A supply chain attack reaches code a team owns by traveling five trust links: the dependency resolver, the package registry, the build and CI system, the update mechanism, and the third-party vendor with standing access.
TL;DR
Coding agents now resolve and pull packages without a human reading the install output, adding a machine-speed consumer to registry and resolver weaknesses attackers already exploit. Perimeter controls miss this class because malicious code arrives through trusted channels. Named incidents and primary sources document each chain link.
A supply chain attack reached Codecov customers through a trusted CI uploader that exfiltrated credentials from every job that fetched it. Between January 31 and April 1, 2021, every CI job that fetched Codecov's Bash Uploader ran one line the maintainers never wrote: a curl command that shipped the job's environment variables, credentials included, to an attacker's server. Codecov's security update documents the command. The script came from Codecov's own distribution point and continued running until a customer compared its SHA256 against the value Codecov published on GitHub. Codecov's postmortem traced the entry point to an HMAC key that the attacker extracted from a layer of Codecov's public Docker image.
Developers and platform engineers can trace that path: how resolvers choose packages, how attackers poison registries, how build systems and update channels carry attacker code downstream, and what changes when an agent selects dependencies without supervision. Governance and defense-program design fall outside this scope.
What a Supply Chain Attack Is
A supply chain attack corrupts something the target already trusts, such as a package, build step, update, or vendor management agent, so malicious code arrives through a channel the target deliberately opened. The exploit primitive is implicit trust in an upstream party. Alex Birsan published dependency confusion research on February 9, 2021, that proved the point. He reached internal systems at more than 35 organizations, including Apple, Microsoft, PayPal, Shopify, Netflix, Tesla, Yelp, and Uber, by publishing public packages under private internal names. He collected over $130,000 in bounties without exploiting a flaw in any victim's code. The resolvers behaved exactly as configured.
Five links carry upstream code toward production, and attackers have compromised each one.
- Source repository: Maintainer and contributor trust; the XZ Utils backdoor followed a multi-year takeover of release authority (2024).
- Package registry: Name resolution and publish rights on npm and PyPI; the ua-parser-js account hijack (2021).
- Build and CI system: The steps that turn source into artifacts; SolarWinds SUNSPOT (2020) and Codecov (2021).
- Update mechanism: Trusted or signed delivery to installed clients; the signed 3CX desktop app (2023) and the M.E.Doc updater that automatically applied a malicious update (2017).
- Third-party vendor or MSP: Management platforms with standing access; Kaseya VSA (2021).
These links carry different artifacts, but each converts upstream trust into downstream execution.
Perimeter controls may treat these artifacts as trusted: the package comes from the expected registry, the binary carries a valid signature, and the vendor's agent holds credentials the customer granted.
Why the Supply Chain Attack Surface Is Widening
Coding agents now select and install packages without a human reading the resolver output, and the models behind them recommend packages that do not exist. Recent measurements of hallucinated package references show both the scale of the problem and where it stops.
- Spracklen et al., peer-reviewed at the 34th USENIX Security Symposium in August 2025 (arXiv 2406.10279), generated 2.23 million package references across 576,000 code samples. The study found that 19.7% of generated package references pointed to non-existent packages, with commercial models averaging 5.2% and open-source models averaging 21.7%.
- Churilov's May 2026 replication on five frontier models (arXiv 2605.17062) measured a spread of 4.62% to 6.10%, which the paper calls an order-of-magnitude compression of the inter-model spread Spracklen observed, though not a retirement of the threat.
- Socket's analysis of the same study, published July 22, 2026, reports 127 names hallucinated identically by all five models, with 53 still registrable.
These figures count package references, not coding tasks, so they do not show how often a task produces at least one hallucination. An attacker who registers one of those names turns model output itself into the delivery vehicle. This LLM supply chain attack requires neither user error nor a compromised account. The same autonomy re-arms dependency confusion because an agent that resolves an internal-sounding name pulls whatever the configured registry serves. In Cosmos, Augment Code's unified cloud agents platform, generally available on paid plans, an Environment defines where an agent runs and what it can access, which bounds what an unattended install can reach.
Package Registry Poisoning
Attackers poison registries through resolver precedence and deceptive or compromised package identities. A malicious release often includes a post-install script that executes at install time. npm and PyPI both carry documented incidents.
Account takeover is the workhorse. On October 22, 2021, attackers used hijacked maintainer access to publish ua-parser-js versions 0.7.29, 0.8.0, and 1.0.0 (CVE-2021-4229). CISA's same-day alert advised users to update and investigate systems that installed the compromised releases.
The Shai-Hulud campaign of September 2025 showed how far that access travels once a payload can republish itself. CISA confirmed the campaign, describing a self-replicating worm that compromised more than 500 packages after entering through compromised maintainer accounts.
Typosquatting is older and cruder. In September 2017 the PSRT announcement reported the removal of 11 typosquatted PyPI packages, including urllib and setup-tools, that sent user data to a remote host. The team pulled them within 70 minutes of the report.
