# Portable Developer Identity Cannot Contain Credential Compromise Across Registries

- **Artifact ID:** CHQ-P-2026-013
- **Version:** v1.4
- **Status:** ACTIVE
- **Public record:** https://record.cybersecurityhq.com/positions/chq-p-2026-013
- **Machine-record SHA-256:** `d643c353364858b102bdc5fad82a1c8142ee0f587a96d27e575974c3472fe14b`

## Canonical text

```text
[SECTION] POSITION METADATA
POSITION_ID=CHQ-P-2026-013
VERSION=v1.4
STATUS=ACTIVE
EFFECTIVE=2026-03
TITLE=Portable Developer Identity Cannot Contain Credential Compromise Across Registries
DOCTRINE_FAMILY=SUPPLY_CHAIN_INTEGRITY
ASSUMPTION_INVALIDATED=REGISTRY_CONTAINMENT
PRESSURE_CLASS=STRUCTURAL
POSITION_TYPE=STRUCTURAL_OBSERVATION
SIGNAL_COUNT=4
DURABILITY_CLASS=STRUCTURAL
EVIDENCE_STATE=CONFIRMED
VECTOR_COUNT=4
LENS=LENS-001
PATTERN_REGISTER_ID=CHQ-PR-013
SOURCE_SIGNALS=SN-2026-03-11-02, SN-2026-03-15-01, SN-2026-03-17-01, SN-2026-03-20-01
GOVERNING_CONSTRAINT=CHQ-ASC-2026-001
ESG_REFERENCE=CHQ-D-2026-ESG v1.0
REVISION_POLICY=Amendment only

[SECTION] AMENDMENT NOTE
AMENDMENT AMD-001 · JULY 24, 2026 · REINFORCEMENT
Window reinforcement recorded. A coordinated July 2026 campaign backdoored multiple official npm packages through several publishing pipelines and several OIDC publishing identities in parallel, with shared infrastructure confirming a single operation. Containment at any single identity or pipeline boundary would not have bounded the campaign. Canonical evidence basis and counts are unchanged; the reinforcement is recorded at the evidence layer.

AMENDMENT AMD-2026-09-22-POSITION-RECORD-CORRECTIVE-WAVE · SEPTEMBER 22, 2026 · POSITION RECORD STANDARD CORRECTION. Canonical field semantics, evidence counts, identifiers, independence wording, and publication integrity corrected in one dated wave.

AMENDMENT CHQ-RAT-2026-001-CANONICAL-TEXT-EXECUTION-WAVE · SEPTEMBER 22, 2026 · CANONICAL TEXT EXECUTION. Scheduled prose constructions rewritten for grammatical clarity without changing the underlying judgment.

AMENDMENT CHQ-PRS-2026-001-AMD-003 · SEPTEMBER 22, 2026 · GOVERNING CONSTRAINT APPLICABILITY. Governing Constraint was audited under the ratified PRS-06.5 material-applicability test. Default citations were removed, materially load-bearing constraints were retained or added, the prior version and hash were preserved, and the canonical hash was recomputed.

[SECTION] EVIDENCE BASIS
PRIMARY: Primary signal: GlassWorm multi-ecosystem supply chain campaign (March 2026). A single threat actor simultaneously compromised 433 components across four registries: GitHub repositories, npm packages, Open VSX extensions, and VS Code Marketplace extensions, using a self-propagating credential theft cycle. Stolen developer credentials were used to compromise packages in adjacent registries, which stole more credentials from more developers. The campaign operated continuously using Solana blockchain C2 infrastructure for four months across three technique generations.
SUPPORTING: SN-2026-03-11-02: Malicious Rust crates published to crates.io exfiltrating .env files. AI-powered bot hackerbot-claw scanned 47,391+ repositories for exploitable CI/CD workflows, achieving RCE in 4 targets. Aqua Trivy extension compromised with prompt injection targeting AI coding agents.
SUPPORTING: SN-2026-03-15-01: GlassWorm Wave 2: a compromised publisher account on Open VSX pushed malicious updates to 4 established extensions with ~25,000 existing installs. Malicious releases were available for 3+ days.
SUPPORTING: SN-2026-03-17-01: IBM X-Force documents Hive0163/Slopoly, the first confirmed AI-generated malware deployed by a ransomware group, demonstrating AI lowering the production cost of supply chain tooling.
