From 8670ecd787dd5519609c7dcb35442e42265541fc Mon Sep 17 00:00:00 2001 From: Jane Alesi Date: Mon, 23 Mar 2026 23:15:39 +0100 Subject: [PATCH] docs(security): expand supply chain defense guide with deep research findings Co-authored-by: Junie --- docs/tech/supply-chain-security-2026-03.md | 730 +++++++++++++++++++++ 1 file changed, 730 insertions(+) create mode 100644 docs/tech/supply-chain-security-2026-03.md diff --git a/docs/tech/supply-chain-security-2026-03.md b/docs/tech/supply-chain-security-2026-03.md new file mode 100644 index 0000000..ceb22bd --- /dev/null +++ b/docs/tech/supply-chain-security-2026-03.md @@ -0,0 +1,730 @@ +--- +description: >- + Supply chain security assessment and comprehensive defense guide for + March 2026 incidents (Trivy/TeamPCP, CanisterWorm, GlassWorm). +tags: [security, supply-chain, incident-response, hardening, defense-guide] +last_updated: '2026-03-23' +priority: 10 +--- + +# Supply Chain Security Assessment (March 2026) + +## Scan Results + +| Check | Status | Detail | +|-------|--------|--------| +| CanisterWorm persistence | **CLEAN** | No `pgmon` service, no `~/.local/share/pgmon/` | +| TeamPCP C2 connection | **CLEAN** | No active connection to `45.148.10.212` | +| TeamPCP exfil repos | **CLEAN** | No `tpcp-docs-*` repos found | +| ICP C2 connection | **CLEAN** | No active connection to ICP endpoint | +| DNS resolution (C2) | **NOTES** | `scan.aquasecurtiy.org` still resolves to `45.148.10.212` (not yet sinkholed) | +| DNS resolution (ICP) | **NOTES** | ICP endpoint resolves via Dfinity boundary nodes (expected - decentralized) | + +### Note on DNS Resolution + +C2 domains resolving is expected - they have not been fully sinkholed. The critical check is **active connections**, which are absent. + +## Threat Landscape Summary + +### Trivy/TeamPCP (March 19-22) + +- Tag poisoning on `aquasecurity/trivy-action` (75 tags) +- Memory-based credential theft via `/proc//mem` +- Exfiltration via typo-squatted domain + victim's own GitHub repos +- Safe version: `aquasec/trivy:0.69.3@sha256:0d52a20836526e387157a55f9368d4001c95b77c3855a9010049448106a6b5e0` + +### CanisterWorm (March 20) + +- 66+ malicious npm packages via stolen tokens +- Self-propagating: harvests npm tokens, republishes victim's packages +- Persistence: systemd user service (`pgmon`) +- C2: ICP blockchain (resistant to takedown) +- Preceded by "Shai Hulud" worm (2025) - now a recurring pattern +- Related 2026 campaigns: Shai-Hulud 2.0 (preinstall phase, destructive fallback), SANDWORM_MODE (MCP injection, multi-channel exfil) + +### GlassWorm (January-March 2026) + +- Invisible Unicode chars (U+FE00-FE0F, U+E0100-E01EF) encode payloads +- 151+ GitHub repos, 72+ VS Code/Open VSX extensions, 400+ total affected packages +- Commits blend in with realistic surrounding changes (AI-generated) +- **Cannot be detected by visual code review or standard linting** +- Decoder pattern: maps codepoints to byte values, passes to `eval(Buffer.from(...))` + +--- + +## Defense Technologies (Deep Research Findings) + +### Layered Detection Architecture + +```text +Layer 1 (Preventive): Workflow Policy + SHA Pinning + OIDC +Layer 2 (Preventive): npm Hardening + Token Scoping + Script Sandboxing +Layer 3 (Detective): Runtime Monitoring (eBPF: Falco/Tetragon/Tracee) +Layer 4 (Detective): Unicode Scanning + Pre-commit Hooks +Layer 5 (Detective): SBOM + Vuln Scanning (syft/grype) + Nuclei +Layer 6 (Detective): DNS/Network Monitoring + Threat Intel Feeds +Layer 7 (Response): Credential Rotation + Incident Playbook +``` + +### 1. GitHub Actions Hardening (Trivy/TeamPCP Defense) + +#### SHA256 Digest Pinning + +All Actions MUST be pinned to full commit SHA, never tags or branches: + +```yaml +# WRONG - vulnerable to tag poisoning +- uses: aquasecurity/trivy-action@0.69.3 + +# CORRECT - immutable +- uses: aquasecurity/trivy-action@a12a3943b4151b629d348435e26e7cb35bc0db20 +``` + +#### OIDC Token Hardening + +- Enforce short-lived tokens (5-15 min expiration) +- Restrict token audience to specific cloud providers and repositories +- Use conditional access policies tied to repository, branch, and environment +- Disable all long-lived PATs; enforce OIDC for machine accounts + +#### Environment Protection Rules + +```yaml +environments: + production: + protection_rules: + - type: required_reviewers + reviewers: 2 + - type: wait_timer + minutes: 30 + - type: restrict_to_deployment_keys +``` + +#### Reusable Workflow Security + +- Store in private repos with explicit access controls +- Require signed commits for workflow updates +- Pin calls to specific commits, not branches +- Audit log all workflow invocations + +#### Action Allowlist Enforcement + +```yaml +# Branch protection or custom CI check +approved_actions: + - actions/checkout@a1b2c3d4e5f6 + - actions/setup-node@f1b2c3d4e5f6 + - org/internal-action@abcdef123456 +enforcement: reject_if_not_in_list +``` + +#### Tag Poisoning Detection + +Verify action repos for suspicious signals: +- Tag has been force-pushed (multiple SHAs for same tag) +- Repo created < 90 days ago +- Zero stars and zero forks +- Unknown or compromised maintainers + +Tools: Snyk GitHub Actions Security (auto-scans workflows), SLSA provenance verification. + +### 2. Memory Forensics (TeamPCP `/proc/pid/mem` Defense) + +#### Attack Vector + +`/proc/[pid]/mem` access allows reading running process memory to extract credentials, tokens, and secrets. TeamPCP targets CI/CD runners holding temporary credentials during workflow execution. + +#### Detection Techniques + +**Volatility 3** - Post-incident memory analysis: +```bash +vol3 -f memory.dump linux.psaux # Process list with env vars +vol3 -f memory.dump linux.bash # Command history +# Scan for credential patterns: ghp_*, ghu_*, AWS_*, npm_* +``` + +**eBPF Real-Time Monitoring** - Detect access at syscall level: +```c +// Trace openat syscall for /proc/*/mem access +TRACEPOINT_PROBE(syscalls, sys_enter_openat) { + char path[256]; + bpf_probe_read_user_str(&path, sizeof(path), (void *)ctx->args[1]); + if (strstr(&path, "/proc") && strstr(&path, "mem")) { + events.perf_submit(ctx, &event, sizeof(event)); + } + return 0; +} +``` + +**memdump** - Capture CI/CD runner memory post-execution, scan for credential remnants before process termination. + +#### Defensive Countermeasures + +```yaml +# Container runtime - deny ptrace capability +securityContext: + capabilities: + drop: [SYS_PTRACE] + readOnlyRootFilesystem: true +``` + +- Deploy runners in VM isolation (not container-only) +- Enable hardware memory encryption (Intel TME / AMD SEV-SNP) +- Rotate all credentials immediately post-workflow execution + +### 3. eBPF Runtime Security (Cross-Vector Detection) + +#### Tool Comparison + +| Tool | Strength | Best For | Enforcement | +|------|----------|----------|-------------| +| **Falco** | Rules-based alerting | Container environments, broad adoption | Alert only (SIGSTOP可选) | +| **Tetragon** | Kubernetes-native, policy enforcement | K8s clusters, tracing policies | Kill/block via policy | +| **Tracee** | Deep syscall tracing, eBPF-only | Bare-metal, CI/CD runners | Alert + filter | + +#### Falco Rules for Supply Chain Attacks + +```yaml +- rule: Unauthorized Process Memory Access + condition: > + open and container and + fd.name glob "/proc/*/mem" or syscall == ptrace + output: "Unauthorized memory access (user=%user.name cmd=%proc.name file=%fd.name)" + priority: CRITICAL + tags: [supply-chain, memory_access] + +- rule: Suspicious Env Variable Exfiltration + condition: > + syscall == execve and container and + proc.name in (curl, wget, nc, python) and + (proc.args contains "GITHUB_TOKEN" or proc.args contains "ghp_" or proc.args contains "npm_") + priority: CRITICAL + tags: [supply-chain, credential_exfil] + +- rule: Suspicious Systemd Service Creation + condition: > + open_write and fd.name glob "*/.config/systemd/user/*" and + not proc.name in (systemctl, systemd, ansible) + priority: HIGH + tags: [supply-chain, persistence] +``` + +#### Tetragon TracingPolicy (Enforcement) + +```yaml +apiVersion: cilium.io/v1alpha1 +kind: TracingPolicy +metadata: + name: block-proc-mem-access +spec: + kprobes: + - call: "__fput" + selectors: + - matchArgs: + - index: 0 + operator: "Equal" + values: ["/proc/*/mem"] + action: SIGKILL +``` + +#### Tracee for CI/CD Runner Monitoring + +```bash +tracee \ + --events=open,openat,ptrace,execve \ + --filter='container and (event.args.pathname contains "/proc" and event.args.pathname contains "mem")' \ + --output json \ + --output-file events.json +``` + +**Workstation Note**: eBPF tools require kernel support. For this Arch Linux workstation, `bpf` package provides headers. Falco can run in agent mode for local monitoring. + +### 4. npm Supply Chain Defense (CanisterWorm Defense) + +#### Lifecycle Script Mitigation + +```bash +# Global disable (already applied) +npm config set ignore-scripts true + +# Per-project override when needed +npm ci --ignore-scripts=false --only=dev # explicit opt-in + +# Node.js policy-based sandboxing (experimental) +node --experimental-policy=policy.json install +``` + +**Limitation**: Shai-Hulud 2.0 uses **preinstall** phase, bypassing postinstall-focused defenses. `--ignore-scripts` blocks both, but some legitimate packages require scripts. Use allowlists: + +```json +// policy.json - allow specific packages only +{ + "resources": { + "node_modules/.package-lock.json": { + "integrity": true + } + }, + "dependencies": { + "package:lodash": true, + "package:express": true + } +} +``` + +#### Token Security + +| Practice | Implementation | +|----------|---------------| +| Granular Access Tokens (GAT) | Scope to specific repos + read-only or automation permissions | +| Token expiration | Set max 90 days; automate rotation | +| Never store in `.npmrc` | Use environment variables or OIDC | +| Audit tokens quarterly | `npm token list`, revoke unused | +| MFA enforcement | Required for package publish (prevents bypass token abuse) | + +#### npm OIDC (Long-Term Fix) + +npm OIDC integration is "very hard to compromise" and would "almost completely erase supply-chain attack surface" (Chainguard, 2026). Enables tokenless authentication for package operations. + +#### Systemd Service Monitoring (CanisterWorm `pgmon`) + +```bash +# Detect unknown user services +systemctl --user list-units --type=service --all + +# Audit service files for anomalies +ls -la ~/.config/systemd/user/ + +# Check for services with suspicious exec paths +grep -r "ExecStart" ~/.config/systemd/user/ | grep -v "/usr/bin\|/usr/local/bin" + +# Monitor service file creation (eBPF Falco rule above) +``` + +#### ICP