Poisoned Pipeline / Home
Poisoned Pipeline
A catalogue of software supply-chain incidents: 333 documented cases, 117 techniques, and the ecosystems they hit.
Incidents per year
Hover a bar for the count. 2025–2026 is the worm/ATO wave (Shai-Hulud and descendants); the pre-2020 bars are the classic vendor-updater era.
Most-used techniques
By number of incidents mapping to each technique. Full list in the technique matrix.
Incidents per platform
Grouped lists per ecosystem in Platforms.
Eras
The 2025–2026 wave is roughly one incident every three days per StepSecurity's tracking.
Frequently seen in write-ups
Actor / malware names appearing most often across incident summaries.
Browse
Technique matrix — techniques × tactics, heat-mapped by incident count
CI/CD matrix — Mercari's pipeline matrix, with the incidents that actually do that
Incident mapping — every incident → techniques
Platforms — all incidents for npm, PyPI, GitHub Actions, …
Attack stories — chronological list
Project
Guidance mapping — OWASP / NIST / SLSA / CISA
Origins — where each technique came from
Conference talks — supply-chain and AI talks, mapped or gapped
Sources — the watch list this catalogue tracks
Changelog — what changed, and when