Skip to content
Ferroscope
Menu

45 minutes · CI and packages

Supply-chain sweep

Most developer compromises arrive through a dependency, a workflow, or an update channel. Audit the three places secrets are exposed.

Next · Web server emergency
4 steps45 minno tools required

The procedure

  1. Step 01 · 15 min

    Pin third-party GitHub Actions to SHAs

    A tag can be moved. A commit SHA cannot.

  2. Step 02 · 5 min

    Set GITHUB_TOKEN to read-only by default

    Then grant write only in the job that needs it.

  3. Step 03 · 15 min

    Find packages that run install scripts

    npm install is executable code. Know which dependencies execute on install.

  4. Step 04 · 10 min

    Rotate anything a compromised package could read

    Environment variables, cloud keys, and SSH agents are all in scope.

Command

npm query ':attr(scripts)' 2>$null

Read it before running it. Every command in this repository is a plain shell command, not a downloaded script.