A deep dive into how we investigate and secure GitLab packages

This post details investigations into the behavior of GitLab's package registries, specifically confirming that the npm package registry checks the official npmjs.org registry only after verifying the package's presence on gitlab.com, aligning with best practices. It also highlights the proactive publishing of the internal npm package `@conventionalcomments/cc-parse` to npmjs.org to prevent potential future issues. The post also discusses the inherent security of Go modules against dependency confusion attacks and outlines plans for a future Dependency Firewall product category.