Notifications
Clear all
Topic starter
17/08/2026 5:39 pm
TL;DR: Recent reporting on Glassworm shows that invisible Unicode payloads, compromised developer and publishing credentials, and automated propagation can turn trusted software channels into a supply chain attack path, according to Unosecur. The real control gap is not code review alone but governance over the non-human identities that publish, build, and distribute software.
NHIMG editorial — based on content published by Unosecur: Glassworm and the Rise of Non-Human Identities in the Software Supply Chain
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when supply chain identities are not governed like privileged assets?
A: The delivery path becomes an attacker-controlled trust channel.
Q: Why do non-human identities increase supply chain risk in developer tools?
A: Non-human identities such as registry tokens, CI secrets, and publishing accounts often have durable access and broad scope.
Q: How do security teams detect malicious software delivery when the code looks legitimate?
A: By looking at identity behaviour and build artefacts together.
Practitioner guidance
- Inventory every publishing and automation identity Map service accounts, API tokens, package publisher credentials, and CI/CD identities to the repositories, registries, and environments they can touch.
- Separate build, publish, and deploy privileges Prevent one credential from controlling the full delivery path.
- Block invisible Unicode and encoding anomalies Add automated checks in pre-commit, pull request, and package ingestion workflows to detect zero-width characters, mixed encodings, and other hidden payload techniques before human review begins.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- How the Glassworm campaign affected GitHub repositories, NPM packages, and VS Code extensions across real delivery paths
- The specific detection signals the vendor highlights for Unicode obfuscation, token misuse, and unusual publishing activity
- The remediation steps for reducing credential exposure and separating build, release, and distribution roles
- The vendor's applied perspective on how SaaS and cloud identity controls can reduce blast radius in software delivery workflows
👉 Read Unosecur's analysis of Glassworm and NHI risk in the software supply chain →
Glassworm and NHI governance: what software supply chain teams missed?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 5:40 pm
Glassworm is an NHI problem before it is a malware problem. The article is right to shift attention from code artifacts to the identities that publish, build, and distribute them. A package manager or CI pipeline is not a neutral tool when it authenticates with tokens and service accounts that can be abused like any other privileged NHI. Practitioner conclusion: the supply chain must be governed as an identity estate, not as a collection of files.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Only 44% of developers are reported to follow security best practices for secrets management, which helps explain why software delivery identities remain a repeatable attack path.
A question worth separating out:
Q: Who is accountable when a stolen publishing token is used to spread malware?
A: Accountability sits with the team that owns the publishing identity, the platform that governs distribution, and the security function that defines revocation and monitoring requirements. In practice, governance must cover the full lifecycle of the token, from issuance to offboarding, because stale publishing access becomes an attack primitive once compromise occurs.
👉 Read our full editorial: Glassworm shows why software supply chains are NHI problems
