier,
       package_guard_events.package_name,
       package_guard_events.package_action,
       package_guard_events.timestamp
FROM package_guard_events
JOIN endpoints ON endpoints.id = package_guard_events.invocation_id
WHERE package_guard_events.ci_provider = 'ENDPOINT_CI_PROVIDER_GITHUB_ACTIONS'
  AND package_guard_events.package_action IN (
    'PMG_PACKAGE_ACTION_BLOCKED', 'PMG_PACKAGE_ACTION_COOLDOWN_BLOCKED')
ORDER BY package_guard_events.timestamp DESC

Run it from Query in the sidebar, or with safedep query exec --sql-file.

SafeDep Cloud query console with the package blocks in all GitHub Actions jobs

The console shows enum columns as numbers. In package_action, 1 is a malicious package block and 4 is a cooldown hold.

Other CI systems

PMG does not record the CI provider for other CI systems. To group their events, give each CI endpoint an ID with a common prefix. In the job, set PMG_CLOUD_ENDPOINT_ID, for example to ci-jenkins-payments. Then filter on the prefix:

SELECT endpoints.identifier,
       package_guard_events.package_name,
       package_guard_events.package_action,
       package_guard_events.timestamp
FROM package_guard_events
JOIN endpoints ON endpoints.id = package_guard_events.invocation_id
WHERE endpoints.identifier LIKE 'ci-%'
  AND package_guard_events.package_action IN (
    'PMG_PACKAGE_ACTION_BLOCKED', 'PMG_PACKAGE_ACTION_COOLDOWN_BLOCKED')
ORDER BY package_guard_events.timestamp DESC

MDM

Review Package Blocks Across CI Pipelines

Prerequisites

Review one pipeline

Review all pipelines

Other CI systems

Next steps

Send Alerts from SafeDep Cloud

Find Where a Malicious Package Reached Your Organization

​Prerequisites

​Review one pipeline

​Review all pipelines

​Other CI systems

​Next steps

Send Alerts from SafeDep Cloud

Find Where a Malicious Package Reached Your Organization

Prerequisites

Review one pipeline

Review all pipelines

Other CI systems

Next steps