Supply chain attacks are a credential theft problem

What is happening

A consistent attack pattern is playing out across software supply chains.

Widely used packages across npm, PyPI, and GitHub Actions are being compromised and weaponised to harvest credentials at install or runtime. This is not isolated activity. Multiple recent campaigns have used this approach to extract cloud credentials, CI/CD tokens, SSH keys, and API secrets.

The mechanism is simple and repeatable:

• Maintainer or publisher credentials are compromised
• A malicious package version is released
• Code executes during install or runtime
• Credentials are harvested immediately from the host environment

No exploit is required. The attacker inherits the permissions of the environment the code runs in.

The objective is not code execution. It is durable access.

Attacker goals

Common targets include:

• Cloud access keys
• CI/CD tokens
• SSH keys
• API credentials
• Kubernetes configuration files

These credentials are validated quickly and used to:

• Gain a foothold
• Enumerate cloud environments
• Identify accessible services and data
• Test privilege escalation paths
• Move laterally across accounts and roles

The supply chain attack is not the breach. It is the initial access vector.

Why this is dangerous

These attacks break the assumptions most detection systems rely on.

There may be no exploit chain and no clear anomaly that, in isolation, indicates compromise. The attacker is operating with valid credentials inside trusted environments.

This includes:

• Developer workstations
• CI/CD pipelines
• Production systems

Once credentials are obtained, the attacker does not need to bypass controls. They authenticate and operate as a legitimate identity.

This creates a fundamental detection gap:

• API calls are authenticated and expected
• Role assumptions are valid
• Service interactions look normal
• Activity aligns with existing permissions

Traditional tools look for suspicious events. These attacks generate sequences of legitimate ones.

By the time sensitive data is accessed, the attacker has already established a valid operational path through your environment.

How these attacks progress

1. Authenticate using stolen credentials
2. Enumerate identities, roles, and resources
3. Identify privilege escalation opportunities
4. Move laterally across accounts and services
5. Approach sensitive data stores such as object storage, databases, and secrets managers
6. Exfiltrate data or establish leverage for extortion

Each step is individually legitimate.

There is no single event that clearly indicates a breach. The signal is in how these steps connect and progress over time.

Velocity of attacks

In observed cases, credential theft occurs immediately upon execution, and stolen credentials are validated and used within hours.

From that point, there is little friction.

Attackers are operating with valid credentials, established tooling, and direct access to cloud control planes. Enumeration, role assumption, and lateral movement are all scriptable and can be executed in rapid sequence.

This is not a slow intrusion. It is a fast, iterative process of expanding access toward data.

As these workflows become more automated, the time between initial access and meaningful data exposure continues to compress rapidly.

How vec0 approaches this

vec0 builds a real-time graph of identities, permissions, activity, and data access, and measures how each action changes an attacker's ability to move through your environment toward sensitive data.

This is not a static view of exposure. It is a real-time view of how an attacker is progressing through your environment.

Traditional tools generate alerts on individual events. They do not model how those events connect into a path toward data.

Instead of asking whether an action is suspicious, vec0 models whether each action moves the attacker closer to data.

That means tracking:

• how identities move between accounts and roles
• how permissions are exercised in sequence
• the paths an attacker is actively traversing toward sensitive data

Every action is evaluated in terms of its impact on the system state and how it changes progression toward data.

• Assuming a new role may expand access to data
• Accessing a new service may expose additional paths
• Failed or denied actions can still signal reconnaissance and increase risk

The focus is not on static risk or isolated alerts. It is on how risk is changing step by step in real time.

We are currently onboarding a small number of early access partners to validate this approach in real environments. If you cannot currently see this progression in your environment, we should talk.