PlaybookCONSTRUCTEDMembers
Software supply chain compromise response plan: a dependency, a build step or a vendor update turned against you
Three shapes of the same incident: a malicious package, a compromised CI action, and a trojanised vendor update. They differ in what the attacker could reach, so they differ in what you rotate and where you hunt. A plan for scoping exposure from the version window, rotating the right secrets, and rebuilding from something you can trust.
version 1.0checked 2026-09-26linux · windows · macos · cloud5 min read
T1195.001T1195.002T1552.001T1528T1059.007CVE-2024-3094CVE-2025-30066
what it covers
- Three shapes, three blast radii
- Phase 1: establish exposure from the version window
- Phase 2: contain
- Phase 3: look for use
- Phase 4: rebuild from something you can trust
- Phase 5: tell the people downstream
- Harden
- Review
sources
- CISA and NIST: Defending Against Software Supply Chain Attacks
- CISA: Widespread supply chain compromise impacting npm ecosystem (September 2025)
- CISA: Reported supply chain compromise affecting XZ Utils data compression library, CVE-2024-3094
- CISA Emergency Directive 21-01: Mitigate SolarWinds Orion code compromise
- GitHub Docs: Security hardening for GitHub Actions
- SLSA: Supply-chain Levels for Software Artifacts