iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume every secret available to the compromised package may have been exposed. Stop or isolate affected builds and developer machines, preserve logs and package artifacts, identify the package versions and exposure window, then inventory all reachable credentials. Revoke or disable the old values, issue least-privilege replacements, update every consumer, verify that the new values work and the old ones fail, and continue hunting for abuse.
This approach applies to malicious npm or PyPI packages as well as compromised dependencies in container builds, CI/CD runners, workstations and deployment systems. CISA’s May 28, 2026 guidance specifically calls for rotating or revoking every secret accessible to affected pipelines, not just the API key that first raised suspicion.
What should I do first after a package supply-chain compromise?
Contain execution and preserve evidence before changing systems. Rotation without containment can let an attacker keep collecting newly issued credentials, while wiping hosts or caches can destroy the clues needed to determine what was accessed.
- Disable the affected package version. Remove it from build inputs, pin a known-good version, and pause unattended dependency updates. Stop CI jobs that install or execute the package.
- Isolate likely-exposed systems. Quarantine developer workstations, runners and build hosts where practical. Restrict known malicious outbound destinations, but avoid broad network changes that erase useful telemetry.
- Preserve evidence. Export CI/CD logs, cloud audit trails, endpoint or disk data, lockfiles, workflow files, package caches, artifact metadata and relevant environment details before cleanup. Record timestamps and the person who collected each item.
- Open an incident timeline. Record when the package was installed, built and removed; which repositories, runners, developers, artifacts and environments were involved; and when each credential was revoked or replaced.
Do not assume that a package with no obvious data theft is harmless. Install and post-install scripts can run with the permissions of the build or developer account, and a foothold can read environment variables, local files, caches and credentials used by later steps.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I define the exposure window?
The exposure window starts with the earliest installation or execution of the suspect package and ends only when affected systems are rebuilt or verified clean. Use both package metadata and operational logs to establish it.
Build a package timeline
- Identify every direct and transitive dependency version from lockfiles, manifests and SBOMs.
- Check package-manager, artifact-repository and container-cache records for downloads, installs and publishes.
- Determine whether install, pre-install or post-install scripts ran, and under which user or service account.
- Map each affected commit, workflow run, runner image, developer machine, artifact and deployment.
Correlate identity and cloud activity
Match the package timeline against source-control audit events, CI/CD job logs, cloud audit trails, registry access, endpoint process records and firewall or proxy logs. Look for credential creation, permission changes, unusual API calls, new OAuth applications, unexpected workflow edits and outbound connections. If exact start or end times cannot be proven, use the broader defensible interval rather than narrowing the rotation scope.
Which API keys and credentials should I rotate?
Rotate every credential the package, its process, the runner or the developer account could read. The following inventory covers the classes called out by CISA, the UK National Cyber Security Centre and Singapore’s Cyber Security Agency.
| System | Credentials to inventory | Evidence and follow-up |
|---|---|---|
| Cloud and identity | AWS access keys, GCP service-account keys, Azure credentials, workload-identity tokens and other cloud secrets available to the runner | Review IAM activity, token use, role assumptions and permission changes; reduce excessive permissions. |
| Source control | Personal or fine-grained access tokens, GitHub Apps and OAuth credentials, deploy keys, repository and organization secrets, webhooks and signing credentials | Audit token creation, scope changes, repository access, workflow edits and unauthorized applications. |
| Package registries | npm, PyPI, Docker and other read or publish tokens | Check package publication history, downloads, ownership changes and cached artifacts; pin a trusted version. |
| CI/CD and infrastructure | Pipeline variables, Terraform and Vault tokens, Kubernetes configurations, SSH keys, deployment keys and secrets injected into ephemeral jobs | Review every job that received the secret, including jobs that failed or were canceled. |
| Applications and data stores | API keys, database passwords, service credentials, encryption keys and signing keys | Search environment files, images, logs, infrastructure templates and application configuration for copies. |
Include secrets stored outside a formal vault: shell history, local dotfiles, build logs, package caches, container layers, crash dumps and generated infrastructure plans. A token that was never committed can still be compromised if a malicious process could read the environment or filesystem.
In what order should I revoke credentials?
Prioritize credentials that let an intruder change systems or expand access. Revocation should happen at the issuing provider, and the exact revocation time belongs in the incident record.
- Production and administrative access. Revoke cloud administrator keys, production deployment credentials, registry-publish tokens and identities with write, billing or security-policy permissions.
- Credentials that can create other credentials. Disable identity-management keys, GitHub Apps, OAuth applications, service-account impersonation rights and secrets-management tokens.
- Source-control and pipeline access. Revoke personal access tokens, deploy keys, repository and organization secrets, CI variables and webhook credentials.
