New IVAS Gate Care engine identifies and verifies malicious packages at the open source entry gate
Labrador Labs (co-CEOs Jinseok Kim and Heejo Lee) announced on the 9th that it has developed an analysis engine that identifies and verifies malicious packages before open source is imported, and has embedded it in its vulnerability analysis platform IVAS (Integrated Vulnerability Analysis System) as Gate Care.
With this addition, Labrador Labs has completed end-to-end management across the entire software (SW) supply chain lifecycle-from the import stage, where open source first enters an organization, through development and operations. Going beyond conventional SW vulnerability analysis centered on the development and operations stages, the company has implemented a repository management framework that identifies and verifies risks before developers ever use an open source component.
▲ Labrador Labs’ Integrated Vulnerability Analysis System “IVAS” identifies malicious packages at the external open source import stage and presents the evidence behind each verdict.
[Source: Labrador Labs]A malicious package is a software component either built for hacking from the outset, or a legitimate open source project with malicious code secretly planted inside it. On the surface, it is indistinguishable from an ordinary open source package. The name and description look plausible, and it may even appear to function normally.
The damage occurs the moment a developer installs the component. When a command such as npm install is executed, the code hidden inside runs automatically. The developer has not clicked anything by mistake or run a file directly they have merely installed a package-yet cloud access keys, login credentials and other data stored on the machine can be exfiltrated. In today’s development environment, where software is assembled from vast numbers of open source components, an attack of this kind can cause extensive damage.
In May, 42 npm packages belonging to TanStack – a core library in the React ecosystem were compromised simultaneously, and 84 malicious versions were published. Malicious packages have become a new threat to software supply chain security.
According to global security firm Sonatype’s 2026 State of the Software Supply Chain report, 454,648 new malicious open source packages were identified over the course of 2025, and 55.9 percent of them abused repositories themselves as platforms for distributing malicious packages. As a result, there is growing pressure on enterprises to verify the safety of software components upfront, before open source is imported into the development environment.
▲ The structure and risks of the open source package registry npm. When a developer installs a single component, hundreds of dependent packages are installed along with it and a cleverly disguised malicious package can slip in among them. [Source: Labrador Labs]
The Labrador Labs IVAS analysis engine determines whether open source contains malicious packages before it enters the corporate internal network, and presents the evidence behind its verdict. It analyzes the import record of external open source to identify malicious packages, and provides both the detection evidence and the source of registration.
Like an airport security checkpoint, Gate Care screens incoming open source packages at the entry gate, so that any risks found can be reviewed before the package is brought into the development environment. This allows enterprises to assess and respond to risk before a malicious package ever reaches a developer’s PC or a build server. Known vulnerabilities, license risks and suspicious dependency relationships can likewise be checked in advance.
Open source that clears the entry gate is linked to IVAS’s existing vulnerability analysis and ServerCare modules, so it is tracked seamlessly from development through operations. Components that were safe at the time of import are continuously re-verified as new vulnerabilities emerge.
Labrador Labs developed the feature based on its experience deploying and operating IVAS at major domestic financial institutions, and on the open source import and management requirements of the financial sector.
“If a software developer installs a malicious package, account credentials, cloud keys and critical information from the development environment can be leaked through the simple execution of a command,” said Jinseok Kim, co-CEO of Labrador Labs. “Open source security can no longer be handled adequately by looking for vulnerabilities only after development is complete.”
[Press release source: Boan News, Han Se-hee (https://www.boannews.com)]