Suspicious Package Dependency Uploads to CI/CD Repositories

Ankit Mehta@Secvyn

•updated Jun 16, 2026•0•0•5

Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.