2025 in Review: The Evolution of Supply Chain Security & What's Next

StepSecurity’s 2025 review highlights a year of sustained growth and real-world impact, with the company securing over 13 million builds weekly and detecting major supply chain incidents often before public disclosure. The firm reports more than 5x ARR growth for the second consecutive year and a fourfold rise in customers, aided by onboarding names like Circle, Dexcom, Mercari, Utility Warehouse, and Paddle.

They identify three notable compromises where Harden Runner played a key role: the tj-actions/changed-files incident, Shai Hulud-linked npm package compromises, and the Nx (s1ngularity) build-system attack, all underscoring the importance of real‑time visibility across the software supply chain. 2025 also saw Harden Runner adoption doubling from 5,000 to 10,000 public repositories, and npm-focused capabilities such as an npm cool down check and npm search aimed at expediting detection and response.

Looking ahead, the 2026 roadmap focuses on securing developer workstations, extending Harden Runner to Windows and macOS, and broadening protection across additional package ecosystems, according to StepSecurity.