The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches 

This report analyzes a class of supply-chain attacks (Sept 2025–May 2026) where malicious install-time package code steals developer and CI/CD credentials (AWS, GCP, Azure, GitHub tokens, SSH keys, etc.), enabling adversaries to pivot into cloud accounts for reconnaissance, persistence, data exfiltration, and further propagation; it documents multiple campaigns (Shai-Hulud, BufferZoneCorp, TeamPCP), maps observed behaviors to MITRE ATT&CK, and provides controls to reduce install-time trust, limit credential scope, enforce metadata protections (IMDSv2, managed identities, Workload Identity), and prioritize cloud risk using Qualys TotalCloud/TruRisk.