Topic starter
02/08/2026 11:30 am
TL;DR: Supply chain malware can execute inside trusted install flows, which makes EDR and proxy controls ineffective when package managers, extensions, or CI runners fetch poisoned dependencies, according to Aikido. The control gap is not visibility alone but machine-local enforcement that understands install-time behaviour and remains present regardless of network path.
Editorial analysis by NHI Mgmt Group, based on content published by Aikido: “Why EDR and proxy won’t save you from supply chain malware”.
Key questions
Q: What breaks when supply chain malware can use trusted platforms as command channels?
A: Traditional network filtering and signature scanning lose much of their value because the malicious traffic looks like normal developer activity.
Q: Why do developer package compromises create both malware and identity risk?
A: Because the compromised package often reaches credentials, tokens, and API access that the developer or CI runner already possesses.
Q: What signs suggest proxy-based supply chain controls are failing?
A: A key signal is when downloads, extensions, or dependency installs still succeed from unmanaged locations or through tools that ignore system proxy settings.
Practitioner guidance
- Harden developer install paths Restrict what package managers, extension hosts, and build tools can read, execute, and contact during install time so trusted workflows cannot reach broad secrets or arbitrary subprocesses.
- Reduce secret exposure on build systems Move cloud keys, tokens, and other high-value secrets out of endpoints and runners that routinely fetch dependencies, then scope any remaining credentials to the smallest possible task.
- Enforce local execution controls Use on-device controls that inspect install-time behaviour directly, because network proxies cannot protect downloads that bypass them or tools that ignore proxy settings.
Bottom line: Supply chain malware exploits trusted developer workflows, so the security gap is not just malicious code but the approval model that lets that code execute with normal permissions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:45 pm
Install-time trust is the real control gap: EDR and proxy tooling both assume the dangerous event is visible as an anomaly after or during transit. Supply chain malware breaks that assumption by arriving through approved workflows and then behaving like normal tooling. The governance lesson is that execution trust must be decided at install time, not inferred later from process telemetry.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should teams prioritise endpoint controls or network controls for supply chain malware?
A: Endpoint controls should take priority when the threat is local execution of trusted software, because the malicious action happens after the download and often outside the proxy path. Network controls still matter for blocking known-bad sources, but they cannot be the only checkpoint. The deciding factor is whether the control can observe install-time behaviour on the machine itself.
👉 Read our full editorial: Why EDR and proxies fail against supply chain malware