Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Assume any API key, token, SSH key, cloud credential, or other secret reachable by an affected build or developer machine may have been exposed. First contain the affected systems and preserve evidence; then identify the exposure window, revoke or disable at-risk credentials, issue least-privilege replacements, update every consumer, and verify that the old credentials no longer work. Rotate promptly when a credential was exposed or could have been exposed—not on an invented universal schedule.
What should you do first after a package supply-chain attack?
Contain the systems that ran the package, but do not erase evidence before you preserve it. A malicious dependency can execute in a developer environment or CI/CD job, where it may be able to read secrets available to that process, host, or workflow. The relevant question is therefore not only which package was affected, but also which credentials were accessible while it ran.
As an Amazon Associate I earn from qualifying purchases.
- Stop further execution. Disable or block the affected package version, pause automatic dependency updates, and stop CI jobs that use it. Quarantine affected hosts where feasible and block known malicious outbound destinations.
- Preserve evidence before cleanup. Export CI/CD logs, lockfiles, package caches, workflow files, relevant disk or endpoint data, and artifacts. Keep an incident record that includes the time actions were taken; destroying these materials can remove clues about what ran and what it accessed.
- Map the affected systems. Identify repositories, developers, runners, builds, artifacts, and deployment environments that used the package. Determine when it was installed or built and whether installation or post-install scripts ran.
- Start the credential inventory. List secrets available to each affected host and job. Include values inherited through environment variables, local files, caches, logs, or infrastructure templates—not only secrets explicitly named in a workflow.
CISA’s May 28, 2026 advisory calls for reviewing CI/CD logs, cloud audit trails, and affected developer machines, and for rotating or revoking secrets accessible to CI/CD pipelines. That scope includes API keys, cloud credentials, SSH keys, registry and infrastructure tokens, source-control tokens, and developer or pipeline secrets. UK NCSC guidance dated June 4, 2026 similarly says to rotate credentials that are exposed or potentially exposed.
How do you determine which credentials may have been exposed?
Build the exposure window from package installation through containment, then map each system the package could have reached. Rotate credentials that were present, accessible to the process, or otherwise plausibly reachable during that window. A lockfile identifies dependency versions, but it does not by itself show which secrets a running build could access.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Trace the package through the build and deployment path
- Check direct and transitive dependencies in lockfiles, manifests, artifact repositories, and package caches. Record the exact package versions and the times they were fetched, installed, or built.
- Review CI/CD logs and workflow files to see which jobs ran the dependency, what environment variables or secret-store values were injected, and which credentials the jobs could request.
- Identify developer machines, runners, repositories, artifacts, and environments involved. A package used in a local development task may have had a different set of secrets available from one used in a production deployment job.
- Check whether the package ran installation or post-install scripts. Record findings without assuming that a package was harmless merely because the application itself was not deployed.
Where the evidence cannot establish that a credential was inaccessible, treat it as potentially exposed and assess it for rotation. CISA’s September 23, 2025 guidance says, “Immediately rotate all developer credentials.” The decision should follow the actual access path and incident scope rather than a guess about what a particular malicious package did.
Prioritize credentials by what they can change
Start with credentials that could write, administer, publish packages, deploy to production, or access broad cloud resources. Those capabilities can let an intruder alter code or infrastructure, publish another malicious version, or use one compromised system to reach others. Include read credentials too when they expose sensitive data or can be used to obtain more powerful credentials.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Which API keys and other credentials should you rotate?
Inventory credential types across cloud, source control, registries, CI/CD, infrastructure, applications, and data stores. The key test is whether a secret was accessible from an affected system—not whether its name happens to contain “API key.”
