<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-supply-chain-incident-response
description: >-
  Implement incident response procedures specific to supply chain compromises
  including dependency poisoning triage, compromised package remediation,
  blast radius assessment, and coordinated disclosure workflows.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - incident-response
  - supply-chain-ir
  - compromise-remediation
  - blast-radius
  - coordinated-disclosure
  - triage
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195"]
---

# Implementing Supply Chain Incident Response

## Overview

Supply chain incidents require specialized response procedures beyond standard
IR playbooks. When a dependency is compromised, the blast radius spans every
downstream consumer. This skill covers triage of supply chain compromises,
blast radius assessment, emergency dependency replacement, coordinated
disclosure, and post-incident hardening to prevent recurrence.

Mode: `[MODE: INCIDENT]` — Respond to supply chain compromises with specialized IR procedures.

## Prerequisites

| Requirement | Details |
|---|---|
| Package manager CLIs (npm, pip, go) | Required |
| SBOM tools (syft, cyclonedx-cli) | Required |
| Vulnerability scanners (grype, trivy) | Required |
| git for repository analysis | Required |
| Python 3.10+ with `requests`, `pyyaml` | Required |

## Key Concepts

### Compromise Triage

```bash
# Identify affected package versions
npm view compromised-pkg versions --json | jq '.'

# Check if compromised version is installed
npm ls compromised-pkg 2>/dev/null
pip show compromised-pkg 2>/dev/null

# Search for compromised package across all projects
find / -name 'package-lock.json' -exec grep -l 'compromised-pkg' {} \; 2>/dev/null
find / -name 'requirements*.txt' -exec grep -l 'compromised-pkg' {} \; 2>/dev/null

# Check when compromised version was installed
npm ls compromised-pkg --json | jq '.dependencies."compromised-pkg".version'
```

### Blast Radius Assessment

```bash
# Find all dependents of compromised package
npm view compromised-pkg dependents --json 2>/dev/null | jq '.'

# Check reverse dependencies in SBOM
jq '.dependencies[] | select(.dependsOn[]? == "compromised-pkg-ref") | .ref' sbom.cdx.json

# Scan all container images for compromised package
trivy image --severity CRITICAL app:latest -f json | jq '.Results[].Vulnerabilities[] |
  select(.PkgName == "compromised-pkg")'

# Audit git history for when dependency was added
git log --all --oneline -- '*lock*' '*requirements*' | head -20
```

### Emergency Remediation

```bash
# Pin to last-known-good version (npm)
npm install compromised-pkg@safe-version --save-exact

# Remove and replace (pip)
pip uninstall compromised-pkg -y
pip install alternative-pkg==1.0.0

# Force lockfile regeneration
rm -f package-lock.json && npm install
rm -f yarn.lock && yarn install

# Verify remediation
npm audit --json | jq '.vulnerabilities'
pip-audit --format json
```

## Workflow

### Step 1: Triage supply chain compromise incident

```bash
node scripts/agent.js --action triage --manifest /tmp/target --output /tmp/triage-result.json
```

### Step 2: Assess blast radius of compromised dependency

```bash
node scripts/agent.js --action assess --manifest /tmp/target --output /tmp/assess-result.json
```

### Step 3: Generate incident response report

```bash
node scripts/agent.js --action report --manifest /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Supply Chain Incident Response Detection
id: dd4aadde-7406-438c-b566-ae83d6917511
status: experimental
description: Detects suspicious activity related to implementing supply chain incident response techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*supply*"
  condition: selection
level: medium
tags:
  - attack.t1195
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Supply Chain Incident Response Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195 |

## Verification

- [ ] Compromised dependency identified and version range confirmed
- [ ] Blast radius assessed — all affected systems enumerated
- [ ] Emergency patch applied — safe version pinned
- [ ] Lock files regenerated with verified dependencies
- [ ] Post-incident detection rules deployed

## References

- [NIST SP 800-61 — Incident Handling](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [OpenSSF Package Analysis](https://github.com/ossf/package-analysis)
- [GitHub Security Advisories](https://github.com/advisories)
- [CISA Supply Chain Guidance](https://www.cisa.gov/supply-chain-compromise)
