Software supply chain security best practices for 2026

What it is

Aikido's list of supply chain controls, each tied to an incident it says would have been stopped. The page gives concrete version boundaries, per-ecosystem flags and incident timelines that the catalog summary only names.

What to do

Cooldown and install scripts. Enforce a 48-hour minimum package age at the private registry or the package manager. npm has min-release-age since 11.10.0, and Yarn and Bun ship their own age gates. Run installs with --ignore-scripts, allowlist the few packages that must build, and apply this in CI and on developer machines.

Default behaviour by package manager, per the page:

• pnpm v10 (January 2025) disabled dependency install scripts by default. pnpm v11 (April 2026) added a 24-hour cooldown by default.
• npm v12 (released 8 July 2026) disables dependency install scripts by default, but your own scripts still run. It has no default cooldown, so set min-release-age yourself.
• Older versions and other ecosystems need the explicit settings.

Lockfile enforcement. Run npm ci in the pipeline, which fails if package.json has drifted from the lockfile. Equivalents: --frozen-lockfile (pnpm), --immutable (Yarn), --locked (Cargo), --require-hashes (pip). Make it a required check before merge.

Pinning. Pin CI dependencies to commit SHAs (GitHub Actions, GitLab, Buildkite and Jenkins accept them). CircleCI orb versions are immutable once released, so an exact version works. Pin Docker FROM lines to a digest, and schedule automated rebuilds, since a pinned digest stops upstream patches. Renovate can convert tags to SHAs and keep them current, and covers Actions and GitLab includes. Dependabot only keeps existing GitHub Actions pins current. Pin MCP servers by lockfile integrity hash (npm) or a full commit SHA (git).

Identity and access. Use fine-grained tokens scoped to specific repos and packages, one per pipeline. Rotate on a schedule and on suspicion, and revoke when someone leaves. Move maintainer accounts to FIDO2 or passkeys, because TOTP codes can be replayed within the 30-second window. npm freezes high-impact accounts for 72 hours after an email change or 2FA recovery and sends the alert to the previous address, so keep the account email current.

Endpoints, agents and response.

• Use endpoint tooling that inspects npm and pip installs as they happen, with a centrally pushed allowlist for IDE extensions and browser plugins.
• Grant agents only the permissions the task needs, then sandbox them with network egress controls.
• Audit any workflow that feeds an issue title or PR description into an agent prompt, and treat agent output that reaches a shell or file write as untrusted.
• Run malware detection both at install time and on PRs that add dependencies, to catch slopsquatted names.
• Stream org audit logs to a SIEM, watching registry pushes and token use.
• Generate a signed SBOM per build artifact, including transitive dependencies, and store it beside the artifact.
• Write down which credentials rotate per pipeline and who may rotate them, and drill it. GitHub Enterprise supports bulk credential revocation for one user or the whole enterprise.

Incident evidence

• axios, March 2026. The attacker published a clean decoy, plain-crypto-js@4.2.0, on 30 March, then swapped in malicious 4.2.1 at 23:59 UTC. Detection flagged it six minutes later. axios@1.14.1 went live at 00:21 UTC on 31 March and axios@0.30.4 at 01:00. npm removed both about three hours after the first. A 48-hour gate leaves roughly 45 hours of margin. The attacker used a long-lived npm token from the maintainer's machine, so there was no suspicious sign-in. The registry record showed an email change, then two publishes 39 minutes apart.
• CanisterWorm. It republished patch versions of every package its victims maintained, over 60 in 24 hours. Most were flagged within minutes, but at least one went undetected for about 53 hours, longer than a 48-hour gate.
• tj-actions/changed-files, March 2025. Version tags were repointed to a malicious commit that dumped CI secrets into logs. About 23,000 repositories referenced it. Repos pinned to a SHA were untouched.
• postmark-mcp, September 2025. An npm impersonation of the ActiveCampaign Postmark MCP server behaved normally for fifteen versions. Version 1.0.16 added a BCC to an attacker address on every email sent.
• Fake WakaTime extension, April 2026. On OpenVSX, it pulled a second payload from GitHub Releases and force-installed it into VS Code, Cursor, Windsurf and VSCodium via each editor's CLI installer.
• PromptPwnd. A malicious issue title fed to a Gemini CLI workflow made the agent write repository secrets into a public issue. Aikido says at least five Fortune 500 companies were affected.
• CrowdSec. A departed developer kept GitHub access, and their laptop was compromised in the TanStack attack. The attacker cloned 170 private repos in about nine minutes. The company noticed four months later.

Caveats

• A 48-hour cooldown misses slow detection, as in the 53-hour CanisterWorm case, so the page pairs it with install-time detection.
• An extension allowlist does not help when an approved extension is compromised. GlassWorm did this, and the updates arrive with no diff to review.
• SHA and digest pinning stops automatic upstream fixes, so it needs a bot or scheduled rebuild.
• The page is vendor content. The closing section promotes Aikido Intel, Device Protection, Safe Chain and SAST, and the 30-control checklist is in a separate document.