--- title: "Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain" url: https://daily.dev/posts/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-su-cygsdd57c source_url: https://unit42.paloaltonetworks.com/sdlc-supply-chain type: article source: "Unit 42" published: 2026-08-21T23:12:00.018Z updated: 2026-08-21T23:13:19.565Z tags: ["security", "cicd", "npm", "sbom"] reading_time: 6 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain **[Unit 42](https://daily.dev/sources/unit42)** · 6 min read · 1 upvotes · 0 comments ## Summary Attackers are increasingly targeting CI/CD pipelines, developer tools, and package ecosystems rather than finished application code. Unit 42 details the ChainDrop npm worm, which infected 400+ packages including keyv and cacheable-request, stealing OIDC tokens from GitHub Actions runner memory, backdooring VS Code and Claude Code configs, and self-propagating via stolen tokens — all managed through Ethereum-based C2. The post maps the full SDLC attack surface across developer endpoints, build pipelines, and cloud runtimes, arguing that static SBOMs are insufficient. Recommended defenses include disabling npm lifecycle scripts, pinning dependencies to commit SHAs, restricting CI/CD egress, using ephemeral build servers, transitioning to short-lived OIDC credentials, and generating pipeline bills of materials (PBOMs) alongside container SBOMs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the ChainDrop npm worm steal credentials from GitHub Actions? ChainDrop used a malicious preinstall script to download the Bun runtime and launch an obfuscated payload that read live process memory from GitHub Actions runners, extracting temporary OIDC tokens and secrets. It then used those stolen npm and GitHub tokens to silently republish infected versions of additional packages while keeping their legitimate functionality intact so developers wouldn't notice. _Developers hardening CI/CD pipelines track emerging npm supply chain threats on daily.dev._ ### What is a pipeline bill of materials (PBOM) and why is it needed? A pipeline bill of materials (PBOM) is an inventory of every tool, plugin, and helper script running inside a build system. A standard application SBOM only lists code libraries added to the software, missing the build tooling itself — which attackers target because pipelines hold temporary passwords and cloud access keys. The Trivy supply chain attack illustrates how pipeline security tools themselves can become the attack vector. _Teams evaluating CI/CD security posture find coverage of incidents like these on daily.dev._ ### Why are npm preinstall scripts dangerous and how can I disable them? npm preinstall scripts run automatically during npm install with the same OS permissions as the user, with no sandboxing. This gives any malicious package immediate access to files, credentials, and the ability to execute arbitrary commands. The ChainDrop worm exploited this to steal secrets and backdoor developer tools. Passing --ignore-scripts to npm disables lifecycle scripts and is a recommended mitigation alongside pinning dependencies to exact commit SHAs. _Developers securing their npm workflows stay current on supply chain attack patterns through daily.dev._ ## Similar posts on daily.dev - [They Didn’t Hack You. They Hacked What You Trust.](https://daily.dev/posts/they-didn-t-hack-you-they-hacked-what-you-trust--3namk0f5h) · InfoSec Write-ups · 0 upvotes · 0 comments - [Massive ChainDrop npm supply-chain attack infects hundreds of packages](https://daily.dev/posts/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages-uhzbslfdu) · BleepingComputer · 3 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#npm](https://daily.dev/tags/npm), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-su-cygsdd57c)