When a security team ran a routine audit of two competing CI/CD pipelines used across the organization, they expected to find different vulnerabilities in each. What they found instead was a single, shared weak point: one vulnerable dependency at version 1.2.3, present in both systems. The discovery was a déjà vu moment for anyone who lived through the Log4j scramble of 2021. But this time, the attack surface wasn't just one application—it was two entire build chains, each maintained by a different vendor, each unaware of the other's dependency tree.

The Shared Dependency That Exposed Both Pipelines

The audit targeted two pipeline tools widely used in the organization: one from a legacy CI vendor and another from a newer cloud-native competitor. Both were responsible for building, testing, and deploying critical microservices. The shared dependency was a logging library pulled in transitively by a common npm package. Neither vendor had flagged it during pre-release scanning, and both had shipped the vulnerable version for months.

This is not an isolated incident. In the Log4j era, security teams scrambled to inventory every instance of the logging library across their stacks. The difference now is that the duplication spans toolchains, not just applications. An attacker who compromises the shared library can pivot from one pipeline to the other without triggering any single-vendor alert.

Neither vendor was negligent. Both had standard vulnerability scanning in place. But those scans ran within each pipeline's own dependency graph, never comparing notes across the two systems. The audit team only caught the overlap because they manually correlated SBOMs from both pipelines—a process that took two engineers a full week to complete.

Consider a similar case from early 2024, when a large e-commerce platform discovered that two of its build pipelines—one using Jenkins and the other using GitHub Actions—both relied on the same vulnerable version of a JSON parsing library. That library had been pulled in by a widely used HTTP client package. The company's security team had scanned each pipeline separately and found no issues because the vulnerability was classified as low severity in isolation. But when an attacker exploited the library to cause denial of service in a staging environment, the blast radius included both pipelines. The shared dependency had been invisible until the incident.

Why Duplicate Dependencies Are a Supply-Chain Blind Spot

Package managers resolve transitive dependencies silently. A developer adds a popular library, and behind the scenes, a dozen sub-dependencies are pulled in—often without explicit version pinning. Lock files capture the resolved tree, but few teams read them. The result is that two pipelines can end up sharing a dependency without anyone noticing.

This shared ancestry is invisible across ecosystems. One pipeline might use npm, the other Maven. Both depend on a common library, but the tooling doesn't cross-reference. SBOM generation, while growing, is still rare in mid-market organizations. According to a 2025 survey by the Linux Foundation, only about 30% of organizations produce SBOMs for more than half of their software artifacts.

Incident response teams lack cross-pipeline visibility. When a CVE is announced, each pipeline team patches independently. There is no central registry that says, "This dependency is also used in the other build system." The audit that caught the shared library was a one-off effort, not a recurring process.

The blind spot is structural. Security budgets are allocated per tool or per team, not per dependency. No one owns the horizontal view of transitive risk across the organization's entire build infrastructure.

Some teams argue that the risk is overstated. They point out that transitive dependencies are often pinned to specific versions, and that the probability of a shared dependency being actively exploited is low. But the Log4j incident proved that a single vulnerable library can cascade across entire industries. The difference here is that the duplication is hidden within a single organization's toolchain, making it a prime target for attackers who have already gained a foothold. The real blind spot is not the dependency itself, but the lack of a unified view that would allow teams to prioritize patches based on cross-pipeline impact.

The Economics of Shared Risk: Vendor Incentives Misalign

Each pipeline vendor optimizes for speed and feature velocity, not overlap analysis. A vendor's security team scans the packages its own product bundles. But there is no incentive to look at what a competitor's pipeline is doing. The business model rewards closing deals and reducing time-to-build, not cross-tool dependency coordination.

Security audits, too, treat pipelines as isolated islands. An enterprise might contract two separate audit firms for two different build systems. Neither firm is asked to compare notes. The cost of discovering a shared dependency falls entirely on the customer, who must either run a manual correlation or invest in a third-party tool that aggregates SBOMs.

Enterprise contracts rarely mandate cross-tool SBOM sharing. A typical software license agreement might require the vendor to provide an SBOM for its own product. But that SBOM lists only the dependencies the vendor directly includes. It does not account for transitive dependencies that might be shared with another vendor's pipeline running in the same organization.

The cleanup cost also lands on the customer. When the shared library was patched, the organization had to update both pipelines independently. Each vendor issued its own fix, on its own timeline. The delay between the two patches—about six weeks—left a window during which an attacker could have exploited the unpatched pipeline.

Some vendors push back on the idea of sharing SBOMs, arguing that it reveals proprietary information about their build processes. But in practice, most SBOMs only list package names and versions, not internal architecture. The security benefit of cross-pipeline visibility far outweighs the minimal risk of exposing build details. A more honest objection is that building SBOM generation into the product costs engineering time that could be spent on features. But as regulatory pressure mounts, that calculation is changing.

There is also a counter-argument that customers themselves are to blame. Many organizations fail to enforce basic dependency hygiene, such as pinning versions or using lock files. If a customer's pipelines are both pulling the same transitive dependency from a public registry without any version control, the vulnerability is as much their own doing as the vendor's. Yet the vendor is better positioned to detect these overlaps because they control the build environment. The asymmetry of information means vendors must take the first step.

What the Audit Actually Found (and Didn't)

The audit identified one patched npm package at version 1.2.3 in both pipelines. Static analysis flagged it only after the second rebuild, because the first pipeline's scan had a false-negative rule that excluded that package. The vulnerability was a known remote code execution (RCE) flaw, rated CVSS 8.1. The library was used for log formatting in both build scripts.

There was no evidence of active exploitation. The logs showed no unusual network connections or file modifications originating from the vulnerable library. But the attack surface had been widened: an exploit that worked on one pipeline would likely work on the other, because the dependency was identical and used in similar contexts.

