Securing Open Source CI/CD Pipelines: Lessons from Handling 2 Supply Chain Incidents
Open-source packages are now the primary attack surface used by threat actors. Rather than targeting enterprises directly, attackers are now compromising widely-used packages with a goal of reaching millions of CI/CD systems simultaneously through trusted releases.
Because these open-source packages form the backbone of modern enterprise workflows—including cloud pipelines, CI/CD systems, and developer tooling—attackers are increasingly targeting open-source organizations to poison these packages and publish them to trusted registries such as npm and the VS Code Marketplace, compromising hundreds of downstream organizations simultaneously through trusted releases installed by their developers.
Over the past year, AsyncAPI faced two supply chain attacks by TeamPCP and Miasma, compromising packages with up to 3.3+ million combined weekly downloads, such as:
@asyncapi/specs(3.1M weekly)@asyncapi/generator(~129k weekly)- Official VS Code extensions
This session presents the tactics, techniques, and procedures (TTPs) we saw used in both incidents, mapped directly to the MITRE ATT&CK framework. We will trace the end-to-end blast radius to illustrate how automated supply-chain compromises propagate into enterprise and public sector environments across Europe and Luxembourg.
Finally, attendees will gain actionable defense strategies and tools we have been using to tighten our security measures. We will showcase how we overhauled our release pipelines using:
- OIDC Trusted Publishing
- Automated CI/CD security scanning
- Hardened token isolation
- Least-privilege permission scopes on automation bots
- Continuous workflow auditing to catch anomalous triggers prior to artifact publication
Attendees will leave with practical checklists to audit their own GitHub Actions, build pipelines, and IDE extension supply chains against active threat groups.
This session provides a first-hand incidence response detailing from the AsyncAPI Initiative security team following two real-world software supply-chain compromises orchestrated by threat groups TeamPCP and Miasma.
The Technical Incident:
Instead of theoretical risks, we walk through the exact TTPs used by threat groups to target Open source organizations including but not limited to:
- Exploitation of GitHub Actions pull_request_target workflows (pwn requests) to steal elevated repository secrets.
- How the attackers released compromised packages with trusted credentials releasing malicious builds of @asyncapi/specs, @asyncapi/generator, and developer VS Code extensions directly to npm and the VS Code Marketplace.
- Mapping observed TTPs directly to the MITRE ATT&CK framework.
Direct Impact for Luxembourg & Financial Sector Attendees:
For Luxembourg's and the EU banking, fintech, and public sector ecosystems operating under strict EU regulatory frameworks like DORA and NIS2 and under the CSSF ICT Risk Management guidelines, open-source packages and developer extensions represent an unmonitored third-party dependency vector. A poisoned upstream library imported into an internal financial pipeline or a developer's IDE circumvents traditional perimeter controls.
Actionable Takeaways:
Attendees will leave with practical blueprints we implemented to remediate and harden our release infrastructure and further insights on how to protect their organizations from being compromised through supply chain attacks.
Florence Njeri is a Cybersecurity Engineer at AsyncAPI Initiative. She led the incident response for both the Shai-Hulud byTeamPCP and Miasma supply chain attacks, which compromised packages with millions of weekly downloads. Florence specializes in GitHub Actions security, CI/CD pipeline hardening, and vulnerability management. With a background in software engineering, cybersecurity research and hands-on penetration testing, she combines theoretical security principles with real-world incident response experience. She holds an Erasmus Mundus Master's in Cybersecurity and is passionate about securing open source infrastructure.
Lukasz Gornicki has worked in open source since 2014 and full-time since 2020. At the AsyncAPI Initiative he is a maintainer, a member of the Technical Steering Committee, and a former Executive Director, which means he has spent years on the unglamorous side of open governance: how decisions get made, who gets to make them, and what happens when a maintainer walks away.
He also works with Open Source Europe on fiscal hosting for open source projects, which is the other end of the same problem: getting money to people who are not companies.
Earlier he drove open source development inside a corporate environment, working alongside internal OSPOs, and has spent a lot of time explaining to organisations why funding the software they depend on is not charity.