AWS Security outlines best practices for defending against software supply chain attacks, using recent npm incidents (Shai-Hulud, Chalk/Debug, axios) as context. Key recommendations for package consumers include: replacing long-lived credentials with temporary ones via IAM Identity Center or OIDC federation; implementing defense in depth through artifact signing (AWS Signer with ECR managed signing), multi-party approval workflows, and centralized dependency management via AWS CodeArtifact; scanning dependencies throughout the SDLC using Amazon Inspector (including behavioral analysis for zero-day malicious packages); leveraging npm provenance attestations; and configuring comprehensive logging with CloudTrail, GuardDuty, and Security Hub to detect and respond to credential compromise. SBOMs in SPDX or CycloneDX format are recommended for rapid blast-radius assessment during incidents.