SUPPORTING: SN-2026-03-20-01: GlassWorm Wave 3 escalation to 433 components. Transitive dependency abuse via extensionPack/extensionDependencies fields. Invisible Unicode payloads. Solana blockchain C2 (50 transactions, 4 months continuous operation). LLM-generated cover commits across 151+ repositories. ZOMBI RAT with self-propagating credential theft cycle.

[SECTION] AUTHORITY DERIVATION
No constraint derivation applies. This is a standalone Position.

[SECTION] GOVERNING CONSTRAINT
CHQ-ASC-2026-001

[SECTION] SCOPE OF APPLICATION
This Position applies to decisions involving developer identity governance, supply chain security architecture, CI/CD pipeline trust models, and package registry access controls.

It applies to organizations using open-source components from public registries, managed service providers operating across client development environments, and platform vendors operating extension or package marketplaces.

It does not evaluate specific vendors, specific registry implementations, or specific credential management products.

[SECTION] POSITION STATEMENT
The developer supply chain has become a propagation medium. Credential theft in one registry produces the infrastructure for credential theft in the next. The ecosystem's trust inheritance model is the propagation mechanism.
In multi-registry development ecosystems where developer identity is portable across registries, credential compromise produces self-propagating damage that is not bounded by any single registry's scope.

The security model for developer supply chain governance assumes that credential compromise is bounded by the registry in which it occurs. An npm token compromise affects npm packages. A GitHub token compromise affects GitHub repositories. Separate credential policies, separate audit trails, and separate incident response playbooks reflect this assumption.

The GlassWorm campaign invalidates this assumption at scale. A single credential theft in one registry produced authenticated, trusted actions across all registries where that credential or its derivatives provided access. Stolen GitHub tokens compromised npm packages. Compromised npm packages stole extension marketplace credentials. Compromised marketplace extensions stole more GitHub tokens. The campaign operated for four months, evolved through three technique generations, and compromised 433 components across four registries without requiring the attacker to scale operations.

The structural condition is not a vulnerability in any individual registry. It is a property of the identity architecture that spans registries: when developer identity is portable, compromise is portable. The blast radius of a single credential theft is not bounded by any registry's authorization scope. It is bounded by the propagation rate through the trust inheritance graph that connects them.

[SECTION] STRUCTURAL OBSERVATION
Together with CHQ-P-2026-011 (Deployed Security Tool Presence Cannot Serve as Evidence of Functioning Control), this Position establishes that the developer supply chain is not a passive attack surface that can be hardened at the perimeter. It is an active propagation medium: the trust relationships that make open-source development productive are the same relationships that make credential compromise self-propagating.

The GlassWorm campaign operated entirely within authenticated sessions using legitimately-issued credentials. The identity provider boundary was intact. The compromise propagated through it, not around it. This is consistent with A-030 (identity provider boundary as identity perimeter): the boundary is functioning, and the attack does not depend on breaking it.

[SECTION] ARCHITECTURAL IMPLICATION
A-021 (Security authority persists through delegation chains) is under pressure. GlassWorm demonstrates that trust delegated through extension dependencies and package relationships does not carry security constraints with the delegation. The extensionPack/extensionDependencies transitive installation mechanism delegates the parent extension's trust to arbitrary dependencies without independent verification.

A-029 (SaaS integration exposure is bilateral and bounded) has been retired. GlassWorm demonstrates that integration exposure is not bilateral. A compromised npm token produces cascading access across GitHub, Open VSX, and VS Code Marketplace without those registries authorizing the cross-boundary access. The blast radius exceeds any bilateral authorization.

A-030 (The identity provider boundary constitutes the identity perimeter) is under pressure. GlassWorm operates entirely within authenticated sessions using legitimately-issued credentials. The identity provider boundary is intact. The compromise propagates through it, not around it.

A-031 (Credential compromise within a registry produces damage bounded by that registry's scope) is newly under pressure on issuance. This is the assumption most directly invalidated by GlassWorm. The entire campaign is evidence that registry-scoped containment does not hold when developer identity is portable across registries.

[SECTION] EVIDENTIAL RECORD
TITLE=CybersecurityHQ Portable Developer Identity Cross-Registry Propagation Evidence
DOCKET=CHQ-ED-2026-012
EXHIBITS=NONE
SIGNALS=SN-2026-03-11-02, SN-2026-03-15-01, SN-2026-03-17-01, SN-2026-03-20-01

[SECTION] STRUCTURAL CONSEQUENCE
The structural condition is that the developer supply chain is now a propagation medium, not merely an attack surface. The distinction is material: an attack surface is passive and can be hardened; a propagation medium is active and amplifies through its own functioning.