Blockchain C2 Detection + +- Decentralized C2 via ICP canisters is resistant to traditional takedown +- Monitor for outbound connections to Dfinity boundary nodes from unexpected processes +- Network baseline: CI/CD runners should never connect to ICP endpoints +- Block ICP boundary node IPs at firewall level for non-ICP workloads + +#### Worm Containment + +- **socket.dev**: Detects malicious packages within 2-5 minutes of publication via differential analysis +- Monitor all npm packages under org control for unauthorized version publishes +- Alert on rapid-succession version publishes (1-3 day windows = suspicious) +- Revoke and rotate tokens immediately if compromise suspected + +### 5. Unicode Attack Defense (GlassWorm Defense) + +#### Understanding the Decoder Pattern + +GlassWorm uses this exact decoder signature: + +```javascript +const s = v => [...v].map(w => ( + w = w.codePointAt(0), + w >= 0xFE00 && w <= 0xFE0F ? w - 0xFE00 : + w >= 0xE0100 && w <= 0xE01EF ? w - 0xE0100 + 16 : null +)).filter(n => n !== null); +eval(Buffer.from(s(``)).toString('utf-8')); +``` + +Detection must target: `eval()` + `Buffer.from()` + codepoint arithmetic + apparent empty/whitespace strings. + +#### Detection Tools + +```bash +# Variation Selectors (VS1-VS16) +grep -rP "[\x{FE00}-\x{FE0F}]" . --exclude-dir=node_modules --exclude-dir=.git + +# Ideographic Variation Selectors +grep -rP "[\x{E0100}-\x{E01EF}]" . --exclude-dir=node_modules --exclude-dir=.git + +# Combined with decoder pattern +grep -rP "(codePointAt|fromCharCode|Buffer\.from)" . \ + --include="*.js" --include="*.ts" --exclude-dir=node_modules +``` + +Python scanner for byte-level detection: + +```python +#!/usr/bin/env python3 +"""Scan files for GlassWorm Unicode injection patterns.""" +import sys, pathlib + +VS_RANGES = [(0xFE00, 0xFE0F), (0xE0100, 0xE01EF)] + +def scan_file(path): + content = path.read_bytes() + hits = [] + for i, b in enumerate(content): + # Check for multi-byte UTF-8 sequences in VS ranges + if b >= 0xEF: # Start of 3-byte UTF-8 (VS range) + if i + 2 < len(content): + cp = int.from_bytes(content[i:i+3], 'big') + for start, end in VS_RANGES: + if start <= cp <= end: + hits.append((i, hex(cp))) + return hits + +for p in pathlib.Path(sys.argv[1]).rglob('*'): + if p.suffix in ('.js', '.ts', '.mjs', '.cjs', '.py', '.json'): + hits = scan_file(p) + if hits: + print(f"{p}: {len(hits)} invisible chars found") + for offset, cp in hits[:5]: + print(f" offset {offset}: {cp}") +``` + +#### Git Pre-commit Hook + +```yaml +# .pre-commit-config.yaml +repos: + - repo: local + hooks: + - id: no-invisible-unicode + name: Block invisible Unicode (GlassWorm defense) + entry: python3 scripts/unicode-scanner.py + language: script + types: [text] +``` + +#### IDE Visibility Configuration + +**VS Code** - Show invisible characters: +```json +{ + "editor.renderWhitespace": "all", + "editor.unicodeHighlight.ambiguousCharacters": true, + "editor.unicodeHighlight.invisibleCharacters": true +} +``` + +**Vim/Neovim**: +```vim +set list +set listchars+=trail:~,nbsp:␣ +" Conceal off for PUA/VS ranges +syntax match GlassWorm "[\uFE00-\uFE0F\uE0100-\uE01EF]" cchar=█ +``` + +#### VS Code Extension Security + +- Verify extension publisher identity before install +- Audit extension update history for suspicious version jumps +- Known malicious: `quartz.quartz-markdown-editor` v0.3.0 (March 12, 2026) +- 72+ malicious Open VSX extensions in coordinated campaign +- Prefer extensions with signed commits and provenance +- Review extension permissions (workspace access, terminal access = high risk) + +#### Semgrep Rules + +```yaml +rules: + - id: glassworm-decoder-pattern + patterns: + - pattern-either: + - pattern: | + eval(Buffer.from($FN(...)).toString(...)) + - pattern: | + $VAR = $V => [...