Respond to a compromised dependency in the release chain.

Instruction: Prioritize containment, artifact investigation and safe rebuilding.

Context:

A fictional dependency maintainer reports a compromised release. Your lockfile includes that version. Production runs an artifact built yesterday; build logs show the dependency install step had access to a package registry token but no production database credentials. You do not yet know whether malicious code executed.

Updated

Official answer available

Read the opening below, then unlock the full answer and practical guidance.

I would stop promotion of affected artifacts, identify every build that used the compromised version and involve the security owner...

Upgrade to view official answer

Related Questions