Source: Unit 42
Author: Yaron Avital
URL: https://unit42.paloaltonetworks.com/sdlc-supply-chain/
ONE SENTENCE SUMMARY:
Supply chain attacks now target developer tools, CI/CD, and cloud runtimes, demanding continuous visibility, execution controls, and cryptographic provenance.
MAIN POINTS:
- Threats shifted from finished software bugs to poisoning the software “digital factory.”
- Multi-year contributor trust abuse enabled backdoors, exemplified by XZ Utils CVE-2024-3094.
- Account hijacking can inject malware into widely used libraries, as seen with Axios.
- Setup script abuse powers credential-stealing worms, including Shai-Hulud via npm preinstall hooks.
- ChainDrop infected 400+ npm packages while preserving functionality to avoid detection.
- GitHub Actions runner memory was targeted to steal OIDC tokens and secrets.
- Stolen npm/GitHub tokens enabled automated republishing and self-propagation across packages.
- Persistence leveraged VS Code and Claude Code hooks plus Ethereum-managed dynamic C2.
- Open-source dependency depth expands attack surface across endpoints, pipelines, and cloud infrastructure.
- Static SBOMs and app-only scans miss build-time execution, pipeline tools, and container OS layers.
TAKEAWAYS:
- Map third-party package touchpoints throughout the SDLC, not only at build completion.
- Add PBOMs and container SBOMs to expose tools and underlying runtime dependencies.
- Reduce developer-tool privilege risk by controlling install scripts and extension execution.
- Harden CI/CD with egress restrictions, ephemeral runners, and commit-SHA dependency pinning.
- Replace long-lived secrets using short-lived OIDC and enforce end-to-end signed provenance.