Some things I'm doing now to reduce the risk of software supply chain attacks:

• I run all package manager installs through Socket Firewall (sfw npm install ...), which blocks known malicious packages and warns on various other problems.
• Claude Code sessions run as a separate user^[1], and I plan to move them all the way to a VM^[2] in the near future.
  • Unfortunately, this user does need access to a lot of API keys including a GitHub token, but I limit their scope to the extent I can.
  • The risk of prompt injection seems to be relatively low in modern Claudes, so I'm not that worried about it. I do use agent-sanitizer in my custom harness though.
• Claude has instructions to immediately notify me if malicious packages get installed anyway.
• Claude does various supply chain checks on every dependency update PR from Dependabot.
• I sometimes have Claude rewrite overly complex dependencies (too many transitive deps, written in a scary language like C).
• I also use sfw on my own user account, and have removed passwordless docker and libvirt access, although I think if a supply chain attack hits my user account I'm probably doomed anyway.

1. ^{^}

   I use a custom web interface to make this convenient.

2. ^{^}

   I should have done this from day one, but agents need GPU access which is tricky to sandbox. Now that I have a custom GPU queue, my plan is to run normal agent sessions in a VM and expose a container with GPU access through gVisor.