Pipeline security lessons from March supply chain incidents

Between March 19–31, 2026, four supply chain attacks compromised Trivy, Checkmarx KICS, LiteLLM, and axios — all targeting CI/CD pipelines as the attack surface. Three attack patterns emerged: poisoned tools/actions, packaging misconfigurations leaking IP, and vulnerabilities in transitive dependencies. GitLab Pipeline Execution Policies (PEPs) can address each pattern by injecting mandatory, unskippable jobs into every pipeline. Three ready-to-use open-source policies are provided: Artifact Hygiene (blocks source map leaks and oversized packages), Dependency Integrity (detects lockfile tampering and blocked package versions), and Tool Integrity (enforces an approved image allowlist). Recommendations include pinning dependencies to checksums, running pre-execution integrity checks, auditing published artifacts, detecting dependency drift, and centralizing policy management.