Adding canary tokens to detect supply chain compromise

[Erj4]

What problem is this solving

This is a suggestion to add security canaries to this repo for monitoring and detecting supply chain attacks. A great example of the benefits of canaries in protecting the community is seen in this Grafana post, and research Detecting the Modern Supply Chain Attack: High-Fidelity Canaries for CI/CD.

Proposed solution

There's a free Tracebit Community Edition GitHub integration you can install here that sets this up in under 5 minutes - once you do, it injects canary tokens (decoy credentials that look real but nothing legitimate ever uses) into each workflow. If anyone tries to use one, you get an alert straight away. Since no real process ever touches them, a trigger means there's likely an issue.

I'm more than happy to raise a PR and implement it myself. No stress if it doesn't fit - thought it would be useful to share with the wider community.

Full disclosure: I work for Tracebit and built this myself. Our Community Edition is fully designed with community in mind and will remain free forever.

Describe alternatives you've considered

No response

[posva]

Interesting. I will take a look. I think there are bigger chances of attack in smaller packages that are direct deps thought, so the devtools for vue router. In the case of Nuxt many other

[Erj4]

Thanks for the response, we'll look into that devtools repo as well, as you suggested.
Since canaries target credential exfiltration rather than doing code analysis, covering a higher level repo like this can also catch compromise of your dependencies in case of cascading supply chain attacks (e.g. Shai-Hulud). That can help you ensure you don't become part of that chain of compromise.
Ideally, this would be used throughout each of the layers of dependencies to get the best coverage.