Why do maintainer and publish credentials matter so much in supply-chain attacks?

Why Maintainer and Publish Credentials Matter

Maintainer and publish credentials sit at the trust boundary of the software ecosystem. Whoever controls them can ship code that downstream teams will treat as routine, which is why these secrets are high-value targets in package repositories, CI/CD systems, and release automation. Current guidance from OWASP Non-Human Identity Top 10 and NHIMG’s 52 NHI Breaches Analysis both show the same pattern: compromise the identity that publishes, and the attacker inherits trust.

The risk is not limited to the maintainers themselves. Publish tokens, signing keys, GitHub App credentials, and CI secrets often outlive the human who created them and may be reused across multiple repositories or environments. That expands blast radius when an attacker phishes a maintainer, steals a token from a workflow log, or captures a secret from a compromised runner. In practice, many security teams only notice the issue after a malicious release has already propagated through dependency trees, rather than through intentional review of publish-path controls.

How It Works in Practice

The publish path is usually a chain of identities and secrets: a developer commits code, CI validates it, a release job packages it, and a maintainer or automation token pushes it to a registry. The weakest link is often the credential that can perform the final trusted action. If that credential is static and broadly scoped, an attacker does not need to own the entire environment. They only need enough access to impersonate the publisher.

Practical defense starts by narrowing who and what can publish. Use separate identities for development, build, and release, and avoid reusing the same secret across repositories. Prefer short-lived tokens, JIT issuance, and workload identity where possible, because the control point should be what the pipeline is allowed to do right now, not what a long-lived credential could do months ago. NHIMG’s Ultimate Guide to NHIs — Static vs Dynamic Secrets explains why ephemeral credentials reduce exposure when release automation is compromised.

Release integrity also depends on how secrets are stored and rotated. Secrets should be kept out of source repositories, excluded from logs, scoped to the minimum repository or package namespace, and revoked immediately after use where automation allows it. Publishing should be paired with strong provenance and review controls, and the final release step should be monitored as a privileged event. When an attack does occur, indicators often appear in the supply chain itself, which is why NHIMG’s Shai Hulud npm malware campaign is a useful reminder that stolen maintainer access can be weaponized at scale. For implementation detail, CISA cyber threat advisories and the NIST SP 800-53 Rev 5 Security and Privacy Controls provide a solid baseline for credential handling, logging, and privileged change control.

These controls tend to break down in monorepos and multi-package release pipelines because one credential can still reach many publish targets if namespace boundaries are not enforced.

Common Variations and Edge Cases

Tighter publish control often increases release friction, requiring organisations to balance speed against provenance, approval overhead, and incident containment. That tradeoff is most visible in open-source projects, vendor-maintained packages, and fast-moving internal platforms where many humans and automation jobs can trigger releases.

There is no universal standard for this yet, but current guidance suggests treating maintainer access as highly privileged and separating human approval from machine execution. In some environments, a human maintainer approves the release while an automation identity performs the actual publish under tightly scoped permissions. In others, a signed build artifact is promoted by a release service that never exposes a reusable publish secret at all. Both patterns are stronger than embedding registry tokens in CI variables or developer laptops.

Edge cases matter. Emergency hotfixes may require temporary elevated access, but that should be time-boxed and fully logged. Cross-ecosystem publishing, such as pushing the same package to multiple registries, can create inconsistent credential hygiene if each registry uses a different rotation policy. The most common failure mode is not sophisticated exploitation but credential sprawl: old tokens, shared bot accounts, and secrets copied into release tooling that never get removed. For that reason, NHIMG’s Reviewdog GitHub Action supply chain attack is a practical example of why publish-path secrets need lifecycle ownership, not just storage.

External research on AI-orchestrated intrusion also reinforces the broader point that automation accelerates abuse once a trusted identity is captured, as shown in Anthropic’s first AI-orchestrated cyber espionage campaign report.

Related resources from NHI Mgmt Group

• Why do maintainer credentials make npm supply chain attacks so dangerous?
• Why do CI/CD tokens and maintainer credentials matter so much in supply chain security?
• Why do publish tokens make supply-chain compromises much harder to contain?
• Why do supplier management credentials matter so much in supply chain risk?