stepsecurity.io resources

stepsecurity.io

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-26.

Date Added	Resource	Excerpt
2026-08-26 2026	How Utility Warehouse Secured Its Software Supply Chain Across CI/CD NPM and Developer Machines with StepSecurity Supply Chain	Library for securing software supply chains, StepSecurity, enabled Utility Warehouse to gain visibility into CI/CD pipeline behavior, NPM dependency risk, and developer toolchains like Claude Code and GitHub Copilot. It proactively blocked a compromised NPM package introduced via refactoring and detected anomalous outbound network activity during CI/CD runs, preventing potential breaches. The solution integrates seamlessly without disrupting developer workflows, offering peace of mind against escalating software supply chain threats.
2026-08-23 2026	The State of Open Source Supply Chain Attacks Supply Chain	Analysis of 56 real-world software supply chain attacks from August 2025 to August 2026 reveals a significant increase in frequency and blast radius. These malicious compromises, targeting trusted packages and CI/CD pipelines across npm, PyPI, RubyGems, Composer, and crates.io, include widespread worms like Shai-Hulud and Miasma, and targeted campaigns like Team PCP that stole cloud and signing keys. Vulnerability disclosures and new malicious packages are excluded, focusing instead on attacks that leverage existing trust to compromise popular AI infrastructure packages, GitHub Actions, and widely downloaded components.
2026-08-15 2026	Team PCP Stole 78330 Secrets From 2186 Organizations. CloudSEK Just Published the List.Supply Chain	Library for detecting and preventing supply chain attacks like the Team PCP campaign, which exfiltrated 78,330 secrets from 2,186 organizations by compromising CI/CD pipelines. It offers layered security controls, including network egress control and runner lockdown, to stop credential theft from platforms like GitHub Actions, GitLab, and Azure DevOps, even when malicious code executes. The library addresses the shift-left of attacks into development pipelines, which hold more privileged credentials than production environments, and is validated by its effectiveness against compromised components in incidents like the LiteLLM and Trivy Action attacks.
2026-07-17 2026	Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys Supply Chain	Library for detecting an Injective npm supply chain attack where 18 packages, including `@injectivelabs/sdk-ts`, were backdoored. The malicious code, disguised as analytics, exfiltrated crypto wallet recovery phrases and private keys by sending them to an attacker-controlled server via a base64-encoded string in the `X-Request-Id` header during key derivation, specifically `PrivateKey.fromMnemonic()` and `PrivateKey.fromHex()`.
2026-07-14 2026	Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories Supply Chain	Library for detecting and blocking coordinated AsyncAPI supply chain attacks. This resource details the Miasma RAT delivery via compromised CI/CD pipelines in two AsyncAPI repositories, impacting packages like `@asyncapi/generator` and `@asyncapi/specs`. It highlights how attackers exploited legitimate GitHub Actions release workflows and OIDC provenance to publish malicious npm packages, and how Harden-Runner blocked exfiltration by identifying C2 endpoints through network telemetry.
2026-06-02 2026	Multiple redhat-cloud-services npm Packages compromised Supply Chain	Library analyzing multiple @redhat-cloud-services npm packages compromised with malware, executing on install before application code. The payload uses ROT-21, AES-128-GCM, obfuscator.io, and a B5 cipher to evade detection and harvest secrets from GitHub Actions, AWS, GCP, Azure, Kubernetes, Vault, npm, and CircleCI. It also acts as a self-propagating worm, using stolen npm tokens and `bypass_2fa` to republish backdoored packages. Analysis involved static and dynamic techniques, including StepSecurity Harden-Runner.
2026-05-23 2026	Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets Supply Chain	Writeup of the laravel-lang supply chain attack where a single actor rewrote all git tags across four popular Composer packages, including `laravel-lang/lang` and `laravel-lang/http-statuses`, to point to malicious commits. These commits added `src/helpers.php` to the `autoload.files` map, executing a payload upon application startup. The payload contacted `flipboxstudio.info`, dropped a PHP loader and ELF binary in `/tmp`, exfiltrated runner environment data, and then self-deleted. This technique bypassed standard version pinning, making pre-May 22, 2026 commit SHAs the only safe option.
2026-05-21 2026	5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough Supply Chain	Library for securing the software supply chain, this resource details five distinct attacks in 48 hours targeting VS Code extensions, GitHub Actions, npm packages, and PyPI. It highlights how traditional tools like SCA and SAST fall short, failing to monitor CI/CD runtime or developer machines. The library offers runtime security for CI/CD, visibility into developer workstations, and ecosystem-wide threat intelligence to address these multi-layered threats.
2026-05-14 2026	Active Supply Chain Attack: Malicious node-ipc Versions Published to npm Supply Chain	Tool detailing the node-ipc supply chain attack where malicious versions 9.1.6, 9.2.3, and 12.0.1 were published to npm. The attack, executed by a rogue maintainer, injected an obfuscated payload into the CommonJS bundle designed to steal over 90 categories of credentials and exfiltrate them to an attacker-controlled server. Version 12.0.1 includes a specific targeting gate based on the module's file path hash.
2026-04-22 2026	litellm: Credential Stealer Hidden in PyPI Wheel Supply Chain	Library detailing a supply chain compromise within the litellm Python package. Versions 1.82.7 and 1.82.8 were found to contain a malicious payload that harvests credentials, encrypts them using AES-256 and RSA-4096, and exfiltrates them to an attacker-controlled domain. The compromise leveraged two distinct injection techniques: a `.pth` file in version 1.82.8, and an embedded base64 blob in `proxy_server.py` for version 1.82.7. This attack potentially gained initial access through a pivot from a compromise of the Trivy tool used in litellm's CI/CD pipeline.
2026-04-11 2026	Shai-Hulud: Self-Replicating Worm Compromises 500+ NPM Packages Supply Chain	Library for detecting and analyzing the Shai-Hulud worm, which compromised over 500 NPM packages including @ctrl/tinycolor. This attack featured self-propagation via `NpmModule.updatePackage`, credential harvesting using TruffleHog and cloud SDKs for AWS, GCP, and Azure, and persistence mechanisms involving GitHub Actions workflows. The malware specifically targeted Linux and macOS environments, exfiltrating secrets like GitHub tokens and AWS access keys.
2026-04-07 2026	Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack Supply Chain	Analysis of the largest npm supply chain attack detailing StepSecurity's real-time detection of a compromised axios package. The incident involved a state-sponsored actor hijacking the popular HTTP client, inserting a malicious dependency, and actively deleting GitHub issues to conceal the compromise. StepSecurity utilized its AI Package Analyst and Harden-Runner to identify suspicious indicators and anomalous network activity, enabling rapid notification and remediation efforts for customers.