A Retrospective Survey of 2024/2025 Open Source Supply Chain Compromises
12 hours ago
- #Phishing Mitigation
- #Open Source Maintenance
- #Supply Chain Security
- Memory safety is a predominant cause of security issues, necessitating the use of memory-safe languages.
- Software supply chain compromises have predominant causes that open source maintainers must mitigate.
- Phishing is the most common initial compromise vector, effective even against 2FA TOTP.
- Control handoff to attackers is a significant issue, often due to open source maintenance sustainability challenges.
- GitHub Actions triggers like pull_request_target and issue_comment are common vectors for compromises.
- Long-lived credential exfiltration is a major risk, with mitigations including short-lived tokens and OIDC.
- Domain and username resurrection can lead to package takeovers, requiring careful management of critical domains.
- Read/write CI permissions can be exploited, with GitHub Actions cache poisoning being a notable risk.
- Post-install scripts in npm can propagate compromises, suggesting the use of ignore-scripts for defense.
- Non-reproducible release artifacts and mutable GitHub Actions tags are additional security concerns.