- Registry and artifact access. Rotate npm, PyPI, Docker and private-registry read or publish tokens, then inspect publication and download history.
- Developer and lower-environment credentials. Rotate local API keys, SSH keys, database passwords and development secrets after higher-risk identities are contained.
Invalidate active sessions where the provider supports it. Remove unauthorized OAuth apps, webhooks, deploy keys, workflow changes and access grants; changing a token alone does not undo those persistence mechanisms.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do I issue replacement credentials safely?
Generate replacements only after containment, and make each value narrower and easier to attribute than the one it replaces.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Use a new owner, purpose, environment and expiration date for every credential.
- Grant the minimum actions and resources required. Separate development, CI, staging and production values instead of reusing one secret.
- Prefer short-lived workload identity or expiring tokens where the provider supports them.
- Store values in the approved secret manager or CI secret store, never in source code, package files, shell history, container images or plaintext tickets.
- Document which application, job or person consumes each value and who is responsible for its next rotation.
For systems that support two active keys, create the replacement first, deploy it, verify it, and then revoke the old key. If a provider offers no overlap period, schedule a controlled maintenance window and keep a tested rollback plan that does not reactivate the compromised value.
How can I rotate secrets in GitHub Actions without breaking deployments?
Treat every secret injected into an affected workflow run as exposed, including secrets used by steps that did not appear related to the malicious package. GitHub’s incident guidance calls for generating replacement tokens and rotating repository, environment and organization secrets.
- Pause affected workflows and disable automatic dependency updates while investigating.
- At the organization, repository and environment levels, replace cloud credentials, registry tokens, signing keys, deployment keys and API keys that the workflow could access.
- Update reusable workflows, environment protections, deployment manifests and external systems that consume those values.
- Review workflow files for unauthorized steps, altered actions, new downloads, encoded commands or unexpected outbound requests. Compare them with a known-good revision.
- Run a controlled build from a clean runner using only replacement secrets. Confirm the expected deployment and API calls, then verify that the revoked values fail.
- Search logs, artifacts, caches and pull requests for the old values and remove any copies. Rotate again if a value appears in output or a generated artifact.
Do not rely on masking alone. Masking can prevent display in logs but does not stop a malicious process from sending a secret to an external service.
What changes for cloud credentials and SSH keys?
Cloud and host credentials deserve separate review because one compromised runner can often reach more than the package’s immediate application.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCloud identities
Rotate AWS access keys, GCP service-account keys, Azure credentials and workload tokens available to the affected process. Examine role assumptions, access-key use, storage reads, security-group changes, new users, policy edits and unusual regions or source addresses. Remove permissions that the workload did not need, and replace long-lived keys with workload identity or short-lived credentials where practical.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
SSH and deployment keys
Replace SSH keys used by developers, runners, deployment systems and automation. Check authorized-key files, bastion hosts, CI variables, machine images and configuration management for copies. Review login records and command history for unexpected access, and disable the old public keys at every host or service that trusted them.
Secrets-management and infrastructure tokens
Rotate Terraform, Vault and Kubernetes credentials, including tokens embedded in state files, kubeconfig files, Helm values, manifests and pipeline variables. A new application secret is insufficient if an attacker can still use an old infrastructure token to read or rewrite it.
How should I handle npm, PyPI and container registries?
Registry credentials can enable both data theft and a second supply-chain event through unauthorized publication. Rotate read and publish tokens, then verify package and artifact integrity.
- Inspect npm, PyPI, Docker and private-registry publication history for unexpected versions, maintainers, tags or upload locations.
- Invalidate tokens used by the compromised developer account, runner or build service, including read-only tokens if they could expose private packages.
- Search local and shared caches for the malicious package and remove it from future builds after preserving a forensic copy.
- Pin a known-good dependency version and regenerate lockfiles from a trusted environment.
- Compare downloaded artifacts with trusted checksums or signatures where available, and rebuild images rather than reusing layers produced on an exposed host.
CISA identified more than 500 compromised npm packages in 2025. In a March 31, 2026 advisory, it identified malicious axios@1.14.1 and axios@0.30.4; those examples illustrate why exact package versions and lockfiles matter during triage.
How do I validate that rotation worked?
Validation has two independent goals: prove that the replacement supports the required function and prove that the old credential no longer works.
- Rebuild on a clean, isolated runner or workstation with the trusted dependency version.
- Exercise a harmless API call or deployment path that represents the real workload.
- Check provider audit logs for the expected identity, scope, source and operation.
- Attempt a controlled request with the revoked credential from an approved test context; it should be rejected. Never test by restoring the old value to production.
- Inspect the resulting logs and artifacts for accidental secret disclosure.
