A supply-chain attack pattern where malicious delivery is directed at specific organisations, IP ranges, regions, or accounts rather than broadly distributed. This makes detection and scoping harder because the compromise footprint can remain small and inconsistent.
Expanded Definition
Selective supply-chain targeting describes a delivery strategy where the attacker does not flood the ecosystem broadly. Instead, malicious packages, updates, dependencies, plugins, or integrations are aimed at chosen organisations, accounts, regions, or IP ranges, making the campaign smaller, more plausible, and harder to scope. In NHI security, that precision matters because compromised service accounts, API keys, and automation tokens often determine whether a targeted payload can move from a software artefact into live systems. The control challenge is less about volume and more about trust boundaries, provenance, and whether an apparently legitimate update is being used as a delivery mechanism. Guidance varies across vendors on whether this is classified as a supply-chain compromise, a targeted intrusion, or an NHI abuse pattern, but the operational reality is consistent: the attacker is optimising for selective reach rather than mass distribution. Frameworks such as the OWASP Non-Human Identity Top 10 treat identity misuse as a core driver of impact. The most common misapplication is treating a targeted delivery event as a generic package incident, which occurs when teams scope only the artifact and ignore the identities and tenants it was aimed at.
Examples and Use Cases
Rigorously defending selective targeting often introduces triage friction, because teams must separate harmless distribution noise from campaign-specific indicators and then trace which identities were meant to receive the payload.
- A maintainer account is compromised and a malicious release is pushed only to customers using a specific cloud region, resembling the kind of focused ecosystem abuse seen in the Mastra npm Supply Chain Attack — Sapphire Sleet.
- A malicious GitHub Action targets repositories belonging to a narrow set of technology stacks, similar in pattern to the Reviewdog GitHub Action supply chain attack, where execution context matters more than sheer distribution.
- A plugin or marketplace update is delivered only to organisations using a specific vendor integration path, echoing the JetBrains Marketplace AI Plugin Campaign.
- An attacker inserts a dependency update that activates only when it detects certain IP ranges, accounts, or tenant metadata, keeping exposure limited and delaying detection.
- Defenders use provenance checks, dependency pinning, and release validation alongside guidance from the OWASP Non-Human Identity Top 10 to reduce the chance that a targeted payload can exploit a trusted automation path.
Selective targeting is also visible in cases where attackers weaponise a narrow trust relationship rather than a wide distribution channel, such as campaigns documented in Klue OAuth Supply Chain Breach and LiteLLM PyPI package breach.
Why It Matters in NHI Security
Selective supply-chain targeting is dangerous because it blends into normal software delivery while aiming at identities that can unlock production access. When the payload is restricted to a subset of tenants or accounts, security tooling may undercount the event, and incident response teams may miss which secrets, service principals, or automation tokens were exposed. That creates a governance problem as much as a technical one: the organisation may believe a compromise was contained simply because the blast radius looked small. In practice, the blast radius can be narrow and still catastrophic if the targeted system holds privileged NHI credentials. The 52 NHI breaches Report shows that identity-centred failures are rarely isolated from broader supply-chain weakness, and the vendor-aligned State of Secrets in AppSec research underscores how long secret remediation can linger once exposure occurs. Organisations typically encounter the real cost only after a targeted package, plugin, or pipeline step has already touched a privileged account, at which point selective supply-chain targeting becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Targets often rely on stolen or abused secrets and automation credentials. |
| OWASP Agentic AI Top 10 | A-06 | Agentic toolchains can be abused through selective malicious updates or plugins. |
| NIST CSF 2.0 | DE.CM-8 | Supply-chain anomalies must be monitored to detect narrow, targeted compromise patterns. |
| NIST Zero Trust (SP 800-207) | PA-4 | Zero Trust treats every software and identity path as untrusted until verified. |
| NIST AI RMF | AI systems can ingest poisoned or selectively delivered inputs through supply chains. |
Assess targeted supply-chain exposure as a risk to model inputs, tools, and downstream behaviour.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
