Skip to content

Overview

Threat Activity

CI/CD pipelines, package registries, and developer environments have become a consistent target for credential theft. In May of 2026 alone, over 170 npm and PyPI packages were compromised, impacting numerous critical down-stream products from TanStack, Mistral AI, UiPath, Grafana, and others.

Many of the controls that would have limited this exposure are well established and documented best practices that remain inconsistently applied. This guide highlights the most important controls and such be used as a reference.

Risk to MBARI

Compromised Actions and upstream packages are being used to capture sensitive data and secrets. Examples include:

  • GitHub Actions runner secrets
  • GitHub personal access tokens
  • npm/PyPI publishing tokens
  • GitHub Actions OIDC tokens
  • AWS credentials
  • SSH private keys
  • kubeconfig files
  • Environment variables and .env files

Secret exposure allows persistence and lateral movement through MBARI systems, potentially impacting downstream users of our published software.