Purple Red Blue

Supply chain attacks have evolved significantly since the high-profile incidents of the early 2020s. While organizations have improved their vendor risk assessments and started verifying software signatures, attackers have adapted with techniques that are considerably harder to detect.

The New Attack Surface

Build Pipeline Compromise

Rather than targeting source code directly, attackers are increasingly focused on CI/CD pipelines. A compromised build agent or a malicious GitHub Action can inject code during the build process without leaving any trace in the source repository. The resulting artifact is signed with legitimate keys, passes all code reviews, and contains malicious functionality that exists only in the compiled output.

Dependency Confusion at Scale

Typosquatting and dependency confusion attacks continue to grow. Package registries for npm, PyPI, and NuGet see thousands of malicious packages uploaded monthly. The most sophisticated variants don’t contain obviously malicious code — instead, they exfiltrate environment variables or install a lightweight backdoor that activates only in specific environments.

Compromised Maintainer Accounts

Open-source maintainers remain a high-value target. A single compromised npm account can push malicious updates to packages depended on by thousands of organizations. Unlike a code repository compromise, a malicious package update is automatically pulled by downstream consumers without any review.

Detection Strategies

1. Pin dependencies and verify checksums. Don’t rely on version ranges. Lock files (package-lock.json, Pipfile.lock, go.sum) should be committed and their integrity verified in CI.

2. Monitor for behavioral anomalies. Network egress from build pipelines should be strictly controlled and monitored. A build step that makes outbound HTTP requests to unfamiliar endpoints is a strong signal.

3. Implement build provenance. SLSA (Supply-chain Levels for Software Artifacts) provides a framework for ensuring build integrity. At minimum, maintain a verifiable record of what was built, from what source, and on what infrastructure.

4. Audit your dependency tree regularly. Tools like npm audit, pip-audit, and govulncheck identify known vulnerabilities, but manual review of new or changed transitive dependencies is equally important.

5. Use private package registries. Hosting approved packages internally and blocking direct access to public registries eliminates dependency confusion attacks entirely.

Supply chain security isn’t a one-time audit — it requires continuous monitoring and a defense-in-depth approach across your entire software delivery lifecycle.