$V].map($W => ($W = $W.codePointAt(0), ...)) + message: "Potential GlassWorm Unicode decoder pattern detected" + severity: ERROR + languages: [javascript, typescript] +``` + +### 6. SLSA Provenance & Sigstore Ecosystem + +#### SLSA Framework (v1.2 Current) + +| Level | Requirement | This Workstation | +|-------|-------------|-----------------| +| L1 | Documented build process | Partial (Ansible) | +| L2 | Hosted build platform | N/A (local dev) | +| L3 | Hardened build + provenance | N/A | +| L4 | Hermetic + reproducible | N/A | + +**Applicability**: SLSA primarily targets CI/CD builds. For this local workstation, focus on L1 (documented process) and verifying SLSA provenance of consumed packages/artifacts. + +#### Sigstore Components + +| Component | Purpose | Tool | +|-----------|---------|------| +| **cosign** | Container image signing/verification | `pacman -S cosign` | +| **fulcio** | Certificate authority (issues certs based on OIDC) | Service | +| **rekor** | Transparency log (immutable record) | Service | +| **sigstore-js** | Node.js client library | `pnpm add @sigstore/sign` | + +```bash +# Verify a container image was signed +cosign verify --certificate-identity=action@github.com \ + --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ + aquasec/trivy:0.69.3 + +# Sign an artifact +cosign sign --key env://COSIGN_PRIVATE_KEY my-image:latest +``` + +#### in-toto Attestations + +in-toto provides a framework for verifying the integrity of the software supply chain. Key concepts: + +- **Layout**: Defines expected steps, authorized functionaries, and inspection rules +- **Attestation**: Metadata about a supply chain step (linked to SLSA provenance) +- **Verification**: Client-side check that all steps match the layout + +Integration with GitHub Actions via `slsa-github-generator`: + +```yaml +- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 + with: + attestation-name: my-attestation +``` + +### 7. SBOM Management + +#### Toolchain + +```bash +# Generate SBOM (CycloneDX format - preferred for security) +syft packages dir:./src -o cyclonedx-json > sbom.json + +# Alternative: SPDX format (preferred for license compliance) +syft packages dir:./src -o spdx-json > sbom.spdx.json + +# Scan SBOM for vulnerabilities +grype sbom:sbom.json --fail-on high +``` + +#### Format Choice + +| Format | Best For | Tooling | +|--------|----------|---------| +| **CycloneDX** | Security scanning, vulnerability matching | grype, Dependency-Track | +| **SPDX** | License compliance, legal | SPDX tools, FOSSA | + +#### Dependency-Track (SBOM Repository) + +Centralized SBOM storage and continuous monitoring: +- Upload SBOMs via API on each build +- Continuous vulnerability scanning (NVD, OSV, GitHub Advisories) +- Policy evaluation (fail builds on critical vulns) +- This workstation: run via Docker for local SBOM management + +### 8. Nuclei Template-Based Scanning + +```bash +# Install +go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest + +# Scan for known supply chain C2 indicators +nuclei -t supply-chain/ -u scan.aquasecurtiy.org + +# Scan local git repos for TeamPCP exfil patterns +nuclei -t custom/teampcp-exfil.yaml -target https://github.com/org/repo + +# Custom template for C2 domain detection +cat <<'EOF' > nuclei-teampcp.yaml +id: teampcp-c2-detection +info: + name: TeamPCP C2 Domain + severity: critical +dns: + - name: "{{Hostname}}" + matchers: + - type: word + words: + - "45.148.10.212" +EOF +``` + +### 9. ML-Based & Behavioral Detection (Emerging) + +#### ML Detection Approaches for Supply Chain Attacks + +| Technique | Application | Tools/Platforms | +|-----------|-------------|-----------------| +| **Package behavior modeling** | Detect anomalous postinstall behavior vs. historical baseline | socket.dev (differential analysis), EndorLabs | +| **Dependency graph anomaly detection** | Flag sudden dependency additions, version spikes, or transitive changes | Snyk Advisor, Socket.dev risk scores | +| **Code embedding similarity** | Detect AI-generated commits that mimic project style (GlassWorm evasion) | CodeQL ML models, GitHub Advanced Security | +| **Network behavior profiling** | Detect C2 beacon patterns, unusual outbound from build runners | Elastic ML, CrowdStrike Falcon | +| **File system entropy analysis** | Detect encoded payloads (Unicode steganography, encrypted strings) | YARA rules + ML classifiers | + +#### Behavioral Detection Patterns + +**Anomalous Package Behavior** (CanisterWorm/Shai-Hulud): +- Package executes network calls during install (baseline: most packages don't) +- Package writes files outside `node_modules` during install +- Package reads environment variables or `.npmrc` during install +- Package spawns child processes during install +- Detection: compare current package behavior against historical behavior profile + +**Anomalous Commit Patterns** (GlassWorm): +- Commit modifies only whitespace/Unicode but diff shows zero visual changes +- Commit timestamp clusters with other suspicious commits across repos (coordinated campaign signal) +- Commit author style differs from project norm (AI-generated code detection) +- Detection: `git diff --word-diff` to catch invisible char changes; commit metadata clustering + +**Anomalous Build Behavior** (TeamPCP): +- Build process accesses `/proc/*/mem` (never legitimate in CI) +- Build process resolves non-whitelisted DNS (tag poisoning C2 indicator) +- Build process creates outbound connections to non-cdn endpoints +- Detection: Falco rules (above), DNS query logging, network egress allowlists + +#### Implementation for This Workstation + +```bash +# Socket.dev CLI - local package risk scoring +npm install -g socket-cli +socket view express # Risk profile before installing +socket scan ./src # Scan dependencies for behavioral anomalies + +# YARA rule for GlassWorm encoded payloads (high entropy strings) +# Install: pacman -S yara +cat <<'EOF' > rules/glassworm.yar +rule GlassWorm_Unicode_Payload { + strings: + $decoder = /codePointAt.*0xFE00|codePointAt.*0xE0100/ ascii + $eval_buf = /eval\(Buffer\.from/ ascii + $vs_range = /\xEF\xB8[\x80-\x8F]/ // UTF-8 for U+FE00-FE0F + condition: + 2 of them +} +EOF +yara -r rules/glassworm.yar ./src +``` + +### 10. DNS & Network Monitoring + +#### Passive DNS Integration + +- Subscribe to Farsight Security or RiskIQ passive DNS feeds +- Query historical DNS data for infrastructure domains during IR +- Detect CNAME chains pointing to attacker-controlled servers + +#### Threat Intelligence Feeds + +| Feed | Coverage | Integration | +|------|----------|-------------| +| URLhaus | Known C2 domains | API, daily dump | +| Abuse.ch SSLBL | Malicious SSL certificates | IP blocklists | +| VirusTotal | Domain reputation | API | +| Custom | Typo variants of internal domains | Local script | + +#### DNS Monitoring for CI/CD + +- Log