Supply-chain attacks and the SLSA framework

Attackers target where you get code and where you build it rather than your app; recognise typosquatting, dependency confusion, compromised maintainers and build systems, and use SLSA to raise trust in artifacts.

Common attack types

Type	How it works	Notable example
Typosquatting	Publish a package with a near-identical name (`reqeusts`)	Many malicious npm and PyPI packages
Dependency confusion	Publish a public package with an internal package's name and a higher version	2021 research against many large companies
Compromised or planted maintainer	An attacker gains publish rights and adds a backdoor	xz-utils (2024), event-stream (2018)
Compromised build system	Inject code during the build while the source stays clean	SolarWinds (2020)
Compromised CI action	Move an action's tag to malicious code	tj-actions/changed-files (2025)

The xz-utils case is especially memorable: a contributor built trust for two years, then planted a backdoor in the release tarball targeting sshd. It was found by chance because SSH logins became half a second slower.

Defending each point

flowchart LR
  SRC["Source<br/>branch protection, review, signed commits"] --> BLD["Build<br/>isolated CI, OIDC, pinned actions"]
  BLD --> ART["Artifact<br/>signature, SBOM, provenance"]
  ART --> DEP["Deploy<br/>accept only verified images"]
  PKG["Dependencies<br/>lockfiles, internal registry, scopes"] --> BLD

Dependency confusion: use scopes (@example-org/) and make the internal registry the only source for internal names.
Typosquatting: review every new dependency; use an allowlist or a proxy registry (Artifactory, Nexus).
Build: ephemeral runners, least privilege, actions pinned by SHA, no downloading and running scripts (curl | bash).

SLSA

SLSA (Supply-chain Levels for Software Artifacts, pronounced "salsa") is an OpenSSF framework describing how trustworthy a build process is. Version 1.0, Build track:

Level	Main requirement
Build L1	Provenance exists: a document saying how the artifact was built and from which commit
Build L2	Built on a hosted platform that signs the provenance
Build L3	Isolated, tamper-resistant builds; the build job itself cannot forge the provenance

Provenance answers: who built it, from which source, with which tools, when. GitHub offers actions/attest-build-provenance, and the slsa-github-generator reaches Build L3.

gh attestation verify oci://registry.example.com/myapp:1.0 --owner example-org

Traps

Believing popular packages are safe; xz-utils is a core package of every distro.
Protecting source while leaving the build server open.
Producing provenance that nobody checks at deploy time.