Introduction#
Supply chain attacks target the software you build with, not just the code you write. In open source ecosystems, a single malicious package or compromised build step can affect thousands of downstream projects. This short post explains common attack paths and gives actionable steps you can apply today.
How attackers get in#
Attackers use several practical routes:
- Malicious packages: uploading trojanized libraries to npm, PyPI, or RubyGems that look legitimate.
- Compromised credentials: stealing maintainer keys or CI tokens to push bad releases.
- Repository hijack: taking over a popular project or its CI pipeline.
- Typosquatting: publishing packages with names similar to popular ones.
Real example: a colleague once pulled a small utility from a new npm package that introduced a loader which phoned home. It looked fine until our CI flagged unusual outbound requests. That was a reminder that small dependencies can bite.
Simple defenses you can start with#
These are low-friction steps that reduce most risk:
- Pin versions and use lockfiles: prefer exact versions in production builds.
- Verify integrity: check package signatures or use checksum verification in pipelines.
- Least privilege for CI: store only the tokens the job needs. Rotate them regularly.
- Limit transitive dependency risk: audit your dependency tree and trim unused packages.
- CI provenance: record build metadata so you can trace artifacts back to a signed source.
Example CI snippet to show provenance capture:
# record minimal provenance info
echo "commit=$(git rev-parse --verify HEAD)" > build/provenance.txt
echo "user=$(git show -s --format=%an HEAD)" >> build/provenance.txt
tar czf artifact.tgz -C dist .
sha256sum artifact.tgz >> build/provenance.txtDetecting and responding#
Detection tools help but do not replace good process:
- Use SCA (software composition analysis) tools to surface suspicious packages.
- Monitor dependency registries for publish events on packages you use.
- Set alerts for unexpected outbound network calls in staging.
- Have a rollback and incident plan: isolate builds, revoke tokens, and publish advisories quickly.
A mild opinion: automatic dependency churn is the real enemy. If your project pulls in new, unreviewed packages frequently, you amplify risk.
Conclusion#
Supply chain attacks exploit trust and automation more than clever exploits. Reduce risk by pinning, capturing provenance, minimizing CI privileges, and auditing dependencies. Start with the simple controls above and iteratively tighten build and release processes. A small habit change now saves messy incident work later.
Co-authored with Vishwakarma, Deeps 2nd Brain
