TL;DR: browser-fetched third-party scripts outside registry scanning coverage
- Green scan is not done: Everyone treats a green Socket scan as supply-chain done, but US supply-chain attacks rose 115% between 2022 and 2023 and 95% of browser-fetched scripts have no protection against DNS hijack, so the registry is one layer of many.
- Full-code checks: cside checks the full code of every third-party source 100% of the time before it renders in a user's browser, monitors over 60 attributes with AI, and takes historical context into account, which is what a registry scanner cannot do once code is delivered dynamically to production sessions.
- The unwatched slice: Socket handles the install step, Cloudflare's WAF handles inbound, Hadrian and Cycognito handle the outside surface, so the decision is not which of them to keep, it is whether the browser-runtime slice between install and inbound is monitored the same way or left to trust.
Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.
Supply Chain attacks are a top of mind problem today. The number of these attacks in the US increased by 115% between 2022 and 2023, according to Statista. Tools like Socket and Coana detect harmful code in registries like NPM. But the supply chain risk doesn't end there.
Some tools are 3rd party scripts that get fetched by the browser of the user. By only checking NPM (or another registry), you're not protected from attacks through these scripts.
These scripts, used for marketing tracking, ads, captchas, and much more, are frequently implemented across entire sites for convenience. These scripts are powerful and can things like rewrite code, redirect users, exfiltrate data, and even mine crypto in your browser.
The delivery method of these scripts allows for dynamic behavior. Any user can get a different delivery each time, especially when a script has been compromised.
As more people adopt better dependency security approaches, dynamic scripts that get fetched browser-side are an increasingly interesting and substantial attack vector. This makes checking sources alone a risky game. The better approach, is checking the full code every time it gets delivered, which is what cside does.
Many of these scripts also aren't maintained by tech-centric companies. Tools may become neglected as companies dissolve or are acquired, leaving them susceptible to hijacks. Even reputable, widely-used services are not without their faults, as evidenced by cdnjs issues in 2021 or this person who bought expired police and social services domain in Belgium and got access to private info that way.
Finally, 95% of these scripts lack protections against DNS hijacks. Even the network you are on may impact the script you get.
What to do about all of this
Here's what we recommend:
Use a tool like Socket (or alternatives) for supply chain risk on the registry and use cside to monitor the behavior by 3rd party scripts browser-side. We check the full code of 3rd party sources, 100% of the time, before it get's delivered to the browser of your user. Securing this side of the supply chain fully.
Lastly, you should protect your infrastructure against inbound attacks. For that use something like Cloudflare's Web Application Firewall.
More niche things like form uploads and bot detection may require specialist tooling.
Use proactive monitoring tools like Hadrian or Cycognito to monitor the threat surface.
