How Harden Runner Detected the Sha1-Hulud Supply Chain Attack in CNCF's Backstage Repository

During 23–24 November 2025, the npm ecosystem suffered a major supply chain attack dubbed Sha1-Hulud: The Second Coming, compromising over 780 npm packages including those from Zapier, ENS Domains, PostHog, Postman and AsyncAPI. Among the affected pipelines were Backstage’s, where nine GitHub Actions workflow runs in the backstage/backstage repository executed compromised packages during the E2E test workflow.

Harden Runner detected the attack across all monitored Backstage workflows by building a baseline of expected network destinations and flagging connections to new endpoints such as bun[.]sh and oss.trufflehog[.]org, which were not part of the workflow’s history. With block mode enabled these anomalous connections would have been blocked, preventing the malware from downloading the Bun runtime or TruffleHog.

Backstage, using the community tier of Harden Runner, makes these insights publicly verifiable via the listed runs. The article notes that enterprise users gain additional visibility through HTTPS monitoring, process telemetry and real-time alerts, underscoring the value of runtime monitoring for preventing zero-day supply chain attacks.