.png)
StepSecurity detected some of the most consequential supply chain attacks of 2025, often before they were publicly known. Today, we secure over 13 million builds every week, giving us real-world visibility into how modern software is built and where it is most vulnerable.
Over the past few years, software supply chain attacks have moved from theoretical risk to daily reality. In 2025, that shift became impossible to ignore. Attackers targeted CI/CD pipelines, open source packages, and trusted developer tooling at an unprecedented pace.
For StepSecurity, 2025 was the year our core thesis—that organizations need real-time visibility and enforcement across their software supply chains, not alerts after the damage is done—was repeatedly validated in production. We scaled the business, accelerated community adoption, and responded to critical compromises as they unfolded.
Here's a look back at what we built, what we learned, and where we are headed in 2026.
A Year of Sustained and Accelerating Growth
- More than 5x ARR growth, for the second year in a row
- 4x growth in customers, continuing a multi-year growth trajectory
- Onboarded customers such as Circle, Dexcom, Mercari, UtilityWarehouse, and Paddle, with enterprises across multiple regions relying on StepSecurity
- Published customer case studies with Aquanow, Recidiviz, Neon Database, and Chainguard
- Presented at Black Hat USA in Las Vegas on how Harden Runner detected the tj-actions/changed-files compromise
- Harden Runner community tier adoption doubled, growing from 5K to 10K public repositories
What makes this growth meaningful is not just the absolute numbers, but the acceleration behind them.
It took nearly three years to reach the first 5,000 public repositories using Harden Runner. In contrast, we added the next 5,000 repositories in just one year, doubling adoption in a fraction of the time. This reflects both increasing awareness of CI/CD supply chain risk and growing trust in StepSecurity as teams move from experimentation to standardization.
Sustaining 5x ARR growth year over year while accelerating community adoption reinforces a clear signal: software supply chain security is no longer an emerging concern. It has become a foundational requirement for modern development teams.
On the Front Lines of Supply Chain Security
In 2025, StepSecurity was at the center of several major supply chain compromises, often detecting malicious activity before it was publicly known. These are the top three:
tj-actions/changed-files compromise
First detected by StepSecurity Harden Runner, triggered by an anomalous outbound network call made by the compromised action. This incident impacted thousands of repositories across the GitHub ecosystem. Our detection and investigation methodology was presented at Black Hat USA in Las Vegas.
Shai Hulud supply chain compromises
Among the first teams to detect and publish technical details. Our research was referenced by CISA and covered by multiple media publications. We published a case study showing how CNCF's Backstage project, using Harden Runner, detected compromised npm packages across nine workflow job runs.
These incidents reinforced why we built StepSecurity in the first place: organizations need real-time visibility and enforcement across their software supply chains, not alerts after the damage is done.
Nx (s1ngularity) compromise
In August 2025, malicious versions of the widely used Nx build system were published to npm after a maintainer token was compromised (GHSA-cxm3-wv7p-598c). The payload executed during install, stealing developer credentials and exfiltrating data by creating public GitHub repositories named s1ngularity-repository.
This incident marked a new frontier in supply chain attacks: the malware attempted to abuse locally installed AI CLI tools to accelerate reconnaissance and data discovery, pushing the attack surface beyond CI/CD and into developer machines themselves.
Product Evolution
Our product evolved directly from customer feedback and lessons learned while responding to real-world supply chain attacks. You can view the full history in our changelog.
GitHub Actions Security
The tj-actions compromise exposed a fundamental problem: many teams rely on third-party actions that are abandoned, lack proper licensing, or become vectors for attack. In response, we added 200 StepSecurity-maintained actions as secure, drop-in replacements. We also introduced workflow run policies to block non-compliant workflows before execution, including blocking runs that reference compromised third-party actions—preventing incidents before they can execute.
To simplify deployment at scale, we announced a partnership with RunsOn, enabling customers to use Harden Runner with RunsOn's built-in images, and added support for baking Harden Runner into custom VMs for GitHub-hosted runners. This ensures every workflow, across every repository, is protected by default.
npm Package Security
In 2025, we expanded beyond CI/CD workflows to address supply chain risk in npm dependencies. During the Shai Hulud attacks, we observed attackers publishing malicious package versions within minutes of compromising maintainer accounts. Existing security tools couldn't respond fast enough.
Our npm capabilities were built to counter these specific attack patterns:
- npm cool down check: Prevents usage of recently released package versions during the critical window when compromised packages are most likely to be caught and removed. This directly addresses the attacker tactic of rapid publication after account compromise.
- npm search: Enables organizations to quickly identify compromised packages across default branches and pull requests, reducing detection time from days to minutes.
- Threat Intelligence and Threat Centre: Provides real-time notifications and detailed context when new supply chain threats impact customer environments, ensuring teams know what's affected and how to respond.
Together, these capabilities give customers proactive defenses and faster response when compromises occur.
What's Next in 2026
Our focus in 2026 is expanding protection across the full development lifecycle.
Securing the developer machine: One of the most requested capabilities from our customers. Recent attacks have shown that compromising a single developer workstation can bypass CI/CD protections entirely, giving attackers direct access to source code, credentials, and deployment pipelines. This critical attack surface has been overlooked for too long.
Harden Runner for Windows and macOS: Currently, Harden Runner protects Linux-based workflows. Extending coverage to Windows and macOS will enable comprehensive protection across heterogeneous CI/CD environments, addressing the needs of teams building across multiple platforms.
Expanding ecosystem coverage: Starting with PyPI and extending to additional package ecosystems. Supply chain attacks aren't limited to npm—we're seeing increased activity across language ecosystems, and our customers need consistent protection regardless of their tech stack.
Supply chain attacks are accelerating. In 2026, our goal is to stay ahead of those threats and help our customers do the same.
Thank you to our customers and community for trusting us and pushing us to build better defenses. And thank you to the StepSecurity team for showing up every day to support users when it matters most.
Here's to an even bigger 2026.
We are hiring. As we expand protection across developer workstations, multiple operating systems, and new package ecosystems, we're growing the team that makes it possible. If you care deeply about securing the software supply chain and want to work on problems that matter, we would love to hear from you.
.png)
.png)
.png)
