Two Supply Chain Attacks in Two Weeks - Why Defense-in-Depth Saved Me

Two supply chain attacks hit my CI/CD pipeline in under two weeks. Neither caused damage. Here's why, and what I hardened afterward. The trend no one can ignore In late March 2026, the aquasecurity/trivy-action GitHub Action was compromised via tag poisoning. A mutable version tag was silently redirected to a malicious commit. Less than two weeks later, a threat actor compromised an axios npm maintainer's account and published two backdoored versions ( 1.14.1 and 0.30.4 ) containing a hidden postinstall script that phoned home to a command-and-control server. Microsoft published a detailed technical analysis of the axios attack. Two different attack vectors. Two different ecosystems. Same target: CI/CD pipelines. This isn't a coincidence. Attackers are actively targeting build infrastructure because that's where the secrets live, where the deployments happen, and where a single compromised dependency can cascade into production. If your CI/CD pipeline isn't hardened against this class