Attackers publish look-alike packages or take over maintainers of popular ones, then insert code that steals tokens and secrets from developer machines and CI/CD systems.
How to defend
- Pin dependency versions and check them with software composition analysis
- Produce an SBOM for every application
- Use short-lived, narrowly scoped tokens in pipelines
- Scan repositories for secrets continuously
Trend analysis by the Cybershield Threat Intelligence team.