Decision RecordActivePublished without chair review
CRT-2026-002604 Jul 2026MORNING EDITIONDaily Roundtable
Use scoped supply-chain change control instead of a blanket engineering freeze
Do not freeze all engineering. Temporarily gate new npm or Composer dependencies, risky dependency upgrades, GitHub Actions workflow edits, Composer tag consumption, CI jobs executing third-party install scripts, package-publishing tokens, and suspicious dependency installs.
Current public guidance · the full record
What to do now
Under reviewAt a glanceDo not freeze all engineering.
Immediately require approval for supply-chain trust-boundary changes: adding new npm dependencies, adding new Composer dependencies, dependency upgrades that change maintainer or install-script risk, GitHub Actions workflow edits, Composer tag pulls, CI jobs that run third-party install scripts or third-party actions, and package-publishing token changes.
Review recent CI and package activity for those same categories. Rotate package-publishing tokens and related CI secrets where suspicious installs, suspicious dependency upgrades, or suspicious workflow changes occurred.
Keep campaign names and attribution out of operational criteria unless primary package or campaign evidence is added; use observable changes in npm, Composer, GitHub Actions, CI execution, and token exposure as the trigger.
Why now
Under reviewOn 2026-07-04, the packet presented a dense set of software supply-chain signals in the same operational lane: North Korea-linked npm packages mimicking Rollup polyfills to steal developer secrets, Shadow Code malicious NPM packages targeting developers, GhostAction GitHub Actions workflow compromise, IronWorm npm supply-chain activity targeting Arweave and WeaveDB developers, and Megalodon GitHub Actions intrusion compromising Laravel-Lang Composer packages.
That density supports a temporary gate around trust-boundary changes now. It does not support a blanket engineering freeze because the cited support is about specific trust boundaries, not all engineering work.
Who is affected
Under reviewDeveloper teams adding or upgrading npm dependencies are affected because the packet reports North Korea-linked npm packages mimicking Rollup polyfills to steal developer secrets, Shadow Code malicious NPM packages targeting developers, and IronWorm npm supply-chain activity targeting Arweave and WeaveDB developers.
Developer teams adding or upgrading Composer dependencies are affected because the selected control includes Composer dependencies and Composer tag consumption, and the packet reports Megalodon GitHub Actions intrusion compromising Laravel-Lang Composer packages.
Repository owners and platform teams changing GitHub Actions workflows are affected because GhostAction is described as a GitHub Actions workflow compromise campaign and Megalodon is described as a GitHub Actions intrusion.
CI/CD operators are affected when jobs execute third-party install scripts, third-party actions, npm package code, or Composer package code, because the selected control treats those execution paths as trust-boundary crossings.
Owners of package-publishing tokens and CI secrets are affected because the roundtable focused on developer-secret theft, package-publishing token risk, and token rotation after suspicious installs or workflow changes.
What supports this
Under reviewThe supply-chain analyst’s interaction supports the action by explicitly saying today does not justify a blanket engineering freeze and does justify a scoped freeze on new npm packages, dependency upgrades, GitHub Actions workflow edits, Composer tag consumption, and CI jobs executing install scripts or third-party actions.
The moderator’s interaction supports the action by restating the narrower response: gate new npm and Composer dependencies, dependency upgrades that change maintainer or install-script risk, GitHub Actions workflow edits, and CI paths that execute third-party code.
The final synthesis supports the principle behind the action by saying the panel consensus was not to “patch everything,” but to contain and invalidate trust where exploitation or token theft is plausible.
The handoff summary for North Korea-linked npm packages supports the npm and developer-secret part of the scope by reporting packages mimicking Rollup polyfills to steal developer secrets.
The Shadow Code handoff summary supports the developer-targeted npm portion by reporting malicious NPM packages targeting developers.
The GhostAction handoff summary supports the GitHub Actions portion by reporting a GitHub Actions workflow compromise campaign.
The IronWorm handoff summary supports the npm supply-chain portion by reporting an npm supply-chain worm targeting Arweave and WeaveDB developers.
The Megalodon handoff summary supports the Composer and GitHub Actions portion by reporting a GitHub Actions intrusion compromising Laravel-Lang Composer packages.