all DNS queries from runners to SIEM +- Block non-whitelisted external domains from runners +- Alert on edit distance < 2 from known infrastructure domains + +--- + +## Hardening Actions + +### Immediate (Already Applied) + +```bash +npm config set ignore-scripts true +``` + +### Recommended for This Workstation + +```bash +# 1. Install supply chain security tools +pacman -S syft grype cosign # SBOM, vuln scan, artifact verify +uv tool install semgrep # SAST with Unicode rules + +# 2. Set up Unicode scanning as pre-commit hook +# (see GlassWorm section above for hook config) + +# 3. Configure IDE visibility +# (see GlassWorm section for VS Code/Vim settings) + +# 4. Audit systemd user services monthly +systemctl --user list-units --type=service --all + +# 5. Network-level C2 blocking (optional) +# Block 45.148.10.212 and ICP boundary nodes if not needed +``` + +### CI/CD Hardening Checklist + +- [ ] Pin all Actions to SHA256 (never tags) +- [ ] Use OIDC over long-lived secrets +- [ ] Block outbound to non-essential domains from runners +- [ ] Run sensitive builds in ephemeral environments +- [ ] Generate and verify SLSA provenance for built artifacts +- [ ] Sign container images with cosign +- [ ] Generate SBOM on every build (syft + grype) +- [ ] Run Nuclei templates against dependencies +- [ ] Enable Unicode scanning in CI pipeline + +--- + +## Detection Patterns + +### File System IOCs + +```bash +# CanisterWorm +find ~ -name "pgmon*" -o -name "uv-proxy" -o -name "pglog" 2>/dev/null + +# Unknown systemd user services +ls ~/.config/systemd/user/ | grep -v "default.target" +``` + +### Unicode IOCs (GlassWorm) + +```bash +# VS1-VS16 range +grep -rP "[\x{FE00}-\x{FE0F}]" . --exclude-dir=node_modules --exclude-dir=.git + +# Ideographic Variation Selectors +grep -rP "[\x{E0100}-\x{E01EF}]" . --exclude-dir=node_modules --exclude-dir=.git + +# Decoder function pattern +grep -rP "codePointAt.*0xFE00|codePointAt.*0xE0100" . --include="*.js" --include="*.ts" +``` + +### Network IOCs + +```bash +# TeamPCP C2 +ss -ntu | grep -E "45.148.10.212" +getent hosts scan.aquasecurtiy.org + +# ICP C2 (unexpected connections to Dfinity) +ss -ntu | grep -E "icp0\.io|dfinity" +``` + +--- + +## Workstation-Specific Implementation Priority + +| Priority | Action | Effort | Impact | +|----------|--------|--------|--------| +| P0 | Pre-commit hook for Unicode scanning | 30min | Blocks GlassWorm | +| P0 | VS Code invisible char visibility | 5min | Visual detection | +| P1 | Monthly systemd service audit | 10min | Detects CanisterWorm | +| P1 | `npm config set ignore-scripts true` verify | 1min | Blocks script-based attacks | +| P2 | syft/grype SBOM scanning | 1hr setup | Continuous vuln monitoring | +| P2 | Nuclei C2 template scanning | 30min | Network IOC validation | +| P3 | Falco local agent setup | 2hr | Runtime memory/process monitoring | +| P3 | cosign artifact verification workflow | 1hr | Build integrity | + +--- + +## References + +- Upwind Security: Trivy/TeamPCP analysis +- EndorLabs: CanisterWorm + SANDWORM_MODE technical analysis +- Aikido Security: GlassWorm Unicode campaign tracking +- Unit42 (Palo Alto): Shai-Hulud 2.0 npm supply chain attack +- Chainguard: npm supply chain hardening and OIDC future +- CISA: GitHub Actions Security Hardening Guidance +- Cilium/Tetragon: eBPF Security Enforcement documentation +- Falco: Runtime security rules and best practices +- SLSA v1.2: slsa.dev/spec/v1.2 +- Sigstore: sigstore.dev +- NIST SSDF v1.1: Secure Software Development Framework \ No newline at end of file