Software Supply Chain Security Best Practices for 2026
Summary
Aikido’s guide recommends package-age gates, lockfile and commit-SHA pinning, scoped credentials, developer-device protections, AI-agent sandboxing, and audit logs to reduce software supply chain risk.
Key points
- The article says Aikido Intel analyzed about 7.5 million package versions in Q2 2026 and confirmed 19,500 malicious packages.
- It recommends a 48-hour minimum package age and disabling install scripts by default, with allowlisting for packages that need them.
- Lockfiles, frozen installs, commit-SHA pins for CI dependencies, and container image digests can prevent unexpected dependency changes.
- The guide says attackers repointed tj-actions/changed-files tags to malicious code that exposed CI secrets in workflow logs; repositories pinned to commit SHAs were unaffected.
- It recommends fine-grained, separate pipeline tokens, FIDO2 or passkeys for maintainers, endpoint monitoring, and centrally managed extension allowlists.
- For AI agents, it advises limiting permissions, sandboxing runtime access, treating MCP servers as dependencies, and validating untrusted input before it reaches commands or file writes.
- Audit logs, signed SBOMs, and rehearsed credential-rotation plans can help identify exposure and respond to malicious package incidents.
Article Details
- Defense Focus
- Prevent malicious dependencies and extensions from entering developer environments and repositories, limit the impact of compromised credentials and AI agents, and improve visibility and response readiness for software supply-chain incidents.
- Detection Methods
- Inspect npm and pip installs at install time for malicious packages and enforce package-age minimums or package allowlists.
- Scan repository changes and pull requests for newly introduced malicious or suspicious dependencies before merge.
- Centrally enforce approved IDE extension and browser plugin allowlists, alongside install-time extension detection.
- Analyze package releases promptly; the article says Aikido Intel analyzes new packages in an average of six minutes and often flags malicious ones within one or two minutes.
- Monitor organization audit logs for registry pushes, token use, account email changes, and the publication and timestamps of package versions.
- Audit workflows that pass issue titles or pull-request descriptions to AI agents, and validate agent output before it reaches shell commands or file writes.
- Generate signed SBOMs for build artifacts, including transitive dependencies, to identify exposure when a compromised package or CVE is reported.
- Data Sources
- Organization audit logs, especially package registry pushes and token use
- Package registry records, including account email changes, published versions, and timestamps
- npm and pip install activity on developer machines
- Repository and pull-request dependency changes
- CI workflow logs
- SBOMs and build-artifact records
- Platforms
- Developer endpoints
- Private package registries
- CI/CD pipelines
- Source-code repositories
- SIEM
- AI-agent workflows
- IDE and browser extension environments
- Defensive Actions
- Require a minimum 48-hour package age before dependency versions can be installed; configure the package manager or private registry to enforce it.
- Disable dependency install scripts with settings such as --ignore-scripts, allowlist necessary exceptions, and apply the policy on developer machines and in CI.
- Commit lockfiles and require frozen or immutable dependency installation in pipelines.
- Pin CI dependencies to full commit SHAs and container base images to digests; use scheduled updates to receive upstream fixes deliberately.
- Use fine-grained, separately issued pipeline tokens; rotate them on a defined schedule or suspicion and revoke access when it is no longer needed.
- Require FIDO2 or passkeys for maintainer accounts and monitor account recovery or email-change alerts.
- Centrally approve IDE extensions and browser plugins, and treat unverified MCP servers like unverified dependencies.
- Scope AI-agent permissions to the task, sandbox runtime access with network-egress controls, and validate untrusted input and agent output.
- Stream organization audit logs to a SIEM and rehearse a credential-rotation playbook, including available bulk-revocation procedures.
- Sign SBOMs at build time and store them alongside their corresponding artifacts.
MITRE ATT&CK
T1105 · Ingress Tool TransferA fake WakaTime extension reportedly retrieved a second payload from a GitHub Releases page.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious package releases, including the reported axios-related package incident and packages republished by CanisterWorm, used compromised software dependencies to reach downstream users.T1195.002 · Compromise Software Supply ChainAttackers compromised the tj-actions/changed-files GitHub Action and repointed its version tags to a malicious commit that exposed CI secrets in workflow logs.T1213.003 · Code RepositoriesThe attacker used the token from the compromised laptop to clone 170 of CrowdSec's private repositories.T1528 · Steal Application Access TokenIn the TanStack-related incident described, an attacker used a token available on a compromised developer laptop to clone CrowdSec private repositories.T1550.001 · Application Access TokenThe attacker used a token from a compromised developer laptop to access and clone CrowdSec private repositories.T1567.003 · Exfiltration to Text Storage SitesA malicious issue title in the PromptPwnd example caused an AI agent to write repository secrets into a public issue thread using its legitimate access.
Threat Actors
Vendors
ActiveCampaign2025, a package called postmark-mcp appeared on npm, impersonating the official MCP server that ActiveCampaign maintains for the Postmark email service. Its job was to let an AI assistant send email through yourAikidoHow Aikido Security helps protect against supply chain attacksGitHubthe possibility of drift, because a SHA refers to one specific tree of code and cannot be repointed. GitHub Actions, GitLab, Buildkite, and Jenkins all accept one in place of a tag. CircleCI works differently,PostmarkIn September 2025, a package called postmark-mcp appeared on npm, impersonating the official MCP server that ActiveCampaign maintains for the Postmark email service. Its job was to let an AI assistant send email through
Products
Aikido IntelIn the second quarter of 2026, Aikido Intel analyzed around 7.5 million package versions. Between our automated systems and human researchers, we confirmed 19,500 malicious packages. Attackers have been abusing openDevice ProtectionDevice Protection covers what gets installed on developer machines and blocks malicious packages and extensions across the organization. Safe Chain is the free and open-source version for individuals that blocksGemini CLICI/CD pipelinesI, affecting at least five Fortune 500 companies. A malicious issue title fed into a Gemini CLI workflow caused the agent to write repository secrets into a public issue thread using its ownGitHub Actionsthe possibility of drift, because a SHA refers to one specific tree of code and cannot be repointed. GitHub Actions, GitLab, Buildkite, and Jenkins all accept one in place of a tag. CircleCI works differently, sinceGitHub Enterpriseconfirm a rotation actually finished, and run the drill. Know your break-glass option in advance. GitHub Enterprise supports bulk credential revocation for a compromised user or for everyone in the enterprise atnpmputs time between publication and adoption. Enforce it at the private registry or at the package manager. npm has min-release-age since 11.10.0, and Yarn and Bun both ship their own age gates.OpenVSXIn April 2026, Aikido found a fake WakaTime extension on OpenVSX carrying a native binary that loaded before any legitimate extension logic, pulled a second payload from a GitHub Releases page, and force-installed itPostmarkIn September 2025, a package called postmark-mcp appeared on npm, impersonating the official MCP server that ActiveCampaign maintains for the Postmark email service. Its job was to let an AI assistant send email throughSafe Chaininstalled on developer machines and blocks malicious packages and extensions across the organization. Safe Chain is the free and open-source version for individuals that blocks malicious packages at install time.
Tools
Dependabotand GitLab includes among others, and it can do the initial conversion from tags to SHAs for you. Dependabot keeps existing Action pins current but is GitHub Actions only. Renovateupstream fixes automatically, so pair this fix with a bot that opens PRs to move the SHA forward. Renovate handles Actions and GitLab includes among others, and it can do the initial conversion from tags to SHAs