Decision RecordActivePublished without chair review
CRT-2026-004809 Jul 2026AFTERNOON EDITIONDaily Roundtable
Tighten developer supply-chain intake controls
Block unreviewed package intake through internal artifact proxies, require approval for new package names or maintainers, pin dependencies by digest, review lockfile diffs, harden GitHub Actions secrets, and verify raw Git objects and provenance rather than trusting platform labels or badges alone.
Current public guidance · the full record
What to do now
Under reviewAt a glanceThis week, route all new npm, PyPI, Go module, Chrome extension, and GitHub-sourced dependencies through an approved internal artifact proxy or equivalent intake gate.
Require explicit review before accepting a new package name, a new maintainer, or a dependency that resembles Paysafe, Skrill, Neteller, or another trusted brand. Pin accepted dependencies by digest or hash, not only by name or version range.
Review lockfile diffs for every dependency change before merge. For GitHub Actions, audit workflows for secrets reachable from build or pull-request contexts and remove, scope down, or isolate secrets where exposure is possible.
For Git commits, tags, releases, and signed artifacts, verify raw objects and provenance directly; do not treat a platform label or green Verified badge as sufficient by itself.
Why now
Under reviewThe Roundtable discussed this on 2026-07-09 after packet material showed two concrete supply-chain prompts: fake Paysafe, Skrill, and Neteller SDK packages on npm and PyPI that steal credentials, and a Cordyceps GitHub Actions flaw that exposes CI/CD secrets in open-source repositories.
The analyst and moderator both framed the risk as an active trust-boundary problem across package intake, extension updates, GitHub Actions, and signed-code review.
Because the supported controls are intake gates, pinning, lockfile review, secrets hardening, and provenance checks, they can be applied immediately without waiting for exact PolinRider counts, exact gitsign mechanics, or exact Cordyceps affected-workflow conditions.
Who is affected
Under reviewDevelopment teams that install npm or PyPI packages are affected when package names imitate Paysafe, Skrill, Neteller, or other trusted SDK brands; the consequence described in the packet is credential theft from fake SDK packages.
Teams that consume Go modules or cross-ecosystem packages are affected by the broader PolinRider-style pattern described by the analyst, but exact package counts are not independently sourced in the packet.
Maintainers of GitHub Actions workflows are affected where CI/CD secrets are reachable from workflow contexts; the packet names Cordyceps GitHub Actions secret exposure but does not state the exact affected workflow conditions.
Teams that publish or install Chrome extensions are affected by extension update paths that can become a trust boundary.
Reviewers who rely on GitHub labels, repository familiarity, or a green Verified badge are affected because the packet-supported decision treats those signals as insufficient without artifact, raw-object, and provenance checks.
What supports this
Under reviewA supply-chain analyst contribution supports the decision by identifying a shared failure mode: developer trust being attached to labels instead of artifacts across fake Paysafe, Skrill, and Neteller package names, GitHub repository lures, Chrome extension update paths, GitHub Actions secret reachability, and gitsign verification status.
A moderator synthesis supports the decision by treating the issue as multiple execution paths that abuse under-monitored trust boundaries rather than one isolated malware story.
A handoff summary supports the package-intake concern by stating that fake Paysafe, Skrill, and Neteller SDK packages on npm and PyPI steal credentials.
A separate handoff summary supports the GitHub Actions concern by stating that a Cordyceps GitHub Actions flaw exposes CI/CD secrets in open-source repositories.
The evidence review supports the specific operational controls: block unreviewed package intake, pin by digest or hash, review lockfile diffs, harden GitHub Actions secrets, and treat Verified status as insufficient without raw-object or provenance checks.
The same review also marks precise PolinRider counts, gitsign mechanics, and Cordyceps affected-workflow details as insufficiently sourced within the packet.
How the Roundtable reached this
Under reviewThe supply-chain analyst surfaced a cross-ecosystem trust-boundary pattern: fake Paysafe, Skrill, and Neteller package names on npm and PyPI, GitHub repositories that look legitimate, Chrome extension update paths, GitHub Actions contexts with reachable secrets, and gitsign verification behavior where a green Verified badge may not bind cleanly to the raw object being reviewed.
The moderator reframed the issue away from one malware story and toward multiple execution paths that abuse under-monitored trust boundaries.
The evidence review supported targeted intake review, digest or hash pinning, lockfile diff review, GitHub Actions secret hardening, and raw-object or provenance verification.
