Supply-Chain Attacks Exploit Trusted Maintainers, CI/CD Workflows and Software Tools
Summary
An analysis of recent supply-chain campaigns finds a recurring pattern: attackers compromise trusted people or components, abuse release and automation workflows, steal secrets, and propagate through connected software ecosystems.
Key points
- The article identifies transitive trust exploitation as a defining pattern in recent software supply-chain attacks.
- The Axios compromise used social engineering to hijack a maintainer’s authenticated sessions and publish malicious npm versions outside the normal CI workflow.
- Shai-Hulud 2.0 modified hundreds of packages, ran code during installation, and harvested secrets for exfiltration.
- The tj-actions/reviewdog compromise used commit impersonation and tag rewriting to distribute code that exposed CI runner secrets.
- The TeamPCP campaign abused workflow misconfiguration, exposed tokens, hijacked tags, and used stolen credentials to spread across related tools.
- Other risks discussed include credential-harvesting packages, malicious or compromised VS Code extensions, and dependency confusion.
- The article recommends treating maintainer identity, dependency and action governance, CI/CD design, install-time execution, and extension governance as security controls.
Article Details
- Attack Vectors
- Social engineering to compromise a package maintainer's endpoint and hijack authenticated sessions, followed by publication of malicious package versions outside the normal CI workflow.
- Compromised maintainer accounts used to alter legitimate packages, execute malicious code during preinstall, bootstrap Bun, harvest secrets, and stage exfiltration through attacker-controlled repositories.
- Compromised GitHub Actions distributed through commit impersonation and tag rewriting, exposing CI runner secrets through memory dumping and workflow logs.
- Misconfigured pull_request_target workflows exposed tokens; incomplete credential rotation and tag hijacking enabled persistent access and poisoned releases.
- Malicious PyPI packages using name confusion executed during install or import to profile environments and extract credentials.
- Compromised or malicious VS Code extensions executed in the IDE and accessed source code, local files, tokens, and workspace context, with persistence via auto-update and startup triggers.
- Dependency confusion caused public packages with names matching internal dependencies and higher version numbers to be resolved and executed during builds.
- Defensive Notes
- Treat dependency resolution, CI workflow design, maintainer identity, and extension governance as first-class security controls.
- Govern dependencies and actions, including release and tag integrity, and control build-time and install-time execution.
- Manage trust and identity for maintainers, bots, and publishers; review CI/CD architecture and workflow design.
- Rotate exposed credentials completely and promptly, and monitor for secret harvesting and lateral movement across connected tooling ecosystems.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article's ATT&CK mapping describes encoded or disguised payload logic used to resist static review and simple scanning.T1059 · Command and Scripting InterpreterMalicious code executed through package install hooks, setup scripts, shell commands, and CI task logic.T1071 · Application Layer ProtocolThe article's ATT&CK mapping describes exfiltration and command traffic over standard web protocols.T1078 · Valid AccountsCompromised maintainer, bot, registry, and CI identities were used to access trusted systems and workflows.T1195 · Supply Chain CompromiseMalicious code or release behavior was inserted into trusted packages, actions, and artifacts across the reported supply-chain compromises.T1552 · Unsecured CredentialsThe campaigns harvested CI secrets, bot tokens, registry credentials, and developer-side secrets.
CVE
People
Threat Actors
Products
AxiosRecent incidents—including the Axios npm compromise [1] [2], the Shai-Hulud 2.0 npm campaign [3], the tj-actions/reviewdog GitHub Actions compromise [4] [5], and the TeamPCP cascading campaign affecting Trivy, LiteLLM,BunMalicious code executed during preinstall, bootstrapped its own runtime (Bun), deployed tooling (including GitHub runner components), and actively harvested secrets using tools like TruffleHog [3].GitHub Actionsthe Axios npm compromise [1] [2], the Shai-Hulud 2.0 npm campaign [3], the tj-actions/reviewdog GitHub Actions compromise [4] [5], and the TeamPCP cascading campaign affecting Trivy, LiteLLM, KICS, and relatedKICSGitHub Actions compromise [4] [5], and the TeamPCP cascading campaign affecting Trivy, LiteLLM, KICS, and related ecosystems [6] [7]—demonstrate a consistent attacker model:LiteLLMGitHub Actions compromise [4] [5], and the TeamPCP cascading campaign affecting Trivy, LiteLLM, KICS, and related ecosystems [6] [7]—demonstrate a consistent attacker model:npmRecent incidents—including the Axios npm compromise [1] [2], the Shai-Hulud 2.0 npm campaign [3], the tj-actions/reviewdog GitHub Actions compromise [4] [5], and the TeamPCP cascading campaign affecting Trivy, LiteLLM,PyPIPyPI Credential-Harvesting CampaignsTrivythe tj-actions/reviewdog GitHub Actions compromise [4] [5], and the TeamPCP cascading campaign affecting Trivy, LiteLLM, KICS, and related ecosystems [6] [7]—demonstrate a consistent attacker model:VS CodeVS Code / Extension Marketplace Abuse