NetRise Extends Provenance to Developer Workflows, Stopping Malicious Packages Before They Reach The Build Pipeline
Rhea-AI Summary
Accenture (NYSE: ACN) portfolio company NetRise announced new enforcement capabilities for its NetRise Provenance software supply chain security platform, extending package trust controls directly into developer workflows via a Package Firewall CLI, a Visual Studio Code extension, and AI coding assistant plugins for tools such as Claude Code, Gemini, and Codex.
According to NetRise, these features evaluate and block malicious or policy-violating open source packages at authoring and install time across editors, command line, AI assistants, and CI, with initial support for the Python (PyPI) ecosystem. NetRise also reiterated that it has entered into an agreement to be acquired by Accenture, after which it will operate under Dragos.
Positive
- New Provenance enforcement tools added for CLI, VS Code, AI assistants
- Unified policy engine enforces package trust across editor, CLI, CI, AI
- Initial ecosystem support for Python (PyPI) with more languages planned
- NetRise to be acquired by Accenture and operate under Dragos
Negative
- None.
News Explained
The announced capabilities are available to Provenance customers, but the release limits initial support to Python’s PyPI ecosystem; additional ecosystems are planned.
Market Reaction – ACN
Following this news, ACN has declined 6.35%, reflecting a notable negative market reaction. Our momentum scanner has triggered 16 alerts so far, indicating notable trading interest and price volatility. The stock is currently trading at $162.18.
Data tracked by StockTitan Argus (15 min delayed). Upgrade to Gold for real-time data.
Key Figures
Historical Context
| Date | Event | Sentiment | 24h Move | Catalyst |
|---|---|---|---|---|
| Jul 28 | AI partnership | Positive | +6.9% | AI-powered ChatGPT app launched with Radisson for hotel discovery and future booking capabilities. |
| Jul 07 | Contract award | Positive | +3.8% | Accenture signed a seven-year NATO digital infrastructure contract valued at approximately €200 million. |
| Jul 07 | AI solutions | Positive | +3.8% | Accenture and Google Cloud introduced agentic AI solutions for mid-market companies. |
| Jul 01 | Federal offering | Positive | +5.4% | NetRise launched a partner-led software supply-chain risk-management offering for the federal market. |
| Jun 24 | Engineering agreement | Positive | +1.7% | Accenture entered an engineering agreement with Coretura for commercial-vehicle software development. |
24h Move is the share-price change in the day after each event; other market factors may also have contributed.
All five recent news events were followed by positive 24-hour price reactions across AI, contract, partnership, and software-supply-chain announcements.
Key Terms
continuous integration technical
sbom technical
dependency manifests technical
AI-generated analysis. How Rhea-AI works. Not financial advice.
New Package Firewall CLI, VS Code extension, and AI coding assistant plugins enforce package trust before malicious or policy-violating dependencies are installed.
The release introduces three new enforcement mechanisms that extend Provenance's package trust decisions across developer workflows:
- Provenance Package Firewall CLI: Enforces organizational policy at package install time in the command line interface (CLI), blocking malicious or non-compliant packages before they are downloaded.
- Provenance Extension for Visual Studio Code: Evaluates dependency manifests as developers write them, identifying malicious or non-compliant packages directly in the editor with contextual guidance and one-click remediation.
- AI Coding Assistant Plugins: Extends Provenance enforcement to AI coding assistants, including Claude Code, Gemini, and Codex, applying the same package trust decisions and policy enforcement to AI-initiated dependency installs.
Modern software supply chain attacks, such as the recent LiteLLM and Axios compromises, share similar characteristics: a package or one of its dependencies is compromised. The malicious release stays published and is pulled into every project that requests it, until it is detected. Each compromise was quickly discovered and fixed, with the window of exposure being merely hours.
"The problem is everything that happens while it's still up," said Michael Scott, Co-Founder and CTO of NetRise. "Builds run, releases go out, containers deploy, all automatically. AI tools pull dependencies into projects for people who aren't even developers. By the time an advisory is published and the package is quarantined, the compromised version has already spread."
"Provenance is built for that window. It blocks the package at every point of install - the developer machine, the software and firmware build pipeline, the AI assistant working on a user's behalf. It shifts the approach of CISOs and Product Security leaders into one of proactive defense rather than reactive response. When the next attack makes headlines, they have the confidence that the affected packages never got in."
The new mechanisms move package trust decisions earlier in the software development lifecycle by evaluating dependencies as they are introduced into a project and enforcing the same policy at install time. A shared policy engine ensures the same trust decision is applied in the editor, at the command line, in AI coding assistants, and in continuous integration (CI).
Developers receive immediate feedback while they edit dependency manifests, including plain-language explanations for flagged packages, one-click remediation, and options to record policy exceptions. The Package Firewall enforces those same decisions during package installation.
"The oldest problem in cybersecurity isn't malicious code—it's trusting software before you know where it came from or whether it deserves that trust," said Thomas Pace, Co-founder and CEO of NetRise. "Malicious packages are just the latest example of a much older problem: organizations continue to rely on software and components they haven't truly validated. That model has to end. Software should prove its origin, integrity, and lineage before it ever runs, and when something does slip through, you should immediately understand where it came from and everywhere it exists. With Provenance integrated into the developer workflow and Turbine continuously validating software in production, that becomes the foundation of how software is built and trusted."
The new enforcement capabilities build on Provenance's existing software supply chain intelligence, extending the same package trust decisions from dependency authoring through software delivery. Learn more about NetRise Provenance at netrise.io/products/provenance.
The Provenance Package Firewall CLI, the AI coding assistant plugins, and the Provenance extension for Visual Studio Code are available to Provenance customers, with initial support for the Python (PyPI) ecosystem and additional ecosystems planned.
Resources
- Schedule a demo: To see Provenance enforce trust from the editor through the pipeline, request a demo at https://www.netrise.io/demo-request.
- For more information about NetRise Provenance, visit: https://www.netrise.io/products/provenance.
- Meet with us at Black Hat
USA 2026: Visit Booth #5547 or schedule a private meeting with the NetRise team: https://www.netrise.io/company/events/netrise-black-hat-usa-2026
For more information or to request a demonstration, visit netrise.io or contact info@netrise.io.
About NetRise
NetRise is the software supply chain security company that exists to eliminate blind trust in software forever. By identifying every component in each binary image across firmware, kernels, operating systems, containers, and applications, NetRise exposes the full stack of inherited risk that source-based tools, vendor SBOMs, and questionnaires cannot see. Non-code related risk uncovered includes hidden dependencies, cryptographic artifacts, misconfigurations, secrets, among others. Global enterprises that produce and consume software, including government agencies, rely on NetRise to validate what they ship and what they run. When the software supply chain is compromised by bad actors, NetRise answers the questions, "how far do these compromises extend?" and "where am I exposed?" enabling rapid identification, prioritization, mitigation, and policy updates, reducing material risk to the business. NetRise has entered into an agreement to be acquired by Accenture (NYSE: ACN), which is also taking a majority investment in Dragos. Upon close of the transactions, NetRise will operate under Dragos.
https://www.netrise.io
Press & Media Contact
Danielle Ostrovsky
Hi-TouchPR
Ostrovsky@Hi-TouchPR.com
View original content to download multimedia:https://www.prnewswire.com/news-releases/netrise-extends-provenance-to-developer-workflows-stopping-malicious-packages-before-they-reach-the-build-pipeline-302836570.html
SOURCE NetRise