In any system where identity is portable, compromise is not containable. The boundary of impact is not defined by system design but by the rate of propagation.

The ecosystem has demonstrated this property empirically. GlassWorm operated across four registries simultaneously for four months, evolved through three technique generations to survive defensive responses, and used stolen credentials from each registry to compromise packages in adjacent registries. The campaign did not require the attacker to scale operations. The developer ecosystem scaled the attack.

[SECTION] BOUNDARY OF APPLICATION
Prescriptive credential management recommendations
Specific registry security implementation guidance
Vendor-specific authentication product evaluation
Regulatory compliance requirements for developer identity

[SECTION] SUGGESTED CITATION
CybersecurityHQ Position
"Portable Developer Identity Cannot Contain Credential Compromise Across Registries"
CHQ-P-2026-013
Version 1.4
2026-03

[SECTION] POSITION STATUS
STATUS=ACTIVE
VERSION=v1.4

[SECTION] RECORD INTEGRITY
SCOPE=PRS-03.1 CANONICAL TEXT (NOT RENDERING)
VERSION=v1.4

[SECTION] DOCTRINAL ALIGNMENT
Standalone Position

[SECTION] REFERENCE CONDITIONS
Authored independently of any subscribing organization
Not tailored to a specific contractual, commercial, or advocacy interest
Subsequent analysis based only on new evidence

[SECTION] LINKED CONDITIONS

[SECTION] LINKED ASSUMPTIONS
```

## Complete structured record

```json
{
  "id": "CHQ-P-2026-013",
  "title": "Portable Developer Identity Cannot Contain Credential Compromise Across Registries",
  "status": "ACTIVE",
  "version": "v1.4",
  "snapshot_date": "2026-03",
  "doctrine_family": "SUPPLY_CHAIN_INTEGRITY",
  "assumption_class": "REGISTRY_CONTAINMENT",
  "pressure_class": "STRUCTURAL",
  "position_type": "STRUCTURAL_OBSERVATION",
  "signal_count": 4,
  "pattern_register_id": "CHQ-PR-013",
  "durability_class": "STRUCTURAL",
  "evidence_state": "CONFIRMED",
  "vector_count": 4,
  "lens": "LENS-001",
  "source_signals": [
    "SN-2026-03-11-02",
    "SN-2026-03-15-01",
    "SN-2026-03-17-01",
    "SN-2026-03-20-01"
  ],
  "governing_acj": [
    "CHQ-ASC-2026-001"
  ],
  "evidence_docket": "CHQ-ED-2026-012",
  "evidence_dockets": [
    {
      "docket": "CHQ-ED-2026-012",
      "issue_date": "2026-03-20",
      "position_version": "v1.0"
    },
    {
      "docket": "CHQ-ED-2026-016",
      "issue_date": "2026-05-04",
      "position_version": "v1.0"
    },
    {
      "docket": "CHQ-ED-2026-022",
      "issue_date": "2026-07-24",
      "position_version": "v1.1",
      "relationship": "AMENDMENT"
    }
  ],
  "prior_evidence_dockets": [
    {
      "docket": "CHQ-ED-2026-016",
      "relationship": "REINFORCEMENT",
      "position_version": "v1.0"
    },
    {
      "docket": "CHQ-ED-2026-022",
      "relationship": "AMENDMENT",
      "position_version": "v1.1"
    }
  ],
  "extends_position": null,
  "doctrine_statement": "The developer supply chain has become a propagation medium. Credential theft in one registry produces the infrastructure for credential theft in the next. The ecosystem's trust inheritance model is the propagation mechanism.",
  "evidence_basis": {
    "primary": "Primary signal: GlassWorm multi-ecosystem supply chain campaign (March 2026). A single threat actor simultaneously compromised 433 components across four registries: GitHub repositories, npm packages, Open VSX extensions, and VS Code Marketplace extensions, using a self-propagating credential theft cycle. Stolen developer credentials were used to compromise packages in adjacent registries, which stole more credentials from more developers. The campaign operated continuously using Solana blockchain C2 infrastructure for four months across three technique generations.",
    "supporting": [
      "SN-2026-03-11-02: Malicious Rust crates published to crates.io exfiltrating .env files. AI-powered bot hackerbot-claw scanned 47,391+ repositories for exploitable CI/CD workflows, achieving RCE in 4 targets. Aqua Trivy extension compromised with prompt injection targeting AI coding agents.",
      "SN-2026-03-15-01: GlassWorm Wave 2: a compromised publisher account on Open VSX pushed malicious updates to 4 established extensions with ~25,000 existing installs. Malicious releases were available for 3+ days.",
      "SN-2026-03-17-01: IBM X-Force documents Hive0163/Slopoly, the first confirmed AI-generated malware deployed by a ransomware group, demonstrating AI lowering the production cost of supply chain tooling.",
      "SN-2026-03-20-01: GlassWorm Wave 3 escalation to 433 components. Transitive dependency abuse via extensionPack/extensionDependencies fields. Invisible Unicode payloads. Solana blockchain C2 (50 transactions, 4 months continuous operation). LLM-generated cover commits across 151+ repositories. ZOMBI RAT with self-propagating credential theft cycle."
