Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

Summary: Unit 42 reports that supply chain attacks have shifted in scale and velocity over the last 12-18 months, with attackers targeting developer tools and build processes rather than finished software - citing the XZ Utils backdoor (CVE-2024-3094), the Axios account hijack, the Shai-Hulud npm worm, and the ChainDrop npm worm, which infected over 400 packages including keyv and cacheable-request. The article states open-source code makes up 80-90% of modern codebases, that setup scripts and IDE extensions run with the developer's own permissions without sandboxing, and that the early 2026 OpenSSL zero-days sat in container OS layers that application-layer scans would not detect.

What's compelling: ChainDrop hid its command-and-control in Ethereum blockchain transactions and persisted through hooks in tools like VS Code and Claude Code, so blocking a known domain or scanning application code would not have caught it. With 80-90% of codebases coming from third parties and build pipelines holding temporary passwords and cloud keys, the exposure sits in the tooling and credentials your code scanners were never built to inspect.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Mentions
CVE-2024-3094
Related