Supply chain attacks compromise a dependency, action, or base image that a pipeline pulls in, and the malicious code then runs inside the build with access to credentials, network egress, and the filesystem. Recent incidents like the litellm compromise are examples of this.

Existing controls are static, dependency and image scanning catch known-bad artifacts before execution, but not a package that scans clean and behaves maliciously at runtime. Today there is no way to tell whether a build contacted an unexpected host or read files outside its scope.