🚀 Introducing GitLab CI/CD Component

SafeDep Team

• Mar 31, 2025 • 1 min read

Announcing the new GitLab CI/CD Component, available in GitLab CI Catalog for seamless integration of vet in GitLab CI. Protect against vulnerable and malicious packages in your GitLab projects. This integration enables GitLab users to easily integrate vet with their GitLab CI pipelines. This integration protects GitLab projects from vulnerable and malicious packages in the dependency tree.

TL;DR

Usage

Features

Scan all dependencies and report vulnerabilities to GitLab security dashboard

GitLab Security Dashboard Vulnerability List

Integrates with SafeDep Cloud to protect against malicious open source packages through active code analysis

GitLab Security Dashboard

Support

Report bugs and feature requests to GitHub issues
Start feature discussions at GitHub discussions

gitlab
cicd
integration
malware

Author

SafeDep Team

safedep.io

The Latest from SafeDep blogs

Follow for the latest updates and insights on open source security & engineering

Security

npm SANDWORM_MODE Attack: Step-by-Step Malware Analysis

Step-by-step technical analysis of the SANDWORM_MODE npm supply chain attack. We dissect yarsg and format-defaults malicious packages, decode multi-layer obfuscation, and trace the payload delivery...

Why We Built a Hosted MCP Server to Stop Malicious Packages for AI Agents

Exposing an MCP server is trivial. Making it useful for AI agents is not. Here's what we learned dogfooding our own tool, and why we built a hosted MCP server backed by real-time open source threat...

Malware

AI Agent Cline v2.3.0 Compromised: From Prompt Injection to Unauthorized npm Publish

A compromised npm token was used to publish a tampered version of Cline CLI. A prompt injection vulnerability in Cline's AI-powered GitHub Actions workflow may have enabled the credential theft.

Engineering

End-to-End test with Nextjs, Playwright and MSW

A practical Next.js 16 App Router E2E setup with Playwright and MSW that keeps server-side fetch deterministic by focusing mocking where it matters, not on server actions.

View All Blogs