Notifications
Clear all
Topic starter
21/08/2026 5:00 pm
TL;DR: Four SAP npm packages were poisoned to steal developer credentials, cloud secrets, and CI/CD tokens during npm install, and the attack chain completed in seconds, according to AccuKnox. That timing exposes a governance gap: detection after execution is too late when supply chain malware weaponises trusted install workflows.
NHIMG editorial — based on content published by AccuKnox covering the SAP npm supply chain attack: SAP npm supply chain attack. Legacy Detect-and-Respond Tools Leave Your Doors Wide Open
By the numbers:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when malicious npm packages execute during CI/CD installs?
A: The main failure is that package installation becomes code execution inside a trusted build context.
Q: Why do CI/CD runners create such high credential risk?
A: They often contain many reusable secrets at once, including cloud keys, package tokens, SSH material, and cluster credentials.
Q: How can security teams tell whether secret management is actually working?
A: Look for fewer plaintext secrets, narrower reuse, faster rotation, and a shrinking set of credentials that remain valid across multiple systems.
Practitioner guidance
- Block unapproved execution in build environments Enforce process allowlisting so downloaded runtimes, postinstall scripts, and unexpected binaries cannot execute inside CI/CD runners or developer workstations.
- Deny direct reads of secret-bearing paths Restrict access to ~/.ssh, ~/.aws/credentials, ~/.npmrc, Kubernetes service account tokens, and /proc/self/environ at the syscall layer.
- Scope and rotate publish tokens aggressively Separate package publishing credentials from routine development access, apply narrow repository scope, and rotate tokens after any suspicious install or build event.
What's in the full article
AccuKnox's full post covers the operational detail this post intentionally leaves for the source:
- Kernel-level enforcement mechanics using eBPF and Linux Security Modules in workload environments.
- How file access controls stop reads from ~/.ssh, ~/.aws/credentials, ~/.npmrc, and /proc/self/environ.
- Process whitelisting behaviour for blocking downloaded runtimes such as Bun before execution.
- CI/CD-specific deployment patterns for Kubernetes runners, VMs, and bare-metal build hosts.
👉 Read AccuKnox's analysis of the SAP npm supply chain attack and runtime controls →
SAP npm supply chain attack: what runtime controls need to block?
Explore further
21/08/2026 5:16 pm
Inline runtime enforcement is now the decisive control boundary for supply chain identity theft. Detection-based tooling can still be useful for investigation, but it fails as the primary containment layer when secret exfiltration completes in seconds. This article shows that the real control question is whether a malicious process can ever read credential files or proc-backed environment data at all. For NHI governance, kernel-level denial matters more than downstream alerting.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Who is accountable when a supply chain package steals credentials and machine access?
A: Accountability usually sits across engineering, platform security, and identity teams because the failure spans software intake, endpoint execution, and credential governance. The right control owners are the teams that approve package trust, manage secret lifecycles, and define which identities may exist on developer workstations.
👉 Read our full editorial: SAP npm supply chain attack exposes why runtime controls matter
