Aikido guide on supply chain defenses drawing on axios, tj-actions, CanisterWorm, GlassWorm and postmark-mcp compromises

Linha do tempo

1. aikido.dev ↗ · pub. 21/10/2026 10:25 · coletado 21/10 22:00 primeiro registro

   Aikido guide on supply chain defenses drawing on axios, tj-actions, CanisterWorm, GlassWorm and postmark-mcp compromises

   ler a análise desta fonte ocultar

   Aikido Security published a best-practices guide for defending against software supply chain attacks. It cites Aikido Intel data: about 7.5 million package versions analyzed in Q2 2026, with 19,500 malicious packages confirmed. The guide uses recent incidents to show which controls would have worked: the axios compromise, tj-actions/changed-files, CanisterWorm, a fake WakaTime extension on OpenVSX, GlassWorm, the postmark-mcp package, the TanStack/CrowdSec token theft and PromptPwnd. It is a vendor guide with some product promotion, not a new incident disclosure.

   Technical Details

   • axios: a decoy [email protected] was published on March 30, then replaced by the malicious [email protected]. [email protected] and [email protected] followed on March 31, and npm removed both about three hours later. The attacker published with a long-lived npm token stolen from the maintainer's compromised machine, and the registry record showed an email change followed by two publishes 39 minutes apart.
   • CanisterWorm republished incremented patch versions of every package its victims maintained, reaching more than 60 packages in 24 hours. At least one went undetected for about 53 hours.
   • tj-actions/changed-files (March 2025): version tags were repointed to a malicious commit that dumped CI secrets into workflow logs. Roughly 23,000 repositories referenced it, and repositories pinned to commit SHAs were unaffected.
   • CrowdSec: a departed developer's laptop was compromised in the TanStack attack, and the stolen token was used to clone 170 private repositories in about nine minutes. The company learned of it four months later when the code appeared on a forum.
   • A fake WakaTime extension on OpenVSX (April 2026) loaded a native binary, fetched a second payload from GitHub Releases and force-installed it into VS Code, Cursor, Windsurf and VSCodium. GlassWorm has compromised legitimate extensions.
   • postmark-mcp (September 2025) impersonated the official ActiveCampaign Postmark MCP server. Version 1.0.16 added a line that BCC'd every sent email to an attacker-controlled address.
   • PromptPwnd: a malicious issue title fed into a Gemini CLI workflow made the agent write repository secrets into a public issue. Aikido says at least five Fortune 500 companies were affected.
   • Slopsquatting: attackers pre-register package names that coding agents hallucinate.

   Remediation

   • Enforce a 48-hour minimum package age, using npm min-release-age (since 11.10.0) or the Yarn and Bun equivalents. pnpm v11 has a 24-hour default cooldown, and npm v12 (released July 8, 2026) disables dependency install scripts by default but has no default cooldown.
   • Use --ignore-scripts with an allowlist, and enforce lockfiles with npm ci, --frozen-lockfile, --immutable, --locked or --require-hashes.
   • Pin CI dependencies to commit SHAs and container base images to digests, and automate updates with Renovate or Dependabot.
   • Use fine-grained, per-pipeline tokens with rotation and prompt revocation. Move maintainer accounts to FIDO2 or passkeys instead of TOTP.
   • Run install-time endpoint inspection on developer machines and centrally enforce IDE and browser extension allowlists.
   • Scope agent permissions and sandbox agents with egress controls. Treat MCP servers as dependencies, pinned by integrity hash or full commit SHA. Treat untrusted input reaching agent prompts as code execution.
   • Detect malicious packages at install time and in pull requests. Stream audit logs to a SIEM, generate signed SBOMs per build, and rehearse credential rotation, including GitHub Enterprise bulk revocation.