Google Warns: Attackers Are Targeting Your Software Build Pipelines

Google Threat Intelligence has flagged a significant shift in software supply chain attacks, with threat actors now systematically targeting the engineering lifecycle itself rather than just individual software products. Attackers are compromising trusted security scanners, utility libraries, and AI developer tools to abuse the elevated privileges these systems hold within build pipelines.

The research also highlights attacks on developer workstations and coding environments, using tailored social engineering, malicious extensions, or typosquatted dependencies to steal private cryptographic keys, API tokens, and active session credentials. Beyond stealing static credentials, attackers are now using advanced techniques such as GitHub Actions cache poisoning, OIDC token extraction, and manipulation of mutable action tags. This allows them to publish compromised software packages that still appear to carry legitimate, trusted cryptographic proof of origin.

Google notes that treating each stage of a build pipeline as a separate, isolated security concern is no longer enough, since these attacks span multiple stages at once. The guidance calls for a defense-in-depth approach covering the entire software development lifecycle, though full details of the five core security pillars were not included in this excerpt.