Living Off the Pipeline: Defending Against CI/CD Subversion

The software supply chain has become one of the most attractive targets for modern adversaries, but the attacks seen in 2025 did not focus solely on poisoning dependencies or hijacking packages. Increasingly, attackers are targeting the infrastructure that powers the software delivery lifecycle itself. Build servers, CI/CD runners, package managers, and developer workstations all sit inside an organization’s trusted delivery path.