Pipeline security lessons from March supply chain incidents (opens in new tab)

Between March 19 and 31, 2026, attacks on Trivy, KICS, LiteLLM, and axios demonstrated that CI/CD pipelines are valuable supply-chain targets. The incidents exploited trusted tools, stolen credentials, packaging mistakes, and malicious dependencies to steal secrets or leak proprietary code. The article argues that centralized, mandatory pipeline policies can detect and block these patterns before they reach production.

Recent Supply-Chain Incidents

• Trivy: Attackers compromised GitHub Action tags and distributed a trojanized binary that harvested environment variables, cloud tokens, SSH keys, and CI/CD secrets.
• Checkmarx KICS: Malicious versions of KICS GitHub Actions exfiltrated API keys, database passwords, cloud credentials, and service-account secrets.
• LiteLLM: Backdoored PyPI releases executed payloads during installation or Python startup, stealing sensitive files and credentials.
• AI coding assistant package: A 59.8 MB source map unintentionally exposed more than 1,900 TypeScript files, internal feature flags, model codenames, and a system prompt.
• axios: Compromised maintainer credentials enabled malicious releases containing a cross-platform Remote Access Trojan through a poisoned dependency.

Three Attack Patterns

Poisoned Tools and Actions

• Pipelines often implicitly trust security scanners, GitHub Actions, package versions, and container images.
• Mutable tags can be changed after approval, causing future pipeline runs to execute malicious code.
• Recommended controls:
  • Pin actions and tools to commit SHAs or image digests.
  • Verify checksums or signatures.
  • Block execution when integrity checks fail.

Packaging Errors That Expose Intellectual Property

• Incorrect .npmignore files or files settings can include source maps, internal configuration, and other debugging artifacts in published packages.
• Pre-publish validation should compare package contents against an allowlist.
• Builds should flag unexpected source maps, .env files, and internal files, then block publication when violations occur.

Malicious Transitive Dependencies

• A compromised dependency can affect users who never directly selected it.
• Unexpected lockfile changes or newly introduced packages can spread attacks across an organization.
• Recommended controls:
  • Compare dependency checksums with known-good lockfile state.
  • Detect unexpected dependency or version changes.
  • Reject unverified packages during builds.

GitLab Pipeline Execution Policies

• GitLab Pipeline Execution Policies inject mandatory CI/CD jobs into pipelines across an organization.
• Policy-defined jobs cannot be bypassed through [skip ci] or [no_pipeline].
• Jobs can run in reserved pre- and post-pipeline stages, surrounding developer-defined jobs.
• GitLab’s open-source Supply Chain Policies project provides independently deployable policies and sample violations for testing the three attack patterns.

The practical recommendation is to make supply-chain validation mandatory and centralized: pin trusted inputs, inspect published artifacts, verify dependency changes, and block builds or releases when policy checks fail.