The evidence auditor supports the scoped operational decision and separately flags that named campaign details should not be expanded into package/version or blast-radius claims without stronger sources.
How the Roundtable reached this
Under reviewThe supply-chain analyst rejected a blanket engineering freeze and narrowed the response to a scoped freeze on trust-boundary changes: new npm packages, dependency upgrades, GitHub Actions workflow edits, Composer tag consumption, and CI jobs that execute install scripts or third-party actions.
The moderator accepted that separation between “move immediately” and “do not overreact,” adding Composer dependencies, dependency upgrades that alter maintainer or install-script risk, GitHub Actions workflow edits, and CI paths that execute third-party code.
The evidence auditor supported the scoped gate, while marking GhostAction, IronWorm, Megalodon, and North Korea-linked attribution as contextual because the packet lacks primary package artifacts, affected package/version details, authoritative campaign reports, and stronger attribution corroboration.
The arbiter selected the operational-action record with that boundary: use scoped supply-chain change control, not a blanket freeze.
What is uncertain
MissingThe strongest uncertainty is scope detail, not whether to gate.
The packet supports gating npm, Composer, GitHub Actions, CI third-party code execution, and package-publishing tokens, but it does not prove which specific package versions or repositories are affected.
GhostAction, IronWorm, and Megalodon are present as packet-described examples, not as fully evidenced package-level cases. North Korea-linked activity is usable as reported context with moderate attribution confidence, but not as a definitive attribution basis for the operational control.
What evidence is missing
MissingThe packet does not include primary npm package artifacts, Composer package artifacts, affected package names, affected versions, install-script samples, workflow files, registry telemetry, or authoritative campaign reports for GhostAction, IronWorm, or Megalodon.
It also does not include corroborating attribution sources strong enough to turn North Korea-linked crypto theft, malicious npm packages, Drift, KelpDAO, and developer-targeting npm activity into one confirmed campaign claim.
Those gaps do not block the scoped gate, but they do block public claims about exact package blast radius, exact affected versions, or definitive actor attribution.
What would change this
Under reviewEscalate from a scoped gate toward a broader engineering freeze only if evidence shows widespread execution of malicious dependency code across many repositories, active compromise of shared CI infrastructure, or repeated unauthorized package-publishing token use that cannot be contained repository by repository.
Narrow the gate if reviews show no suspicious installs, no risky dependency upgrades, no unauthorized GitHub Actions workflow edits, no suspicious Composer tag pulls, and no exposed package-publishing tokens.
Strengthen public attribution only if corroborating sources support more than the current reported or moderate North Korea-linked framing.
What to watch next
Under reviewWatch for proof of what code ran where: CI job logs that executed third-party install scripts or third-party actions, GitHub Actions workflow edits, npm and Composer dependency additions, Composer tag pulls, package-publishing token use, and SBOM deltas.
If those reviews find suspicious installs or workflow changes, rotate affected package-publishing tokens and CI secrets.
If authoritative package reports or primary artifacts identify specific npm packages, Composer packages, versions, repositories, or compromised workflows, replace the broad trust-boundary gate with targeted blocks, removals, and token rotations for those named items.
Evidence basis
The room now has a cleaner separation between “move immediately” and “do not overreact.” Tomas narrowed the supply-chain response from a broad engineering freeze to a scoped freeze around trust-boundary changes: new npm and Composer depende…
No, Halil — today does **not** justify a blanket engineering freeze. It does justify a **scoped freeze on trust-boundary changes**: new npm packages, dependency upgrades, GitHub Actions workflow edits, Composer tag consumption, and any CI j…
Summary: This is a busy, high-pressure morning, but the panel’s consensus is not “patch everything”; it is “contain and invalidate trust first where exploitation or token theft is plausible.” Exposed Citrix NetScaler, Oracle PeopleSoft, Cis…
Public value history
- 04 Jul 2026Initial public guidanceCurrent guidance
Created the first public value version for this Decision Record.
Source RoundtableMorning roundtableConvened 04 Jul 2026Methodology
How the panel reaches a Public Decision Record.