Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

Unit 42 research highlights a dramatic rise in automated supply-chain attacks that target developer tools, CI/CD pipelines and cloud runtimes. The report details the ChainDrop npm worm — a three-step, highly evasive campaign that used preinstall hooks to deliver an obfuscated payload, read live process memory on GitHub Actions to steal OIDC tokens and local credentials, and then used stolen tokens to self-propagate across hundreds of packages while maintaining legitimate functionality; it also discusses persistence via developer tool hooks and blockchain-driven C2. The report emphasizes that SBOMs and point-in-time scans are insufficient and recommends strict execution controls, ephemeral CI servers, short-lived credentials, provenance signing, and other pipeline and endpoint hardening measures.