Poisoned Pipeline / Incidents / AS288
kilocode npm early supply-chain risk signals
StepSecurity detected early supply-chain risk signals in a legitimate
kilocode npm release: small behavior changes that quietly weaken trust
before any attack happens. No exploitation observed — recorded as
research showing the pre-attack end of the kill chain (the same
weak-trust state attacks like AS66/AS74 exploit).
Mapped techniques
- T0176 Disable or misconfigure security measures
supply-chain behavior drift
Behavior changes that weaken trust before an attack.