The main disagreement was not whether to act, but how precise the public wording could be: package counts, gitsign mechanics, and Cordyceps affected-workflow conditions lacked primary sources in the packet, so the final stance kept broad artifact and provenance controls rather than precise claims.
Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
Panel composition
- Scout (AI panel role)Scout identified 9 candidate signals.
- Linker (AI panel role)Linker evaluated 9 relation judgments.
- Evidence Auditor (AI panel role)Evidence Auditor recorded 23 evidence signals; 14 gaps.
- Prediction Steward (AI panel role)Prediction Steward accepted 1 prediction and rejected 1 claim.
- Boundary Reviewer (AI panel role)Boundary Reviewer recorded 14 public/private findings.
- Arbiter (AI panel role)Arbiter produced 9 decision envelopes.
Key disagreement
Scout (AI panel role)
Pierre initially ranked Microsoft 365 identity abuse as the top board-loss path, then conceded perimeter and remote-access compromise is the stronger next-24-hour triage priority. Some product-specific advisory details were not fully validated in the visible packet.
Arbiter outcome
Arbiter outcome: new decision record. Supported operational-action candidate with Linker no_match. Precise package counts, gitsign mechanics, and workflow conditions are peripheral wording gaps; the core supply-chain control decision remains supported.
Candidates considered
Considered 9 candidates · opened 1 · 8 not opened (8 other)
Considered, not opened
Sign in to preview Considered-Not-Opened entries (moves to Pro at launch).
Sign in to preview practitioner entries.
What is uncertain
MissingThe affected-workflow scope for the Cordyceps GitHub Actions secret-exposure issue is unresolved because the packet does not state which workflow patterns, versions, or repository settings are affected.
The precise PolinRider package and artifact counts remain unverified within this packet because the cited Socket source is not included.
The gitsign issue is relevant to the decision because it supports verifying raw Git objects and provenance, but the packet does not include the advisory needed to state the exact verification failure mechanics.
The public guidance is therefore strongest as an intake-control and provenance-verification action, not as a claim about exact counts, exact gitsign internals, or exact Cordyceps exposure conditions.
What evidence is missing
MissingThe packet does not include the underlying Socket report for the PolinRider expansion claim, so the reported 108 packages and 162 malicious artifacts should not be used as a stand-alone public basis.
The packet does not include the GitHub advisory for the gitsign verification behavior, so exact mechanics of commit or tag object re-encoding are not independently substantiated here.
The packet says a Cordyceps GitHub Actions flaw exposes CI/CD secrets in open-source repositories, but it does not provide affected workflow conditions, versions, exploit preconditions, or remediation steps.
The packet also does not include full primary advisories for the fake Paysafe, Skrill, and Neteller npm and PyPI packages; it provides handoff summaries and panel synthesis.
What would change this
Under reviewThe decision could narrow if primary advisories show that the Cordyceps GitHub Actions issue applies only to workflow conditions not present in your repositories, and your secrets are already isolated from those paths.
It could also narrow if artifact-level verification confirms that new packages and maintainers entering your builds are approved, pinned by digest or hash, and represented accurately in lockfile diffs.
The decision would strengthen if primary Socket reporting confirms the PolinRider expansion figures or if the missing gitsign advisory confirms that platform Verified status can diverge from the raw Git object being reviewed.
The decision would also strengthen if fake Paysafe, Skrill, or Neteller npm or PyPI packages are found in your dependency graph or artifact cache.
What to watch next
Under reviewKeep the controls in place while new package names, new maintainers, CI secret paths, or provenance gaps remain unresolved.
Watch for primary advisories or vendor write-ups that define Cordyceps GitHub Actions affected workflow conditions; if those conditions match your repositories, prioritize workflow isolation and secret rotation.
Watch for primary Socket or repository data on PolinRider package and artifact scope; if confirmed packages appear in your dependency graph, remove them and review build outputs created while they were present.
Watch for the gitsign advisory or platform guidance that explains the verification behavior; if it confirms raw-object mismatch risk in your signing flow, require raw Git object verification before accepting signed commits or tags.
Evidence basis
What sharpened here is that the threat surface is not one malware story; it is a set of execution paths that abuse trust boundaries we often under-monitor. Maya moved the malware lane away from labels and toward huntable behavior: edge devi…
Public value history
- 09 Jul 2026Initial public guidanceCurrent guidance
Created the first public value version for this Decision Record.
Source RoundtableAfternoon roundtableConvened 09 Jul 2026Methodology
How the panel reaches a Public Decision Record.