.png)
The Practical Checklist for Defending Against Supply Chain Attacks
A practical checklist for engineering teams facing the current generation of supply chain attacks. The recommendations follow the path a compromised package takes into production, from the registry through your pipeline to the machines your team works on. Covers the specific habits that prevent a compromised package from becoming an incident.
Nicholas Thomson is a Content Marketing Writer at Aikido Security. Prior to this, he worked as a technical writer at Datadog and Edge Delta. Before entering tech, he worked as an editor at Penguin Random House.
Key Findings
Enforce a package age policy before anything installs
Package installs run publisher-controlled scripts with the developer's permissions before a single line of code is imported. A 48-hour minimum age policy blocks fast-moving malware before it reaches your developers.
Pin pipeline dependencies to commit SHAs
Tags and branch names are mutable. An attacker who compromises an action can move the tag without touching your workflow file. Pin every action and pipeline dependency to an immutable commit SHA instead.
Enforce phishing-resistant MFA
FIDO2 and passkeys are the standard to aim for. TOTP and SMS codes can be captured on a fake login page and replayed on the real site in real time, and maintainer accounts are a primary target.
Treat MCP servers as third-party dependencies
MCP servers carry the same supply chain risks as any other dependency, and they often run with more access. Only install MCP servers from verified sources, pin them via integrity hash or commit SHA, and check that the server has a maintained repository and a known publisher before installing.
Summary
Attackers have moved from targeting production applications to targeting the systems that build them, but defenders still control what enters those systems. You control your lockfile, your pipeline configuration, your token scopes, and the tooling on your developer machines. The engineering teams that come out ahead are the ones using that control before someone finds the vulnerable entry points first. This checklist contains actionable defenses across dependencies, pipelines, containers, developer environments, and the agentic tools your team is starting to rely on.
What you’ll learn
A practical checklist for engineering teams facing the current generation of supply chain attacks. The recommendations follow the path a compromised package takes into production, from the registry through your pipeline to the machines your team works on. Covers the specific habits that prevent a compromised package from becoming an incident.
Nicholas Thomson is a Content Marketing Writer at Aikido Security. Prior to this, he worked as a technical writer at Datadog and Edge Delta. Before entering tech, he worked as an editor at Penguin Random House.