How Webflow Blocks Malicious Packages with Socket Firewall -...

Mohit BansalSenior Manager, Infrastructure Security, Webflow

About Webflow#

Webflow is a visual development platform that lets designers and teams build, launch, and manage websites without hand-writing code. It combines a visual canvas with a CMS, hosting, ecommerce, and interactions, so teams can go from design to a production site in one place. Webflow is used by everyone from independent designers to large marketing and product teams that want control over how their sites look and behave without depending on engineering for every change.

The Challenge: Keeping Pace With Modern Supply Chain Attacks#

Webflow runs security across a large engineering organization with lean, focused teams. Its application security and infrastructure security functions support a large engineering organization.

Before adopting Socket, Webflow ran a mix of tools, with Snyk as the primary scanner alongside Dependabot and the rest of GitHub Advanced Security. As the team had already started moving away from bundled suites toward best-in-class tools for each job, two gaps stood out.

The first was reachability. Snyk's analysis did not give the team the deterministic reachability it wanted, which made it hard to separate the vulnerabilities that mattered from the ones that did not.

The second was timing. Supply chain attacks were breaking regularly, and the team often learned about them late.

"If you don't constantly glue yourself to the RSS feeds, it is very hard to know what is happening around you," said Ankit Agrawal, Senior Manager of Application Security at Webflow. "End of life, deterministic reachability, and being late to these attacks were all pain points we had been flagging for a year. Socket helped us get to the next stage with supply chain."

One of the main concerns for Webflow's infrastructure security team was the risk of malware hitting developer machines.

"We certainly don't want to be running malware in production," Webflow infrastructure security engineer Andrew Rose said. "The reality of the way these attacks work is that malware usually lands on a developer's machine well before anything reaches production. Socket helps us prevent that."

The Solution: Consolidating Supply Chain Security on Socket#

Webflow moved its software composition analysis from Snyk to Socket and expanded into Socket Firewall, reachability analysis, threat intelligence, and the socket fix and patch workflows. Rather than a single point tool, Webflow adopted Socket across prevention, detection, and patching.

A few things drove the decision: deterministic reachability, Socket's threat research and how fast it shared new findings, and a roadmap that included firewall and Extension Guard.

"Deterministic reachability was an important feature for us," Agrawal said. "Socket's research and the speed the team moved at to share those findings with us was the X factor in making the decision. There were also things on Socket's roadmap back then, like firewall, that helped."

Blocking Malicious Packages Before They Reach Developers#

Socket Firewall is deployed across Webflow's engineering endpoints, coordinated by Mohammad A., Senior Security DevOps Engineer, with help from Rose and Webflow's IT team. It holds newly published packages during a cooldown window, keeping brand-new versions out of developer environments until they have been vetted.

"Socket Firewall gives us the sense of freedom that if something malicious is out there, it is not going to be installed," Bansal said. "It has been helping us stop hundreds of packages during the cooldown period."

Rolling Out Firewall Without Slowing Developers Down#

The bar is high for a tool that gates developers on their own machines. It needs to be an experience that they barely notice. Otherwise, if it gets in the way, developers will just turn it off.

"Developers are very opinionated about their local environments," Rose said. "When you introduce a tool that is going to hard gate them, the UX needs to be good enough that developers want to work with it rather than around it.

"The effort was wrapping it in a way that helps developers do the right thing without slowing them down. The interactive dev experience is good now. What we are working on now is providing hints to agents so the agent doesn't just try to work around it, and we are having a lot of success with that."

Because developers use different package managers and workflows, Webflow rolled firewall out in phases rather than all at once, starting small and widening as feedback came in. Mohammad captured that feedback in a dedicated Slack channel to track how the rollout landed for different teams.

"Every developer is different," Bansal said. "That is where it gets difficult. We re-evaluated our approach and went with a phased rollout, ten people, twenty, fifty, and captured every piece of feedback along the way. We are at all of engineering now, and we plan to roll it out to everybody in the company."

Reachability and Fixing at Scale#

On the SCA side, Socket's Tier 1 reachability analysis helps Webflow focus on the vulnerabilities that are actually exploitable in their code.

"If we go to the alert section, we might see six criticals," Agrawal said. "When we look at the Tier 1 reachability analysis, it might give us two. We wouldn't want to push a finding to developers and tell them to fix it right now when it is something unreachable."

Webflow also uses socket fix and socket patch to remediate in bulk, taking a repository with many criticals and highs and clearing them in a single PR. On the main mono repo, that work cleared all criticals and highs, though new dependencies arrive daily and the team keeps working the queue.

The socket fix command took some time to win the team over. At first, the security team worried it hid too much of what was being changed. As the command matured and gave better suggestions, that changed.

"Over time we were converted to being a believer in the socket fix command," Agrawal said. "It takes away the complexity around whether you need to go fix a specific version or let Socket take care of it. It is fully integrated into the developer workflows now."

Socket's policy engine runs in Webflow's CI pipeline, replacing a manual process the team used to maintain with Snyk. Webflow blocks on the findings that warrant it, like critical vulnerabilities, typosquatting, and known malware, while keeping other findings from stopping developers unnecessarily.

That approach also improved the inputs to development. Webflow has pointed developers to Socket's reports as part of dependency selection for a long time.

"It wouldn't be accurate to say it sped up how long a developer spends selecting a dependency," Rose said. "But it has improved the quality of the dependencies they have been requesting to add to the code base."

Support and Partnership#

Webflow pointed to Socket's support as a clear differentiator, both in responsiveness and in how quickly the team unblocked them.

When Webflow hit a blocker rolling out firewall, Socket moved fast. The team needed separate policies for different parts of the org, and Socket set up what they needed to move forward.

Ankit AgrawalSenior Manager of Application Security, Webflow

"We pointed out in the Slack channel that it didn't look possible for us to roll out firewall because of a number of issues," Agrawal said. "For most of the blocking ones, we were given a solution right away. We were able to start moving forward the next day with our critical blockers resolved."

For Bansal, the day-to-day model was the difference.

"We work with a lot of security tooling companies," Bansal said. "With Socket, if my team has a question, we reach out on Slack. We don't have to create a ticket or think about an SLA anymore. The team is always there in Slack, ready to help. That is the difference between the other companies and Socket."

Results#

With Socket, Webflow consolidated its supply chain security onto one platform, added prevention at the developer environment with firewall, cut alert noise with reachability, and cleared the criticals and highs on its main repo. The team also gained a partner whose research and response speed shortened the window between a new supply chain attack and Webflow knowing whether it was exposed.

"Socket is a company that is actively working on the core problems in the security supply chain space," Agrawal said. "We are fortunate to be a partner and to be able to influence the product as it moves forward."