SIP Framework
Five immediate controls that form one defensible path from the developer laptop to a verified container release.
The model
Five controls, one artifact chain
Agent → dependencies → container build → attestations → release gate. Each control strengthens the input to the next.
SIP i
Isolate local AI agents
Run coding agents in a sandboxed microVM with deny-by-default network access and host-managed secrets.
Implementation detailsSIP ii
Freeze unvetted dependencies
Delay newly published packages, commit the lockfile, and disable dependency lifecycle scripts by default.
Implementation detailsSIP iii
Harden container builds
Use a minimal, non-root runtime image and keep compilers and package managers in a separate build stage.
Implementation detailsSIP iv
Generate SBOM and provenance attestations
Attach inventory and maximum-level provenance to every image build, including the relevant build stages.
Implementation detailsSIP v
Scan the attested SBOM
Scan the SBOM attached to the exact image digest and block promotion when fixable Critical CVEs remain.
Implementation detailsStart here
Learn it, fork it, or delegate it
Technical article
The Complete SIP Implementation Guide
Read the rationale, commands, Dockerfile, GitHub Actions workflow, and digest-based release gate for all five controls.
Read moreReference implementation
SIP on GitHub
Fork a working Node.js example that implements the controls in a GitHub Actions supply-chain workflow.
Read moreAgent Skill
SIP It Up with a Coding Agent
Install the portable SIP skill and ask a compatible coding agent to implement controls ii through v in a repository.
Read moreXygeni: The npm Worm Playbook
Xygeni cites SIP as a practical response to the npm worm detection window. Its analysis highlights SIP ii—the five-day dependency cooldown and disabled lifecycle scripts—then explains why behavioral detection is a complementary layer for fast or dormant malware.
Research and context
The threats and evidence behind SIP
Pillar guide
Software Supply Chain Security
Place SIP in the broader defense path connecting package attacks, SBOM, VEX, SLSA, Cosign, and hardened images.
Read moreThreat analysis
The Largest npm Supply Chain Attack
Study Shai-Hulud and the package-compromise pattern that makes cooldowns and disabled lifecycle scripts urgent.
Read moreAgent and IDE risk
Mini Shai-Hulud
Follow the attack path through lifecycle scripts, secondary runtimes, IDE persistence, and local coding agents.
Read moreActive defense
Beyond SLSA: IX Hexbreaker Aegis
Understand why provenance alone cannot stop a worm that compromises the developer or CI context before the build.
Read moreAttestations
The Poisoned Macchiato
Go deeper into multi-stage SBOM coverage, in-toto attestations, Cosign, and OCI referrers.
Read moreResearch paper
SoK: Weaponizing the Developer Context
Read the research taxonomy for autonomous CI/CD worms, attack surfaces, and remediation architectures.
Read more