Supply Chain Omen exploits the asymptotic density of the modern dependency graph. The average enterprise application now pulls 4,200 transitive packages; the weapon occupies one leaf node, far below the audit horizon, and remains inert through every test, staging, and CI environment.
Activation requires a precise environmental fingerprint: a specific kernel version, a specific cloud-region metadata endpoint, and a specific production-only environment variable. When all three align — which occurs only in the live production deployment — the payload executes. By that point the artifact has passed every gate in the pipeline, signed by the organization's own keys.
The July 2027 campaign planted the payload in a popular logging library's optional peer dependency. It activated across 340 production deployments simultaneously, exfiltrating cloud credentials before anyone noticed the anomalous egress. The logging library maintainers were unaware; the peer dependency was maintained by a separate, compromised account.