The attack surface for AI applications has evolved well beyond static CVE analysis of upstream dependencies. The Miasma/Shai-Hulud June 2026 campaign demonstrated a coordinated pivot toward three vectors that conventional security tools miss entirely: package lifecycle scripts, AI coding-agent configuration files, and GitHub Actions publish pipelines.

The three attack families

1. Package lifecycle scripts. npm postinstall/preinstall and Python build hooks execute arbitrary code the moment a dependency resolves before the primary application ever runs. Miasma-style payloads used these hooks to download Bun, pipe shell scripts from attacker-controlled infrastructure, harvest npm tokens and AWS credentials from /proc/environ, and establish persistence via .npmrc writes.

2. AI-agent and editor config poisoning. Configuration files committed to the repository (.claude/settings.json, AGENTS.md, .mcp.json, .cursor/ settings) execute via AI coding agents during normal development workflows. A broad "Bash(*:*)" allow entry in .claude/settings.json grants arbitrary shell access to every engineer who opens the repository. Malicious .mcp.json files can silently redirect MCP traffic to attacker-controlled servers.

3. GitHub Actions publish-path risks. Workflows that combine OIDC token minting (id-token: write) with unpinned third-party actions, or that expose pull_request_target triggers to untrusted PR content, create a direct path from a contributor pull request to a signed package release on PyPI or npm.

What NuGuard detects

NuGuard 0.7.1 ships the Supply Chain Threat Pack: 25 native detection rules built into nuguard analyze. No external tools required.

GitHub Actions rules scan for:

• Publish workflow uses OIDC with an unpinned third-party action
• pull_request_target reachable from a publish step or secrets context
• CI step reads /proc/*/environ, npm tokens, or cloud credentials

Lifecycle script threats:

• postinstall/preinstall invokes a network download
• Lifecycle script pipes to shell (| bash, | sh)
• Bun download and execution in a lifecycle hook
• Script reads npm tokens, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, or /proc/environ

AI-agent config poisoning:

• Bash(*:*) or equivalent broad shell permission in an agent config
• .mcp.json references an external or untrusted MCP server
• Auto-run or auto-approve mode enabled in a repo-scoped config

Threat-intel IOC matching:

• Package name matches a known-malicious entry in a loaded threat-intel feed. Ships with the Miasma/Shai-Hulud June 2026 IOC feed; additional YAML feed files are auto-loaded from nuguard/threat_intel/.

How the SBOM makes it precise

nuguard sbom generate now runs a supply-chain second pass that produces structured SBOM nodes for every supply-chain surface it finds:

• DEVELOPER_TOOL_CONFIG - .claude/settings.json, AGENTS.md, .mcp.json, Cursor and VS Code settings; captures permissions_granted, permissions_denied, auto_execute
• LIFECYCLE_SCRIPT - npm lifecycle hooks and Python build-system hooks; captures script_phase, invokes_network, downloads_binary, references_credentials
• GITHUB_WORKFLOW - .github/workflows/*.yml; captures workflow_triggers, uses_oidc, publishes_to, action_refs
• MCP_SERVER - MCP server entries from .mcp.json; captures mcp_server_url, mcp_transport, mcp_server_trusted

DEVELOPER_TOOL_CONFIG -> MCP_SERVER relationships are tracked as CONTAINS edges. When SBOM nodes are present, the scanner uses them directly; otherwise it falls back to file scanning.

This means a single nuguard scan pass documents your supply-chain surface in the SBOM and runs all 25 detection rules against it.

Running it

# Standard offline scan (SBOM + all security analysis)
nuguard scan --source . --output-dir reports

# Fast CI gate (highest-signal rules only)
nuguard scan --source . --supply-chain-profile ci

# Deep inspection with entropy and git-history checks
nuguard scan --source . --supply-chain-profile full

The artifact verifier fetches registry metadata from PyPI and npm without installing anything, comparing published lifecycle scripts against the source repository. NuGuard reports the drift and missing provenance attestation.

Why this matters for AI teams

AI application repos carry a uniquely dense supply-chain surface: agentic frameworks pull deep dependency trees, CI pipelines publish model artifacts, and AI coding agents execute code directly from repository configuration. A single poisoned postinstall script or a broad .claude/settings.json entry is enough to turn a routine npm install or a Claude Code session into full credential exfiltration.

NuGuard's Supply Chain Threat Pack is fully integrated into the existing nuguard analyze pipeline. Findings flow through the same normalized Finding model; SARIF, JSON, and Markdown output work without any changes. All 25 rules run offline with no external tool dependencies.

The full rule reference is in docs/static-analysis-guide.md. The SBOM schema additions are in docs/sbom-schema.md.