Notifications
Clear all
Topic starter
24/08/2026 2:01 pm
TL;DR: Open source supply chain attacks reached 56 distinct incidents in 12 months, with the pace accelerating to roughly one incident every three days and several worm-like campaigns spreading through trusted packages, GitHub Actions, and CI/CD runners, according to StepSecurity. The pattern shows that build systems now need stronger identity, secrets, and egress controls because compromise often happens before production ever sees the code.
NHIMG editorial — based on content published by StepSecurity: The State of Open Source Supply Chain Attacks
By the numbers:
- Over the last 12 months, the StepSecurity threat intelligence team tracked and alerted on 56 distinct supply chain attacks.
- In March 2026 the rate jumped to 13 incidents in a single month and has stayed high since: 9 in April, 9 in May, 10 in June, 6 in July.
- In March 2026, the threat actor Team PCP ran a five day campaign, March 19 to 24, built on a simple loop.
Questions worth separating out
Q: What breaks when a compromised package executes during import in CI/CD pipelines?
A: Import-time execution collapses the usual separation between dependency loading and code execution.
Q: Why do supply chain attacks matter to NHI governance?
A: Because many supply chain compromises succeed through non-human identities, such as integrations, tokens, and service accounts, rather than through a user login.
Q: How do security teams know whether secrets in CI/CD are actually controlled?
A: Look for three signals: how many secrets a workflow can reach, how long those secrets remain valid, and whether any of them can publish or sign artefacts.
Practitioner guidance
- Inventory every pipeline identity and secret source Map which package managers, GitHub Actions, runners, and deployment jobs can access cloud keys, signing keys, and repository tokens.
- Restrict mutable release trust Replace tag-based trust with immutable versions, verified provenance, and explicit approval for package and action updates.
- Contain secret exfiltration at the runner Apply egress restrictions and secret-detection policies to CI/CD runners so a malicious dependency cannot call out with dumped credentials.
What's in the full report
StepSecurity's full report covers the operational detail this post intentionally leaves for the source:
- Month-by-month incident timeline from August 2025 through August 2026 with the specific ecosystems affected
- Per-campaign breakdowns for Shai-Hulud, Team PCP, Miasma, and other worm-style attacks
- Examples of how malicious packages stole CI/CD secrets from runner memory and propagated further compromise
- Runtime detection and blocking controls used to catch poisoned packages, repointed tags, and outbound exfiltration
👉 Read StepSecurity's analysis of open source supply chain attacks in 2026 →
Open source supply chain attacks: what IAM and CI/CD teams need now?
Explore further
24/08/2026 2:01 pm
Supply chain compromise is now an identity governance problem, not just a software trust problem. The report shows attackers are targeting the credentials that let packages, actions, and runners act with authority. That shifts the control question from 'is the package safe?' to 'which identities can this pipeline use, and how are they bounded?' Practitioners should treat build identities as governed assets, not background infrastructure.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, according to The State of Secrets in AppSec.
- 75% of organisations express strong confidence in their secrets management capabilities, even as leaked secrets still persist for weeks.
A question worth separating out:
Q: Who is accountable when a trusted upstream package is poisoned?
A: Accountability usually spans the publishing organisation, the platform team that allowed persistent release credentials, and the security team that failed to govern supply chain trust end to end. Frameworks such as NIST CSF and NIST SP 800-53 expect access control, monitoring, and lifecycle management for high-risk identities and release paths.
👉 Read our full editorial: Open source supply chain attacks are now a daily build risk