    ]
  },
  "doctrinal_alignment": [],
  "revision_policy": "Amendment only",
  "esg_reference": "CHQ-D-2026-ESG v1.0",
  "scope": "This Position applies to decisions involving developer identity governance, supply chain security architecture, CI/CD pipeline trust models, and package registry access controls.\n\nIt applies to organizations using open-source components from public registries, managed service providers operating across client development environments, and platform vendors operating extension or package marketplaces.\n\nIt does not evaluate specific vendors, specific registry implementations, or specific credential management products.",
  "position_statement": "In multi-registry development ecosystems where developer identity is portable across registries, credential compromise produces self-propagating damage that is not bounded by any single registry's scope.\n\nThe security model for developer supply chain governance assumes that credential compromise is bounded by the registry in which it occurs. An npm token compromise affects npm packages. A GitHub token compromise affects GitHub repositories. Separate credential policies, separate audit trails, and separate incident response playbooks reflect this assumption.\n\nThe GlassWorm campaign invalidates this assumption at scale. A single credential theft in one registry produced authenticated, trusted actions across all registries where that credential or its derivatives provided access. Stolen GitHub tokens compromised npm packages. Compromised npm packages stole extension marketplace credentials. Compromised marketplace extensions stole more GitHub tokens. The campaign operated for four months, evolved through three technique generations, and compromised 433 components across four registries without requiring the attacker to scale operations.\n\nThe structural condition is not a vulnerability in any individual registry. It is a property of the identity architecture that spans registries: when developer identity is portable, compromise is portable. The blast radius of a single credential theft is not bounded by any registry's authorization scope. It is bounded by the propagation rate through the trust inheritance graph that connects them.",
  "context": "Together with CHQ-P-2026-011 (Deployed Security Tool Presence Cannot Serve as Evidence of Functioning Control), this Position establishes that the developer supply chain is not a passive attack surface that can be hardened at the perimeter. It is an active propagation medium: the trust relationships that make open-source development productive are the same relationships that make credential compromise self-propagating.\n\nThe GlassWorm campaign operated entirely within authenticated sessions using legitimately-issued credentials. The identity provider boundary was intact. The compromise propagated through it, not around it. This is consistent with A-030 (identity provider boundary as identity perimeter): the boundary is functioning, and the attack does not depend on breaking it.",
  "governance_condition": "A-021 (Security authority persists through delegation chains) is under pressure. GlassWorm demonstrates that trust delegated through extension dependencies and package relationships does not carry security constraints with the delegation. The extensionPack/extensionDependencies transitive installation mechanism delegates the parent extension's trust to arbitrary dependencies without independent verification.\n\nA-029 (SaaS integration exposure is bilateral and bounded) has been retired. GlassWorm demonstrates that integration exposure is not bilateral. A compromised npm token produces cascading access across GitHub, Open VSX, and VS Code Marketplace without those registries authorizing the cross-boundary access. The blast radius exceeds any bilateral authorization.\n\nA-030 (The identity provider boundary constitutes the identity perimeter) is under pressure. GlassWorm operates entirely within authenticated sessions using legitimately-issued credentials. The identity provider boundary is intact. The compromise propagates through it, not around it.\n\nA-031 (Credential compromise within a registry produces damage bounded by that registry's scope) is newly under pressure on issuance. This is the assumption most directly invalidated by GlassWorm. The entire campaign is evidence that registry-scoped containment does not hold when developer identity is portable across registries.",
  "implications": [
    "Where developer identity is portable across registries, the blast radius of a single credential theft is bounded by propagation rate rather than by any registry's authorization scope.",
    "Supply chain security architectures that assume registry-scoped containment inherit that assumption's structural failure as a permanent limitation on governance accuracy."
