Glassworm & CrowdStrike Trivy/LiteLLM Supply Chain Compromises
Key Questions
What supply chain attacks are currently ongoing in this highlight?
Ongoing attacks include Glassworm, Miasma, easy-day-js, Leo Platform, and Injective Labs, which employ new hiding techniques such as binding.gyp, backdated commits, and key-derivation-telemetry.ts.
What mitigation strategies are recommended for these supply chain compromises?
Mitigations emphasize SBOM trust, CI gating, and provenance verification. New tools include Synapse CLI for chain-of-custody gating, SBOM-Tools for SHA-pinning, MemSBOM for runtime SBOM, and SBOM Security from PhalanxCyber using purl-as-spine architecture.
What is the ongoing debate about SBOM trust models?
The debate centers on build-time versus post-build SBOM trust. This is addressed in tools like SBOM Security and articles discussing credential abuse where secrets persist after package removal.
How do credential-centric attacks factor into recent breaches?
Attacks such as Shai-Hulud, Hades, and Injective Labs demonstrate that stale credentials often outlive package removal. This reinforces the need for improved access lifecycle governance, as detailed in the stale credentials article.
What additional resources are provided for vulnerability scanning and protection?
Related reads cover an app vulnerability scanning guide using SAST/DAST/SCA layering, open source template protection with AES-256-GCM and Ed25519 signing, and Cloud Workload Vulnerability Scanning for Containers via OCSA with digest evidence chains.
Ongoing supply chain attacks (Glassworm, Miasma, easy-day-js, Leo Platform, Injective Labs) with new hiding techniques (binding.gyp, backdated commits, key-derivation-telemetry.ts). Mitigations focus on SBOM trust, CI gating, and provenance verification. New tools: Synapse CLI (chain-of-custody CI gating), SBOM-Tools (SHA-pinning), MemSBOM (runtime SBOM), and SBOM Security (PhalanxCyber) with purl-as-spine architecture. Build-time vs post-build SBOM trust debate continues. Credential-centric attacks (Shai-Hulud, Hades, Injective Labs) highlight secrets outliving package removal. Stale credentials article reinforces access lifecycle governance gaps. New reads include app vulnerability scanning guide (SAST/DAST/SCA layering), open source template protection pattern (AES-256-GCM, Ed25519 signing, entitlement-based key release), Cloud Workload Vulnerability Scanning for Containers (OCSA) with digest evidence chain and six coverage planes, and a synthesis article on how attackers turned the supply chain against itself (Nx Console trojan, credential/identity abuse). Latest additions: Critical Gitea CVE-2026-58426 (HMAC signature ambiguity in Actions Artifacts V4) – reinforces artifact integrity; AWS SBOM Generator plugin system in Lua – extends SBOM coverage; Syft/Grype SBOM generation guide – practical CI/CD integration.