An SSH key is a cryptographic identity used to prove who you are when connecting to servers, Git hosts, build systems, and other remote services. It usually comes as a matched private key and public key pair. The private key stays on the user’s device or in an agent, while the public key is registered on systems that should trust that identity.
SSH keys matter because they often grant direct access to production servers, source code repositories, and automation accounts. If malware steals a private key, an attacker may be able to log in without a password, impersonate a developer, or move laterally through infrastructure. In supply-chain attacks, malicious packages can search common key locations, read SSH agents, or copy configuration files during install. Defenders reduce risk by using passphrases, hardware-backed keys, short-lived credentials, least-privilege access, and rapid key revocation when compromise is suspected.