  ],
  "implications_text": "The structural condition is that the developer supply chain is now a propagation medium, not merely an attack surface. The distinction is material: an attack surface is passive and can be hardened; a propagation medium is active and amplifies through its own functioning.\n\nIn any system where identity is portable, compromise is not containable. The boundary of impact is not defined by system design but by the rate of propagation.\n\nThe ecosystem has demonstrated this property empirically. GlassWorm operated across four registries simultaneously for four months, evolved through three technique generations to survive defensive responses, and used stolen credentials from each registry to compromise packages in adjacent registries. The campaign did not require the attacker to scale operations. The developer ecosystem scaled the attack.",
  "exclusions": [
    "Prescriptive credential management recommendations",
    "Specific registry security implementation guidance",
    "Vendor-specific authentication product evaluation",
    "Regulatory compliance requirements for developer identity"
  ],
  "supersedes": null,
  "amendments": "AMD-001; AMD-2026-09-22-POSITION-RECORD-CORRECTIVE-WAVE; CHQ-RAT-2026-001-CANONICAL-TEXT-EXECUTION-WAVE; CHQ-PRS-2026-001-AMD-003",
  "amendment_note": "AMENDMENT AMD-001 · JULY 24, 2026 · REINFORCEMENT\nWindow reinforcement recorded. A coordinated July 2026 campaign backdoored multiple official npm packages through several publishing pipelines and several OIDC publishing identities in parallel, with shared infrastructure confirming a single operation. Containment at any single identity or pipeline boundary would not have bounded the campaign. Canonical evidence basis and counts are unchanged; the reinforcement is recorded at the evidence layer.\n\nAMENDMENT AMD-2026-09-22-POSITION-RECORD-CORRECTIVE-WAVE · SEPTEMBER 22, 2026 · POSITION RECORD STANDARD CORRECTION. Canonical field semantics, evidence counts, identifiers, independence wording, and publication integrity corrected in one dated wave.\n\nAMENDMENT CHQ-RAT-2026-001-CANONICAL-TEXT-EXECUTION-WAVE · SEPTEMBER 22, 2026 · CANONICAL TEXT EXECUTION. Scheduled prose constructions rewritten for grammatical clarity without changing the underlying judgment.\n\nAMENDMENT CHQ-PRS-2026-001-AMD-003 · SEPTEMBER 22, 2026 · GOVERNING CONSTRAINT APPLICABILITY. Governing Constraint was audited under the ratified PRS-06.5 material-applicability test. Default citations were removed, materially load-bearing constraints were retained or added, the prior version and hash were preserved, and the canonical hash was recomputed.",
  "reference_conditions": [
    "Authored independently of any subscribing organization",
    "Not tailored to a specific contractual, commercial, or advocacy interest",
    "Subsequent analysis based only on new evidence"
  ],
  "evidential_record": {
    "title": "CybersecurityHQ Portable Developer Identity Cross-Registry Propagation Evidence",
    "docket": "CHQ-ED-2026-012",
    "exhibits": [],
    "signals": [
      "SN-2026-03-11-02",
      "SN-2026-03-15-01",
      "SN-2026-03-17-01",
      "SN-2026-03-20-01"
    ]
  },
  "related_positions": [
    "CHQ-P-2026-011",
    "CHQ-P-2026-016"
  ],
  "pdf_hash": "6744f05877135ae0dc994658aa0c5d584304f73e6d233f912b8468dca8c3544d",
  "prior_hashes": [
    {
      "version": "v1.1",
      "sha256": "542dd09c4e047b7ddfabe4a0d3fdd52e863c0a8840fe83725adf45495cab199f"
    },
    {
      "version": "v1.3",
      "sha256": "16226048d8b055905b5a74bd63a7ecd15df595ff77b365d03e8047c0dadc69a9"
    }
  ],
  "authority_derivation_text": "No constraint derivation applies. This is a standalone Position.",
  "canonical_hash": "6744f05877135ae0dc994658aa0c5d584304f73e6d233f912b8468dca8c3544d"
}
```