| System | Credentials and controls to review | Related evidence to inspect |
|---|---|---|
| Cloud and identity | AWS access keys, GCP service-account keys, Azure credentials, workload tokens, and other secrets reachable from the runner | Cloud audit trails, IAM activity, and permission changes |
| Source control | Personal access and fine-grained tokens, GitHub Apps and OAuth credentials, deploy keys, repository and organization secrets, webhooks, and signing credentials | Token creation, permission changes, unexpected repositories, commits, workflow runs, and workflow edits |
| Package registries | npm, PyPI, Docker, and other package read or publish tokens | Package publication history, cached artifacts, and use of known-good versions |
| CI/CD and infrastructure | Pipeline variables, Terraform and Vault tokens, Kubernetes configurations, SSH keys, deployment keys, and secrets injected into ephemeral jobs | CI/CD logs, workflow files, infrastructure templates, and job access |
| Applications and data stores | API keys, database passwords, service credentials, encryption keys, and signing keys | Environment files, images, logs, local files, and infrastructure code that may contain copied values |
Also inspect the places secrets can persist: environment variables, build logs, local configuration, package caches, artifacts, and container or deployment images. The Singapore CSA’s advisory describes a September 2025 campaign in which at least 180 npm packages were infected and warns that supply-chain footholds can expose API keys, access tokens, and SSH keys. The number describes that campaign, not the likelihood that a particular organization was affected.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do you revoke credentials and issue replacements safely?
Revoke the old credential at the provider that issued it, then create a replacement with only the permissions and lifetime the consumer needs. Do not treat deleting a value from a repository or configuration file as revocation: a copied credential may remain usable until its issuer disables it.
Revoke the old access path
- For each potentially exposed credential, record its owner, issuing provider, scope, consumers, and last known use. Prioritize production, administrative, write, deployment, and package-publishing access.
- Revoke or disable the credential through its issuer and record the revocation time. Invalidate sessions where supported. Review for unauthorized OAuth apps, webhooks, deploy keys, token changes, and workflow modifications, and remove those that are not legitimate.
- If the affected CI job was ephemeral, include every secret injected into that run in the assessment. A short-lived runner does not make a long-lived token exposed to it safe.
Create scoped replacements
- Generate fresh credentials with the minimum permissions needed for their specific task. Assign an owner and expiry, and use distinct values for development, CI, staging, and production rather than reusing one secret everywhere.
- Store replacements in the organization’s approved secret manager. Do not put them in source code, package files, shell history, or images.
- Where a provider supports overlapping credentials, use that capability to transition consumers in a controlled order. Confirm current provider behavior and token semantics in that provider’s documentation; they can change.
GitHub’s guidance calls for generating replacement tokens and rotating repository, environment, and organization secrets. That is a reminder to check each level where a value may be stored, not just the individual repository or job where the incident was first noticed.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do you update CI/CD and applications without breaking deployments?
Changing a secret at its issuer is only part of the repair: every consumer must switch to the replacement. Make the change in a controlled build or deployment, and avoid leaving old values in parallel configuration, templates, or artifacts.
- Map consumers to credentials. Find which workflows, deployment manifests, applications, scheduled jobs, registry clients, infrastructure automation, and local developer tools use each secret.
- Update the authoritative secret store. Replace the old value in CI/CD secret variables and other approved stores. Update workload identity bindings and application configuration where relevant.
- Refresh deployed and cached configuration. Check manifests, environment files, images, templates, and artifacts that may still contain the old value. Search repositories, logs, and artifacts for old secrets, and remove stored copies. Do not assume that editing the source file changes an already-built image or deployed workload.
- Run a controlled build and deployment. Use only replacement credentials, and check that the job completes the expected API calls with the intended permissions.
- Confirm the old values fail. Test revocation through the relevant provider or consumer without exposing the secret in logs. If a deployment still depends on an old credential, identify that consumer and correct it rather than restoring the compromised value.
This staged validation applies the replacement-and-update approach in GitHub’s guidance alongside CISA’s emphasis on reaching a known-safe state. Keep the incident record and monitoring active while validating; a successful deployment does not establish that no unauthorized use occurred earlier.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What should you monitor after rotation?
Review activity across the systems that could have been reached, including cloud, identity, source control, package registries, CI/CD, endpoints, and firewalls. Look for suspicious use during the exposure window as well as activity after revocation; rotating a key does not explain what it may already have been used to do.
- Check cloud and identity logs for anomalous access, unexpected permission changes, and activity tied to affected credentials or accounts.
- Inspect source-control repositories, commits, workflow runs, token creation, and permission changes for unauthorized modifications.
