Puppet rolls out malware scanning feature for new modules

Puppet, an infrastructure automation company, has announced a malware scanner feature for newly published modules on the Forge, Puppet's module marketplace.

The anti-malware feature was announced at the Puppetize Digital 2021 event and is designed to combat security risks and increase the security profile of customers using new modules. The rollout targets supported modules and will cover all newly published modules by the end of the year.

During the first quarter of 2021, supply chain attacks rose by 42% and impacted roughly seven million people. Puppet says this has lead to IT admins requiring more secure automation code.

Currently, users are expected to audit code and report and correct vulnerabilities to avoid security vulnerabilities and actual intrusions into their infrastructures. In addition, many site policies do not allow the use of public code unless it has been scanned first. With its latest malware module scanning feature, Puppet says users will have a more streamlined process for downloading pre-scanned modules to comply with strict site policies and consume modules more readily.

"Puppets new module malware scanning on the Forge gives users peace of mind when it comes to selecting and consuming our modules," says Puppets Forge and Content Ecosystem product manager, Ben Ford.

"This extra layer of protection improves trust in our content, benefits customers and open source Puppet users, and encourages people to think and build more securely as they contribute to Puppet's growing community."

Puppet has an active community of nearly 10,000 people on Puppet's Community Slack, which provides automation content for infrastructures worldwide, even helping CERN discover the mysteries of the universe. The rollout process for the malware scanning focuses first on supported modules, then partner and approved modules. The functionality will be available to new releases of all community modules on the Forge by the end of the year. The Forge currently hosts slightly more than 7,000 modules.

The company recently started re-architecting its Puppet Developer Kit, a unified interface with a set of tools for anyone who writes or consumes Puppet code. The kit is designed to help users develop high-quality Puppet modules or other content faster and more flexibly. Nearly 93% of modules released on the Forge come from the community.

The community team also brought the PowerShell DSC Gallery to the Forge, providing seamless access to DSC Resources' power in the form of modules, where they can be deployed and used just like any other content.