- 012024 reshaped the threat model in three ways: XZ Utils proved multi-year patient maintainer takeover, Polyfill.io proved CDN-level injection at internet scale, and GitHub Actions tag mutation proved the action ecosystem still has soft spots.
- 02Defenses worth implementing this quarter: SBOM generation + ingestion for every shipped artifact, commit-hash pinning for every action and dependency in CI, self-hosting or proxying critical CDN dependencies, SLSA Build L3+ for production artifacts, Sigstore signing with fail-closed verification.
- 03There is no perfect defense against patient adversary maintainer takeover. Mitigations: track maintainer changes on critical deps, require multi-maintainer signing, pin and review every dependency upgrade.
- 04Run a quarterly tabletop on a hypothetical supply-chain compromise of a critical dependency. The first 'how do we know if we are affected' exercise surfaces the gaps fast — and worth finding before reality forces the question.
The 2024 supply-chain incidents pushed the threat model further into production reality. The XZ Utils backdoor demonstrated multi-year maintainer takeover. The Polyfill.io compromise demonstrated CDN-level injection at internet scale. GitHub Actions tag mutation incidents showed the action ecosystem still has soft spots.
The defenses worth implementing this quarter
- 01SBOM generation and ingestion for every artifact you ship
- 02Pinning to commit hashes for every action and dependency in CI
- 03Self-host or proxy critical CDN dependencies (do not load directly from third-party CDNs in production paths)
- 04SLSA Build Level 3+ for any artifact running in production
- 05Sigstore signing and verification — fail closed on missing signatures
Maintainer-takeover specifically
There is no perfect defense against a patient adversary becoming a trusted maintainer. The mitigations: track maintainer changes on critical dependencies, require multi-maintainer signing for releases on packages you depend on, pin and review every dependency upgrade.
What to do operationally
Run a quarterly tabletop exercise on a hypothetical supply-chain compromise of a critical dependency. The first time the team exercises 'how do we know if we're affected,' the gaps are immediate and embarrassing — and worth finding before reality forces the question.