Post-install scripts execute these payloads during installation. An autonomous agent performing the install can run the script without a person watching the output, so the agent's execution boundary determines what the malicious process can reach. A Cosmos Environment is where that boundary is set.
How Dependency Confusion Exploits Resolver Precedence
Dependency confusion needs no compromised account or typo. The attacker publishes a public package matching a private internal name at an absurdly high version, and the resolver selects it. Birsan's advisory identified pip's --extra-index-url behavior as the core weakness. When a private index and PyPI both hold a name, pip defaults to installing from whichever source carries the higher version number, so version 9000.0.0 on PyPI beats every internal release.
pip's current documentation (v26.2.1) labels the flag unsafe when teams use it to search for private package names and names dependency confusion explicitly. Namespace resolution creates a version race that delivers the payload without exploiting target code.
npm resolves the equivalent risk deterministically by mapping each scope to exactly one registry. Its official guidance strongly encourages scoped packages so a private name cannot be substituted from the public registry.
Build Pipeline and CI/CD Infiltration
A poisoned build step can reach downstream consumers even when the source repository remains clean. SolarWinds stated that the SUNBURST backdoor was not present in the source code repository, existing only in Orion updates released between March and June 2020 after attackers compromised the build system. The company separately disclosed a test injection run as early as October 2019.
CrowdStrike's SUNSPOT analysis from January 11, 2021, shows the mechanism. SUNSPOT watched for MsBuild.exe and swapped InventoryManager.cs for a backdoored copy only while Orion was compiling. It wrapped the edits in #pragma warning disable to silence compiler warnings, then restored the original file after the build. SolarWinds told the SEC that fewer than 18,000 installations contained the result.
Attackers also used the build step to inject code into upstream open source in 2024. An attacker placed malicious code in the xz 5.6.0 and 5.6.1 release tarballs, as CVE-2024-3094 (CVSS 10.0) describes. During the build, an obfuscated process extracts a prebuilt object file from a disguised test file and links it into liblzma. Red Hat noted that the Git distribution lacked the triggering M4 macro, so the injection lived only in the tarballs.
After a compromise, the pipeline becomes a credential aggregation point. The NVD record for CVE-2025-30066 documents how attackers modified the tags v1 through v45.0.7 of tj-actions/changed-files on March 14 and 15, 2025, repointing them at a commit carrying malicious code. The modified action printed CI secrets, access keys, GitHub personal access tokens, npm tokens, and private RSA keys into public build logs. CISA added CVE-2025-30066 to the Known Exploited Vulnerabilities catalog on March 18, 2025.
Each compromise altered a different part of the build path while leaving the source repository untouched.
- SolarWinds used SUNSPOT to replace a source file only during compilation.
- XZ placed its injection in release tarballs rather than the Git distribution.
- tj-actions repointed published version tags to expose credentials in build logs.
- The attacker behind Codecov modified a distributed CI uploader to exfiltrate environment variables.
Downstream of the Codecov compromise, a HashiCorp disclosure reported that the company rotated the GPG private key used to sign its release SHA256SUM files, having found no evidence that attackers used the exposed key.
Update Mechanism and Code-Signing Abuse
A valid signature proves who signed an artifact. It provides no evidence about the integrity of the build that produced the artifact or the sources that fed it. That gap allows signed updates to carry malware past client-side integrity checks.
The 3CX compromise of March 2023 is the fullest documented case. CrowdStrike detected malicious activity from a legitimate, signed binary on March 29, 2023. The signed 3CX desktop app installer dropped a compromised ffmpeg.dll, and the 3CX security alert named Windows Electron App versions 18.12.407 and 18.12.416.
A Mandiant investigation for 3CX traced entry to an earlier signed compromise. An employee installed a trojanized X_TRADER installer, carrying a valid code-signing certificate issued to Trading Technologies International, on a personal computer in 2022. Attackers reached 3CX's corporate network over VPN two days later, and trojanized 3CX builds shipped in late March 2023. Each stage had its own documented compromise window.
SUNBURST rode the same trust. CISA's advisory AA20-352A records that the legitimate SolarWinds code-signing certificate signed the malicious DLL. SolarWinds revoked that certificate on March 8, 2021.
CISA determined that updates to the Ukrainian tax software M.E.Doc delivered the June 27, 2017 NotPetya outbreak. Attackers had established a backdoor in the vendor's development environment as far back as April 14, 2017. ESET found that the M.E.Doc updater applied the malicious update automatically without user interaction. The trusted updater itself carried the malicious code, so delivery relied on the software's own update channel rather than a signature check.