- Review registry publication history and package caches for unexpected publishing or altered artifacts.
- On affected developer machines and runners, inspect unexpected child processes, outbound connections, and endpoint alerts.
- Check firewall records for connections to known malicious destinations and continue monitoring after the replacements are in use.
Preserve relevant logs and artifacts as the investigation continues. If monitoring identifies new access paths or credentials that were missed in the first inventory, add them to the rotation and investigation scope.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow can you reduce the chance of a repeat incident?
Make package provenance, secret access, and build permissions easier to verify before the next incident. Prevention does not eliminate the need to rotate potentially exposed credentials, but it can reduce both the number of secrets a compromised dependency can reach and the time needed to respond.
- Use lockfiles and software bills of materials (SBOMs) to identify direct and transitive dependency exposure. Search artifact caches, pin trusted versions, pause unattended updates during an incident, and prefer trusted or private registries.
- For npm, CISA recommends
ignore-scripts=trueandmin-release-age=7where appropriate. These settings are not a substitute for assessing a package that has already run. - Enforce phishing-resistant multifactor authentication on developer and registry accounts. A FIDO2 security key is one implementation.
- Enable branch protection, secret scanning, dependency updates, audit-log streaming, and workflow review.
- Reduce the credentials available to each build and prefer workload identity where it fits the environment. Centralized secret management and workload identity can scale across many services, but require integration and preparation.
Should you rotate credentials manually or use centralized secret management?
The right response method depends on incident size and preparation. For a small incident, provider-by-provider rotation may be the fastest path; across many services, centralized secret management and workload identity can improve coordination, provided they are already integrated and the organization can validate the change.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Approach | When it can fit | Trade-off to plan for |
|---|---|---|
| Manual provider-by-provider rotation | A small incident with a manageable number of credentials and consumers | Can be fast to start, but requires careful tracking of scope, owners, consumers, revocation, and validation across providers |
| Centralized secret management | Many services or teams that already use an integrated secret store | Can make storage and replacement more consistent, but depends on prior integration and correct consumer updates |
| Workload identity | Services that can use identity-based access rather than long-lived stored credentials | Can reduce reliance on static secrets, but requires environment-specific setup and testing |
Compare approaches by exposure coverage, revocation speed, blast radius, least-privilege support, auditability, secret-storage integration, CI/CD compatibility, monitoring quality, and whether the provider supports a safe transition between old and new credentials. Do not choose an approach solely because it centralizes storage: if a compromised job can still request broad credentials, the access path remains consequential.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What recent incidents show about the scale of package compromise
Campaign figures help explain why dependency exposure deserves a broad inventory, but they do not prove that a particular package or organization was compromised. CISA identified two malicious Axios versions—[email protected] and [email protected]—on March 31, 2026. CISA also reported over 500 npm packages compromised in 2025; the Singapore CSA later described at least 180 infected npm packages in a September 2025 campaign. These are separate incident figures and should not be combined into a single count.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe practical implication is to establish the exact package version and exposure window in your own environment, then trace the credentials reachable from affected builds and machines. There is no universal credential-rotation interval in the cited authority guidance: CISA, UK NCSC, and the other cited recommendations call for prompt rotation when credentials were or could have been exposed.
Frequently Asked Questions
How long does it take for a revoked API key to stop working?
That depends on the issuing provider and credential type; the cited guidance does not establish a universal revocation delay. Check the provider’s current documentation and verify that the old credential is rejected before treating the transition as complete.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Should I rotate credentials if the package was installed but I do not see suspicious activity?
Absence of an alert is not proof that a credential was inaccessible or unused. Base the decision on the package’s execution window and the secrets available to the affected host or job, and treat uncertain access as potential exposure.
Can rotating a secret undo data or code accessed before revocation?
No. Rotation limits future use of the old credential; it does not reverse earlier actions. Review audit trails and repositories for unauthorized access or changes, and investigate any activity that occurred before revocation.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Do I need to rotate credentials in an artifact or image that was never deployed?
Assess whether the credential was present in the artifact and whether anyone or any process could access it. An unpublished or undeployed artifact may still be available in a cache or repository, so check storage and access before concluding it was isolated.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
