I just got back from Open Source Summit, and one topic followed me from hallway to hallway: the EU Cyber Resilience Act.
Suddenly, the timeline isn’t so abstract. Since September, manufacturers have had to report actively exploited vulnerabilities within 24 hours. By December 2027, the full set of supply chain requirements will apply. If you sell software or connected products to EU customers, the rules apply wherever your company is based.
The engineering leaders I spoke to understood the urgency but expressed a persistent frustration: executive leadership still viewed CRA readiness as an unwelcome and expensive compliance exercise.
Nobody necessarily enjoys new regulation. But I think framing the CRA as a box-ticking exercise is a dangerous miscalculation.
Almost nobody writes software from scratch anymore. We assemble it from thousands of open-source packages, most of which we've never read and never will. And increasingly, AI coding agents pick and install those packages for us, with no human checking what comes in.
It's why small teams can build big things. But it also means your security depends on people and pipelines you don't control. This year alone has brought a steady run of attacks on npm, PyPI, Maven, and NuGet. In April, a backdoored version of Axios, a package with over 100 million weekly downloads, was live on npm for about three hours. One poisoned sub-dependency or one leaked CI secret is enough. The cleanup, the legal exposure, and the lost trust cost far more than prevention would have.
When I look at the CRA, I see something closer to an insurance policy: a law that writes down what good teams should be doing anyway to keep the business running.
Few people still ask whether to control which packages come into their builds. The conversation among engineering teams has moved on. The question now is how to control package ingestion and meet CRA mandates without slowing everyone down. From what I've seen, the answer has four parts.
The part I find most encouraging is how little friction this has to add. The gateway runs as a transparent proxy in front of public registries or your existing repository manager. Developers don't change their setup, and neither do your CI images. Security rules live as policy as code, reviewed and versioned like everything else you ship.
I think the CRA will change how software gets built, not just in Europe but everywhere. Teams that treat it as paperwork will feel it as friction. Teams that treat it as a reason to fix their supply chain will meet the deadline comfortably, and they'll be much harder to hit in the meantime.
That's how we think about registry security at Varnish. Real-time blocking, quarantine, OpenTelemetry, and fast artifact caching, all sitting in the path, so keeping your supply chain safe never means waiting on your builds.
That’s the thinking behind Varnish Artifact Firewall. It sits in front of the registries and repository managers your teams already use and applies your policies to every request as it happens:
Blocks malicious and vulnerable packages before they reach a laptop or CI runner.
Quarantines new releases until they’ve had time to settle.
Keeps builds green by serving the newest approved version instead of failing.
Logs every decision and streams it through OpenTelemetry, so when the 24-hour clock starts, you already know what was pulled and where it went.
It works alongside Varnish Virtual Registry’s fast artifact caching, so builds are both fast and secure at scale. The result is an auditable supply chain, a met compliance deadline, and builds that never wait on security.