Keep evidence of successful replacement, failed use of the old credential and the systems tested. If a replacement fails, fix the consumer or permission scope rather than re-enabling the compromised secret.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should I hunt for after rotating the keys?
Credential rotation limits future access; it does not reveal what happened before revocation. Continue monitoring source control, identity, cloud, registry, CI/CD, endpoint and firewall data.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Search for unusual API calls, data reads, role assumptions, login locations, child processes and outbound destinations.
- Inspect unexpected repositories, commits, workflow runs, releases, package publications, webhooks, OAuth applications and deploy keys.
- Look for newly created users, access policies, scheduled jobs, persistence scripts or modified runner images.
- Compare artifact hashes and dependency trees with known-good builds.
- Continue heightened monitoring after rotation because attackers may test old credentials, use stolen data or return through a separate account.
Correlate events by credential owner and source system. A single anomalous request may be benign; the same identity creating a token, changing a workflow and publishing a package is a stronger incident signal.
Which prevention controls reduce the next rotation effort?
Prevention is less about one product than about reducing what a dependency can see and how quickly access can be revoked.
- Maintain lockfiles and software bills of materials so direct and transitive exposure can be identified quickly.
- Use trusted or private registries, pin known-good versions and pause unattended updates when a campaign is active.
- For npm workloads where appropriate, set
ignore-scripts=trueandmin-release-age=7to reduce automatic execution and newly published-package exposure. Test these settings against packages that legitimately require install scripts. - Require phishing-resistant multifactor authentication, such as a FIDO2 security key, for developer, source-control and registry accounts.
- Enable branch protection, secret scanning, dependency-update controls, audit-log streaming and mandatory workflow review.
- Use separate identities and secret stores for development, CI, staging and production, with short expirations and documented owners.
- Test revocation and replacement procedures before an emergency, including clean-runner rebuilds and rollback that does not reuse exposed values.
Should I rotate everything manually or use centralized secret management?
The right choice depends on the number of systems, how quickly providers can revoke credentials and whether your organization already has integrations in place.
| Approach | Where it fits | Trade-offs |
|---|---|---|
| Manual provider-by-provider rotation | Small incidents with few accounts and services | Can start quickly, but is easier to miss, harder to audit and more labor-intensive as environments grow. |
| Centralized secret management | Organizations with many applications, runners and environments | Improves ownership, auditability, expiration and coordinated updates, but requires preparation and integration before an incident. |
| Workload identity and short-lived tokens | Cloud and automation workloads that support federated identity | Reduces the value of stolen long-lived keys, but depends on correctly scoped trust policies and reliable deployment configuration. |
Evaluate exposure coverage, revocation speed, blast radius, least-privilege support, dual-key or rollback capability, auditability, secret-store integration, CI/CD compatibility and monitoring quality. A hybrid response is common: revoke high-risk keys directly, then use centralized systems to propagate replacements and enforce expiration.
Recommended Free Tools
How often should credentials be rotated after the incident?
There is no universal interval in the cited guidance. CISA, the UK NCSC and Singapore’s CSA consistently require immediate rotation when credentials were exposed or could have been exposed; routine schedules should be set by credential type, privilege, lifetime and provider capability after containment.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Keep the incident-specific replacement separate from normal rotation. Record the exposure, revocation and replacement times, then assign each new credential an owner and expiry so it does not become an untracked long-lived secret.
What does the scale of recent package compromises imply?
Recent campaigns show why a package-level alert can require organization-wide credential review. CISA reported more than 500 compromised npm packages in 2025. Singapore’s CSA described a September 2025 campaign involving at least 180 npm packages. Those figures do not prove that any particular account or package in your environment was compromised, but they justify checking transitive dependencies, shared runners and cached artifacts rather than investigating only the application named in an alert.
Frequently Asked Questions
Can I rotate only the API key that appeared in the package alert?
No. Scope rotation to every credential the package process, runner or developer account could read, including tokens in environment variables, files, caches and CI logs. A malicious dependency may never use the first key you notice while silently collecting others.
Should I wipe an infected runner immediately?
Isolate it first and preserve logs, lockfiles, caches, workflow files and relevant endpoint data. Rebuild from a clean image after evidence collection; wiping before capture can remove the process and network history needed to identify additional exposed credentials.
What if revoking a token breaks a production service?
Create a least-privilege replacement and deploy it through a controlled change before disabling the old value when the provider supports overlapping keys. If overlap is unavailable, use a maintenance window, validate the replacement in a safe environment and keep the compromised value disabled rather than restoring it as a workaround.
Do read-only registry tokens need rotation?
Yes, if they could access private packages, metadata or artifacts from an exposed process. Read access can reveal proprietary code and dependency information, and the same account may hold publish or broader permissions that are not obvious from one workflow.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
