<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-supply-chain-incident-response
description: >-
  Performs incident response for software supply chain compromises including
  dependency poisoning, CI/CD pipeline attacks, compromised build artifacts,
  and malicious package detection across npm, PyPI, and container registries.
domain: cybersecurity
subdomain: incident-response
tags:
  - supply-chain
  - dependency-security
  - CI-CD-security
  - package-analysis
  - SBOM
  - build-integrity
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195"]
---

# Performing Supply Chain Incident Response

## Overview

Supply chain incidents compromise trusted software components — dependencies,
build systems, CI/CD pipelines, or distribution channels. These attacks are
particularly dangerous because they bypass traditional perimeter defenses by
arriving through trusted update channels. Examples include SolarWinds (build
system compromise), Codecov (CI tool compromise), and numerous npm/PyPI package
poisoning incidents.

This skill covers detection of compromised dependencies, CI/CD pipeline
investigation, SBOM analysis for affected components, and containment of
supply chain compromises across the software development lifecycle.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Syft | SBOM generation | `curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \| sh` |
| Grype | Vulnerability scanning | `curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh \| sh` |
| npm audit | Node.js dependency check | Pre-installed with npm |
| pip-audit | Python dependency check | `pip install pip-audit` |
| cosign | Artifact signature verification | `go install github.com/sigstore/cosign/v2/cmd/cosign@latest` |
| SLSA verifier | Build provenance verification | GitHub release |

## Key Concepts

### Supply Chain Attack Vectors

| Vector | Example | Detection |
|--------|---------|-----------|
| Dependency confusion | Private package name published to public registry | Monitor for unexpected public package resolution |
| Typosquatting | `requests` vs `requets` | Dependency name similarity analysis |
| Compromised maintainer | Legitimate package with malicious update | Version diff analysis, behavioral change detection |
| Build system compromise | Malicious code injected during CI/CD build | Build reproducibility, provenance verification |
| Registry compromise | Tampered artifacts in package registry | Hash/signature verification against known-good |

### SLSA Supply Chain Levels

```
SLSA 0: No guarantees
SLSA 1: Documentation of build process
SLSA 2: Tamper resistance of build service
SLSA 3: Extra resistance to specific threats
SLSA 4: Highest assurance — hermetic, reproducible builds
```

## Workflow

### Step 1 — Identify Affected Components

```bash
# Generate SBOM from production image
syft packages registry.company.com/app:latest -o syclonedx-json > sbom.json

# Check if compromised package is in SBOM
cat sbom.json | jq '.components[] | select(.name == "compromised-pkg")'

# npm — check for compromised dependency
npm ls compromised-pkg 2>/dev/null
npm audit --json > /evidence/npm_audit.json

# Python — check for compromised dependency
pip-audit --format json --output /evidence/pip_audit.json
pip show compromised-pkg
```

### Step 2 — Analyze Compromised Package

```bash
# Download and inspect specific version
npm pack compromised-pkg@1.2.3
tar xzf compromised-pkg-1.2.3.tgz
# Review install scripts for malicious code
cat package/package.json | jq '.scripts'

# Diff suspicious version against known-good
diff -r package-good/ package-bad/ > /evidence/package_diff.txt

# Python — inspect package contents
pip download compromised-pkg==1.2.3 --no-deps -d /evidence/
unzip /evidence/compromised_pkg-1.2.3-py3-none-any.whl -d /evidence/pkg_contents/

# Check package publication timeline
npm view compromised-pkg time --json
```

### Step 3 — Investigate CI/CD Pipeline

```bash
# GitHub Actions — audit recent workflow runs
gh run list --repo company/app --limit 50 --json conclusion,headBranch,updatedAt,name

# Check for modified workflow files
git log --oneline --diff-filter=M -- .github/workflows/ | head -20

# Verify build artifact signatures
cosign verify --key cosign.pub registry.company.com/app:latest

# Check SLSA provenance
slsa-verifier verify-image registry.company.com/app:latest \
  --source-uri github.com/company/app \
  --source-tag v1.2.3

# Audit CI/CD secrets access
gh api repos/company/app/actions/secrets --jq '.secrets[].name'
```

### Step 4 — Determine Blast Radius

```bash
# Find all repositories using the compromised package
# (requires dependency graph or SBOM inventory)
grype sbom:sbom.json --only-fixed --output json > /evidence/vulnerabilities.json

# Search across organization for package usage
find /repos/ -name "package.json" -exec grep -l "compromised-pkg" {} \;
find /repos/ -name "requirements.txt" -exec grep -l "compromised-pkg" {} \;

# Check container images for compromised layer
for image in $(cat /evidence/image_inventory.txt); do
  syft packages "$image" -o json | jq --arg pkg "compromised-pkg" \
    '.artifacts[] | select(.name == $pkg) | {name, version}' 2>/dev/null
done
```

### Step 5 — Contain and Remediate

```bash
# Pin to known-good version
npm install compromised-pkg@1.2.2 --save-exact
pip install compromised-pkg==1.2.2

# Block compromised version in registry proxy
# (Artifactory, Nexus, or npm Enterprise)
curl -X DELETE "https://artifactory.company.com/api/npm/npm-remote/compromised-pkg/-/compromised-pkg-1.2.3.tgz" \
  -H "Authorization: Bearer $ARTIFACTORY_TOKEN"

# Rebuild all affected artifacts from clean dependencies
# Invalidate all build caches
rm -rf node_modules/ .npm/ __pycache__/ .pip-cache/
npm ci --ignore-scripts  # Reinstall without running scripts
npm run build

# Rotate any secrets that may have been exposed
# CI/CD secrets, API keys, deployment credentials
```

## Detection

```yaml
title: Supply Chain Incident Response Detection
id: ad91c833-26d3-400f-b0fc-c6d9a283777c
status: experimental
description: Detects suspicious activity related to performing supply chain incident response techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*supply*"
  condition: selection
level: high
tags:
  - attack.t1195
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] SBOM generated for all affected systems and images
- [ ] Compromised package version identified with publication timeline
- [ ] Package contents analyzed and malicious code documented
- [ ] CI/CD pipeline audit completed (workflow changes, secret access)
- [ ] Blast radius determined (all repos/images using compromised version)
- [ ] Compromised versions blocked in registry proxy
- [ ] All affected builds rebuilt from clean dependencies
- [ ] Build signatures and provenance verified
- [ ] Exposed credentials rotated

## References

- SLSA Framework: https://slsa.dev
- OpenSSF Scorecard: https://securityscorecards.dev
- MITRE ATT&CK T1195 (Supply Chain Compromise)
- NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management
- Sigstore / cosign: https://docs.sigstore.dev
- CISA Supply Chain Security Guidance