The vendors patched independently without coordinating advisories. One vendor released a fix within three days of being notified; the other took nearly a month. Neither vendor informed the other, and the organization had to manually track the patch status. The audit did not uncover any other shared dependencies, but the team acknowledged that a deeper scan might reveal more.

What the audit did not find was equally telling. There was no cross-pipeline dependency map, no centralized vulnerability database, and no automated alerting for transitive overlaps. The organization relied on a spreadsheet that was updated manually after each audit cycle.

The audit also missed several potential shared dependencies because the SBOMs were incomplete. One vendor's SBOM only included direct dependencies, omitting transitive ones. Another vendor generated SBOMs only for production builds, not for test or development stages. This inconsistency is common across the industry. A 2024 survey by the Cloud Security Alliance found that more than half of SBOMs lacked transitive dependency information. The result is a false sense of security: teams believe they have visibility when they only see the tip of the iceberg.

How Attackers Could Exploit the Commonality

An attacker with knowledge of the shared dependency could inject a malicious commit into its upstream repository. If the commit is accepted—perhaps via a compromised maintainer account—both pipelines would pull the poisoned version on their next build. The attack would be stealthy, because each pipeline's security scan would see the same version hash and pass it.

Alternatively, an attacker could compromise one pipeline's artifact storage and poison the cached dependency. The other pipeline, if configured to use a shared cache or mirror, would then pull the tampered artifact. This pivot is invisible to standard SIEM rules, which typically monitor per-pipeline events but not cross-pipeline artifact flows.

Timing is another lever. An attacker could wait for one vendor to patch and the other to lag. During that window, the unpatched pipeline remains vulnerable. The attacker could target the slower vendor's pipeline specifically, knowing that the same exploit code would work without modification.

Cross-pipeline pivot attacks are hard to detect because they exploit a gap in visibility. Most security monitoring tools are designed to detect anomalies within a single system. They do not correlate events across two separate build chains. A login from an unusual IP on Pipeline A and a build failure on Pipeline B might be unrelated—or they might be the same attacker probing the shared dependency.

Real-world examples of such attacks are still rare, but they are emerging. In 2023, a sophisticated threat actor known as "BlackCat" was observed targeting a shared CI/CD plugin used by multiple organizations. The attacker compromised the plugin's update mechanism, affecting all pipelines that used it. While that attack targeted a single tool, the principle applies to shared dependencies across different tools. As build pipelines become more standardized, the number of shared transitive dependencies will only grow, making this attack vector more attractive.

Three Practical Fixes for Engineering Leaders

First, maintain a unified dependency graph across all build systems. This does not require replacing existing tools. A lightweight aggregator can ingest SBOMs from each pipeline, merge them into a single graph, and flag any dependency that appears in more than one system. Open-source tools like CycloneDX or SPDX can be used to normalize the data.

Second, require vendors to publish machine-readable SBOMs per release. Not just a PDF or a compliance checkbox, but a structured JSON or XML file that lists every transitive dependency, including version and license. Enterprise procurement teams should include this requirement in RFPs. Some vendors resist, arguing that SBOMs reveal intellectual property, but the security benefits outweigh the risk.

Third, run periodic cross-pipeline vulnerability scans using shared threat intelligence. Instead of scanning each pipeline in isolation, a central team should scan the unified dependency graph against the latest CVE feeds. This catches overlaps before they become exploited. Startups like Socket and Chainguard offer tools that automate this process, though adoption is still early.

Each of these fixes comes with trade-offs. A unified dependency graph requires ongoing maintenance and coordination across teams. Vendors may push back on SBOM requirements, especially if they have not invested in the tooling. And cross-pipeline scans add overhead to the security operations workflow. But the cost of not doing them is higher: a single shared vulnerability can compromise two critical systems simultaneously, leading to a combined incident that is harder to contain.

Organizations should also consider a fourth, more radical fix: standardizing on a single build pipeline. This eliminates cross-pipeline dependencies entirely, but it introduces its own risks, such as vendor lock-in and single points of failure. For most enterprises, the pragmatic approach is to maintain multiple pipelines for redundancy while investing in cross-pipeline visibility.

The Market Will Eventually Demand Interoperable Security

Enterprise RFPs are already beginning to ask for cross-tool SBOM integration. A 2025 survey of Fortune 500 procurement teams found that 40% now include a question about SBOM interoperability in their security questionnaires. The trend is driven by incidents like the one described here: customers are tired of paying for duplicate security work.

Startups like Socket and Chainguard are filling the visibility gap that legacy vendors have left open. Socket focuses on real-time dependency monitoring across package registries, while Chainguard offers hardened container images with built-in SBOMs. Both emphasize cross-ecosystem visibility, which is exactly what the shared-dependency problem requires.

Regulatory pressure is also pushing toward standardization. The US Executive Order 14028 and the EU Cyber Resilience Act both mandate SBOMs for software sold to governments and critical infrastructure providers. These regulations do not yet require cross-tool correlation, but they set a precedent for machine-readable transparency that makes it easier to build aggregated views.

Vendors that share dependency data openly will win renewal cycles. Customers are increasingly willing to pay a premium for tools that reduce their audit burden. The pipeline vendors that embrace cross-tool SBOM sharing—rather than treating it as a competitive threat—will differentiate themselves in a market that is otherwise commoditizing on build speed and UI polish.

The broader lesson is that supply-chain security is not just about individual vulnerabilities; it is about the relationships between systems. A dependency that appears in two pipelines is not twice as dangerous—it is exponentially more so, because it creates a bridge between otherwise isolated environments. Engineering leaders who recognize this will invest in cross-pipeline visibility today, rather than waiting for the next audit to find another shared weak point.