A supply chain incident contact sheet should list who decides internally, who can revoke access, how to report to each package registry, how to reach key vendors, and who handles legal and customer communication. Fill it in now, because in the first hour nobody has time to look up a phone number.
What goes on the sheet
| Group | Who | Why |
|---|---|---|
| Incident lead | Named person and deputy | Makes containment calls |
| Evidence owner | Named person | Preserves logs |
| Communicator | Named person | Internal and customer messages |
| Credential owners | Cloud, source control, registry, vault admins | Can revoke and rotate |
| Legal and privacy | Counsel, privacy lead | Notification decisions |
| Registries | Reporting paths for each one you use | Get malware removed |
| Key vendors | Security contact for build and hosting tools | Ask about their exposure |
| Insurer and auditors | If contract requires notice | Avoid missed duties |
Registry reporting paths
Know these before you need them. npm provides a Report malware option on the package page, asking for your contact details, the package name, all affected versions and a description. After review, npm Security removes the package, publishes a placeholder and an advisory. PyPI provides a Report project as malware link on the project page, and accepts reports for things like typo squatting, dependency confusion, data exfiltration and obfuscation. For security issues in PyPI itself, PyPI asks for email to its security address and not for public disclosure.
Make it usable
- Put it somewhere that works if your main systems are down, such as a printed copy and a shared document in a separate account.
- Include out of hours numbers, not only email.
- Name a deputy for every role.
- Test it. Call one number from each group once a quarter.
- Review it after any staff change.
Link it to your roles
The sheet supports the roles in incident roles for a small team. Keep both in the same place.
A starter layout
A table with columns for role, name, deputy, phone, backup channel and last tested date is enough. Add a row for each registry you publish to or consume from, with the reporting link. Add a row for each cloud and source control admin, since they can revoke access fastest. Keep the document short, so it is read, and update the tested date every time someone calls a number.
Quick check
How often should we check the sheet?
Quarterly, and after any departure or reorganisation.
Do we report malware to the registry if we are not the maintainer?
Yes. Both npm and PyPI accept reports from any user with the details needed to confirm it.
Safeguard's asset discovery and compliance automation can help keep owners and systems documented. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
