StepSecurity detected some of the most consequential supply chain attacks of 2025, often before they were publicly known. Today, we secure over 13 million builds every week, giving us real-world visibility into how modern software is built and where it is most vulnerable.
Over the past few years, software supply chain attacks have moved from theoretical risk to daily reality. In 2025, that shift became impossible to ignore. Attackers targeted CI/CD pipelines, open source packages, and trusted developer tooling at an unprecedented pace.
For StepSecurity, 2025 was the year our core thesis—that organizations need real-time visibility and enforcement across their software supply chains, not alerts after the damage is done—was repeatedly validated in production. We scaled the business, accelerated community adoption, and responded to critical compromises as they unfolded.
Here's a look back at what we built, what we learned, and where we are headed in 2026.
What makes this growth meaningful is not just the absolute numbers, but the acceleration behind them.
It took nearly three years to reach the first 5,000 public repositories using Harden Runner. In contrast, we added the next 5,000 repositories in just one year, doubling adoption in a fraction of the time. This reflects both increasing awareness of CI/CD supply chain risk and growing trust in StepSecurity as teams move from experimentation to standardization.
Sustaining 5x ARR growth year over year while accelerating community adoption reinforces a clear signal: software supply chain security is no longer an emerging concern. It has become a foundational requirement for modern development teams.
In 2025, StepSecurity was at the center of several major supply chain compromises, often detecting malicious activity before it was publicly known. These are the top three:
First detected by StepSecurity Harden Runner, triggered by an anomalous outbound network call made by the compromised action. This incident impacted thousands of repositories across the GitHub ecosystem. Our detection and investigation methodology was presented at Black Hat USA in Las Vegas.
Among the first teams to detect and publish technical details. Our research was referenced by CISA and covered by multiple media publications. We published a case study showing how CNCF's Backstage project, using Harden Runner, detected compromised npm packages across nine workflow job runs.
These incidents reinforced why we built StepSecurity in the first place: organizations need real-time visibility and enforcement across their software supply chains, not alerts after the damage is done.
In August 2025, malicious versions of the widely used Nx build system were published to npm after a maintainer token was compromised (GHSA-cxm3-wv7p-598c). The payload executed during install, stealing developer credentials and exfiltrating data by creating public GitHub repositories named s1ngularity-repository.
This incident marked a new frontier in supply chain attacks: the malware attempted to abuse locally installed AI CLI tools to accelerate reconnaissance and data discovery, pushing the attack surface beyond CI/CD and into developer machines themselves.
Our product evolved directly from customer feedback and lessons learned while responding to real-world supply chain attacks. You can view the full history in our changelog.
The tj-actions compromise exposed a fundamental problem: many teams rely on third-party actions that are abandoned, lack proper licensing, or become vectors for attack. In response, we added 200 StepSecurity-maintained actions as secure, drop-in replacements. We also introduced workflow run policies to block non-compliant workflows before execution, including blocking runs that reference compromised third-party actions—preventing incidents before they can execute.
To simplify deployment at scale, we announced a partnership with RunsOn, enabling customers to use Harden Runner with RunsOn's built-in images, and added support for baking Harden Runner into custom VMs for GitHub-hosted runners. This ensures every workflow, across every repository, is protected by default.
In 2025, we expanded beyond CI/CD workflows to address supply chain risk in npm dependencies. During the Shai Hulud attacks, we observed attackers publishing malicious package versions within minutes of compromising maintainer accounts. Existing security tools couldn't respond fast enough.
Our npm capabilities were built to counter these specific attack patterns:
Together, these capabilities give customers proactive defenses and faster response when compromises occur.
Our focus in 2026 is expanding protection across the full development lifecycle.
Securing the developer machine: One of the most requested capabilities from our customers. Recent attacks have shown that compromising a single developer workstation can bypass CI/CD protections entirely, giving attackers direct access to source code, credentials, and deployment pipelines. This critical attack surface has been overlooked for too long.
Harden Runner for Windows and macOS: Currently, Harden Runner protects Linux-based workflows. Extending coverage to Windows and macOS will enable comprehensive protection across heterogeneous CI/CD environments, addressing the needs of teams building across multiple platforms.
Expanding ecosystem coverage: Starting with PyPI and extending to additional package ecosystems. Supply chain attacks aren't limited to npm—we're seeing increased activity across language ecosystems, and our customers need consistent protection regardless of their tech stack.
Supply chain attacks are accelerating. In 2026, our goal is to stay ahead of those threats and help our customers do the same.
Thank you to our customers and community for trusting us and pushing us to build better defenses. And thank you to the StepSecurity team for showing up every day to support users when it matters most.
Here's to an even bigger 2026.
We are hiring. As we expand protection across developer workstations, multiple operating systems, and new package ecosystems, we're growing the team that makes it possible. If you care deeply about securing the software supply chain and want to work on problems that matter, we would love to hear from you.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。