cyber.hendryadrian.com
Security News · stepsecurity.io

StepSecurity Adds Machine and CI Attribution to Secure Registry Requests

· Original article ↗

Summary

StepSecurity says Secure Registry can now attribute npm and PyPI requests to developer machines or CI workflows in its audit log, helping teams identify where a compromised package was pulled.

Key points

  • Secure Registry’s Policy Evaluations log now includes Source and Source Identifier columns for package requests.
  • Developer-machine requests link to a device page; GitHub Actions requests link to the corresponding Harden-Runner workflow run.
  • Teams can filter the log by package and version to identify machines and pipelines that requested them.
  • Attribution is opt-in: users add an identifier suffix to the registry authentication token; requests without one continue to work but have no source attribution.
  • The article cites the Mastra npm supply-chain incident and two compromised GitHub Actions as examples of why teams need to identify where malicious packages were pulled.

Article Details

Event Type
StepSecurity announced source attribution in Secure Registry audit logs, linking package requests to the developer machine or CI pipeline that made them.
Impact
The feature is intended to help security teams identify machines and pipelines that pulled compromised packages and scope remediation. The article cites the June 17, 2026 compromise of the @mastra npm organization, in which easy-day-js was added across more than 140 packages with a combined weekly download count exceeding 1.1 million, and the June 24 compromises of codfish/semantic-release-action and simonecorsi/mawesome.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainThe article describes a software supply-chain compromise in which an attacker added the malicious easy-day-js dependency across more than 140 packages in the Mastra AI framework ecosystem.

Vendors

GitHubThis is not a one-off problem. The following week, on June 24, two GitHub Actions, codfish/semantic-release-action and simonecorsi/mawesome, were compromised within hours of each other. The pattern is clear: maliciousStepSecuritySecure Registry is StepSecurity's authenticated upstream registry. Every npm and PyPI request from your developers, CI runners, and artifact managers flows through it and is evaluated against your security controls

Products

GitHub ActionsThis is not a one-off problem. The following week, on June 24, two GitHub Actions, codfish/semantic-release-action and simonecorsi/mawesome, were compromised within hours of each other. The pattern is clear: maliciousHarden-RunnerA request from GitHub Actions links to the corresponding Harden-Runner workflow run, so you can see the run's outbound network destinations, file write events, and detections alongside the package request.npmOn June 17, 2026, an attacker compromised the @mastra npm organization and quietly added easy-day-js, a typosquat of the popular dayjs date library, as a dependency across more than 140 packages in the Mastra AIPyPISecure Registry is StepSecurity's authenticated upstream registry. Every npm and PyPI request from your developers, CI runners, and artifact managers flows through it and is evaluated against your security controlsStepSecurity Secure RegistrySecure Registry now attributes every request to its source

Related Articles