Ask where the malicious code first appeared and who or what put it there. Compare the repository, the build and the published artifact. A mismatch points to the build or registry, a legitimate looking commit points to an account, and an unexpected package source points to name resolution.
Why triage the entry point
Response differs by entry point. If a token was stolen, you rotate tokens. If a build was altered, you rebuild from clean infrastructure. If a name trick pulled the wrong package, you fix sources. Rotating the wrong thing leaves the door open.
You will not always know right away. A short, ordered set of questions gives you a working theory in the first hours.
Six triage questions
- Is the malicious code in the source repository? If yes, find the commit, the author and how it was merged. If no, the change happened later, in the build or after.
- Does the published artifact match the source? The SLSA threats overview lists cases where a package was uploaded that did not match the build process, or built from modified sources. Compare file lists and hashes where you can.
- Who published the release, and from where? Look for a new publisher, an unusual time, or a release that did not come from your normal pipeline.
- Did the dependency come from the source you expected? A package resolved from an unexpected index or a similar name suggests a name trick.
- Did a pipeline job run something it should not have? Check workflow changes and job logs around the time of the release.
- Did the release arrive through an update channel rather than a package manager? That suggests a poisoned update or a tampered mirror.
Reading the answers
| Finding | Likely entry point |
|---|---|
| Bad commit by a valid account, no pipeline change | Takeover or stolen credential |
| Repository clean, artifact different | Build or registry compromise |
| New publisher or token use outside CI | Credential theft |
| Workflow file changed or injected text in a job | CI abuse |
| Wrong package name or source in the install log | Name trick |
| Bad version delivered by auto update | Poisoned update |
Treat this as a hypothesis. Real incidents can combine entry points.
What to preserve
Keep the artifacts before you clean up: the bad package version, build logs, workflow runs, registry audit entries and lockfile history. Cleanup destroys evidence, and you may need it for a report or a customer notice. If you need advice on obligations, ask your legal counsel.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a change in a dependency is surfaced after the original scan passed.
Where Safeguard fits
Safeguard's SBOM and continuous monitoring give you a record of what you consumed and when it changed, which speeds up questions two and four. Rotating credentials and rebuilding stay with your team.
Quick check
What if two entry points fit?
Respond to both. Rotate credentials and rebuild from a clean environment until you can rule one out.
Can I skip triage and rotate everything?
You can, and in an emergency you may. Triage still tells you how the attacker got in, so the same hole is not left open.
Sources
Last reviewed: 19 October 2026.