Third-Party Vendors and MSPs as Force Multipliers
An MSP's management platform holds standing, credentialed access to every customer it manages, so one compromise can propagate without separately exploiting each downstream tenant. On July 2, 2021, attackers exploited CVE-2021-30116, a credential-disclosure flaw in Kaseya VSA that DIVD had privately reported to Kaseya on April 6, 2021. The attackers used that access to run arbitrary commands that pushed REvil ransomware to managed endpoints. Kaseya estimated that the attack directly breached about 50 customers among more than 35,000 and affected 800 to 1,500 downstream businesses.
The pattern predates ransomware. The December 2018 DOJ indictment of APT10 operators charges that the group compromised an MSP and used its access to reach client data in at least 12 countries during a campaign running since at least 2014. CISA, NSA, and partner agencies formalized the model in advisory AA22-131A on May 11, 2022, describing a vulnerable MSP as an initial access vector with globally cascading effects.
Five incidents map cleanly onto the links they exploited.
| Incident | Year | Chain Link Exploited | Source |
|---|---|---|---|
| SolarWinds Orion (SUNBURST) | 2020 | Build system | CISA advisory AA20-352A |
| Codecov Bash Uploader | 2021 | CI script distribution | Codecov postmortem |
| Kaseya VSA (REvil) | 2021 | MSP management platform | Kaseya incident overview |
| 3CX desktop app | 2023 | Signed update delivery | 3CX security alert; Mandiant |
| XZ Utils backdoor | 2024 | Maintainer release authority | NVD CVE-2024-3094 |
Customers cannot eliminate vendor trust, but they can patch vendor agents, restrict their access, and monitor what those agents do.
The Link Artifact-Level Review Misses
Reviewers can approve a compromised dependency or build step when the diff looks clean. SUNBURST is the extreme case: attackers injected it during compilation, so it appeared in no repository diff and left its signal only in build provenance.
The 2018 event-stream incident sat at the other end. The maintainer granted a contributor publish rights, after which the contributor added flatmap-stream as a dependency. npm's event-stream postmortem reports that the malicious logic arrived later in flatmap-stream@0.1.1. The reviewable change was one dependency line a human reviewer could pass over, because the signal lived in publisher and build provenance and in install-script behavior measured against the repository's own rules.
Repository context changes what review can catch. Deep Code Review, a reference Expert in Cosmos, checks a pull request or merge request without a chat loop: it reads the diff, checks changed files against repository guidance, and posts inline findings for objective issues. It can run from a Cosmos Session with the change URL pasted in, or from a trigger that fires when a change opens or becomes ready for review.
Repository guidance is what moves a diff read past face value. A new preinstall script may look unremarkable in isolation but becomes a finding where repository guidance forbids install-time execution. Within Cosmos, Experts define agent behavior, Environments define where agents run and what they can access, and Sessions preserve auditable work. Those Cosmos controls bound agent activity, but they do not turn artifact review into build-provenance verification.
One attribution rule applies when reading recent postmortems. Snyk's analysis of the August 2025 Nx s1ngularity payload found that attackers used locally installed AI coding agents (claude, gemini, q) to inventory files and exfiltrate secrets. Those postmortems describe the tools as instruments an attacker abused on victim machines, not as authors of the compromised package.
How to Name the Weakest Link
Teams can audit each link by checking whether an artifact documents it. Missing artifact documentation makes that link the weakest.
- Resolver precedence config: The relevant artifact is the service's dependency configuration. It should name a single index or map every internal scope to one registry. A pip configuration that uses
--extra-index-urlfor private package names creates the version race that pip's documentation calls unsafe. - Registry lock files: The artifact is a committed lock file with integrity hashes plus the CI flag that enforces it. For Python, pip's
--require-hashesmode supplies that enforcement. - CI step permissions: The artifact is a workflow file with third-party actions pinned to commit SHAs and tokens scoped per step. The tj-actions compromise repointed published version tags, so a tag pin provided no protection.
- Signing key custody: The artifact is a written inventory of signing certificates recording each private key's location, its authorized custodians, and the revocation procedure. A team that cannot identify who can revoke a certificate has undocumented custody.
- MSP trust scope: The artifact is an access inventory listing what every vendor management agent can reach, plus logs that prove its activity. CISA's AA22-131A advisory recommends retaining logs for at least six months.
- Agent-resolved dependencies: The artifact is the configuration that bounds an agent's access and the record of its actions. In Cosmos, an Environment supplies the boundary and a Session preserves the auditable record of the work.
The artifact the team cannot produce names the priority.
What to Do Next
The tradeoff runs through every incident above: artifact-level review is fast and fits naturally at the merge gate, but it cannot verify provenance. Run the six-artifact audit against one production service this week, route agent-authored dependency changes through a Cosmos review pass, and treat the link with no producible artifact as the first remediation priority.
Frequently Asked Questions
Related Reading
Written by
Molisha Shah
Molisha is an early GTM and Customer Champion at Augment Code, where she focuses on helping developers understand and adopt modern AI coding practices. She writes about clean code principles, agentic development environments, and how teams are restructuring their workflows around AI agents. She holds a degree in Business and Cognitive Science from UC Berkeley.