--- title: Connecting the Dots: Securing the Overlooked Corners of... description: Attackers are increasingly targeting CI/CD pipelines, developer tools, and package ecosystems rather than finished application code. Unit 42 details the... canonical: https://daily.dev/posts/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-su-cygsdd57c twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain | daily.dev og:description: Attackers are increasingly targeting CI/CD pipelines, developer tools, and package ecosystems rather than finished application code. Unit 42 details the... og:url: https://daily.dev/posts/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-su-cygsdd57c og:image: https://api.daily.dev/og/posts/cYgSdD57c.png og:image:alt: Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain **[Unit 42](https://daily.dev/sources/unit42)** · 6 min read · 1 upvotes · 0 comments ## Summary Attackers are increasingly targeting CI/CD pipelines, developer tools, and package ecosystems rather than finished application code. Unit 42 details the ChainDrop npm worm, which infected 400+ packages including keyv and cacheable-request, stealing OIDC tokens from GitHub Actions runner memory, backdooring VS Code and Claude Code configs, and self-propagating via stolen tokens — all managed through Ethereum-based C2. The post maps the full SDLC attack surface across developer endpoints, build pipelines, and cloud runtimes, arguing that static SBOMs are insufficient. Recommended defenses include disabling npm lifecycle scripts, pinning dependencies to commit SHAs, restricting CI/CD egress, using ephemeral build servers, transitioning to short-lived OIDC credentials, and generating pipeline bills of materials (PBOMs) alongside container SBOMs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the ChainDrop npm worm spread and what did it steal? ChainDrop infected 400+ npm packages including keyv and cacheable-request using a three-step chain. A malicious preinstall script downloaded the Bun runtime to launch a 727 KB obfuscated payload. A hidden Python script read live GitHub Actions runner memory to steal OIDC tokens and credentials. Stolen tokens were then used to republish additional infected packages while keeping legitimate functionality intact, and persistence was maintained via hooks in VS Code and Claude Code configs with C2 managed through Ethereum blockchain transactions. _Teams hardening npm pipelines against worms like ChainDrop track emerging attack patterns on daily.dev._ ### Why is an SBOM alone not enough to protect against supply chain attacks in CI/CD? An SBOM generated at the end of a build only inventories code libraries present at that point, missing malware that executed during the build process. CI/CD pipelines also rely on tools, plugins, and helper scripts that carry their own attack surface, requiring a pipeline bill of materials (PBOM). Container environments add another gap: application SBOMs omit OS-level libraries like OpenSSL baked into container images, which can harbor critical vulnerabilities invisible to application-layer scans. _Engineers evaluating SBOM tooling and pipeline security find the tradeoffs covered on daily.dev._ ### What practical steps can I take to harden my CI/CD pipeline against supply chain attacks? Disable npm lifecycle install scripts with --ignore-scripts, enforce package cooldown periods, pin dependencies to exact commit SHAs, restrict CI/CD egress traffic, and use ephemeral CI/CD servers. Replace long-lived credentials with short-lived OIDC tokens to eliminate the persistent secrets that self-propagating worms exploit. Establish cryptographic provenance from signed commits through to signed artifacts and SBOMs in production to create an unbroken chain of trust. _Developers shipping secure pipelines stay current on supply chain hardening techniques through daily.dev._ ## Similar posts on daily.dev - [They Didn’t Hack You. They Hacked What You Trust.](https://daily.dev/posts/they-didn-t-hack-you-they-hacked-what-you-trust--3namk0f5h) · InfoSec Write-ups · 0 upvotes · 0 comments - [Massive ChainDrop npm supply-chain attack infects hundreds of packages](https://daily.dev/posts/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages-uhzbslfdu) · BleepingComputer · 3 upvotes · 1 comments - [Evolution of Web3 in Cloud Supply Chain Attacks](https://daily.dev/posts/evolution-of-web3-in-cloud-supply-chain-attacks-3unzi5cdy) · Unit 42 · 0 upvotes · 0 comments - [5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough](https://daily.dev/posts/5-supply-chain-attacks-in-48-hours-why-securing-one-layer-is-not-enough-wlypxlj48) · StepSecurity · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#npm](https://daily.dev/tags/npm), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-su-cygsdd57c) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain","url":"https://daily.dev/posts/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-su-cygsdd57c","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-su-cygsdd57c"},"datePublished":"2026-08-21T23:12:00.018Z","dateModified":"2026-09-14T08:25:32.927Z","description":"Attackers are increasingly targeting CI/CD pipelines, developer tools, and package ecosystems rather than finished application code. Unit 42 details the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0a35ea66fde8485f2a3800fa77f6baa6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0a35ea66fde8485f2a3800fa77f6baa6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-su-cygsdd57c","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cicd,npm,sbom","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-su-cygsdd57c#faq","mainEntity":[{"@type":"Question","name":"How did the ChainDrop npm worm spread and what did it steal?","acceptedAnswer":{"@type":"Answer","text":"ChainDrop infected 400+ npm packages including keyv and cacheable-request using a three-step chain. A malicious preinstall script downloaded the Bun runtime to launch a 727 KB obfuscated payload. A hidden Python script read live GitHub Actions runner memory to steal OIDC tokens and credentials. Stolen tokens were then used to republish additional infected packages while keeping legitimate functionality intact, and persistence was maintained via hooks in VS Code and Claude Code configs with C2 managed through Ethereum blockchain transactions. Teams hardening npm pipelines against worms like ChainDrop track emerging attack patterns on daily.dev."}},{"@type":"Question","name":"Why is an SBOM alone not enough to protect against supply chain attacks in CI/CD?","acceptedAnswer":{"@type":"Answer","text":"An SBOM generated at the end of a build only inventories code libraries present at that point, missing malware that executed during the build process. CI/CD pipelines also rely on tools, plugins, and helper scripts that carry their own attack surface, requiring a pipeline bill of materials (PBOM). Container environments add another gap: application SBOMs omit OS-level libraries like OpenSSL baked into container images, which can harbor critical vulnerabilities invisible to application-layer scans. Engineers evaluating SBOM tooling and pipeline security find the tradeoffs covered on daily.dev."}},{"@type":"Question","name":"What practical steps can I take to harden my CI/CD pipeline against supply chain attacks?","acceptedAnswer":{"@type":"Answer","text":"Disable npm lifecycle install scripts with --ignore-scripts, enforce package cooldown periods, pin dependencies to exact commit SHAs, restrict CI/CD egress traffic, and use ephemeral CI/CD servers. Replace long-lived credentials with short-lived OIDC tokens to eliminate the persistent secrets that self-propagating worms exploit. Establish cryptographic provenance from signed commits through to signed artifacts and SBOMs in production to create an unbroken chain of trust. Developers shipping secure pipelines stay current on supply chain hardening techniques through daily.dev."}}]} ```