CI/CD & Supply Chain Security
The software supply chain is the new frontier of offensive security. A single compromised build pipeline can grant access to thousands of downstream targets.
High-Impact Attack Surface
Attack Surface Overview
Key Attack Techniques
🔓 Secret Extraction
Dumping CI/CD environment variables, stealing API keys, cloud credentials, and tokens from build logs.
💉 Pipeline Injection
Modifying build configs to execute arbitrary code during CI/CD runs (workflow files, Jenkinsfiles).
🏃 Runner Compromise
Attacking self-hosted runners for persistence, lateral movement into internal networks.
📦 Dependency Attacks
Typosquatting, dependency confusion, and package hijacking on NPM/PyPI/etc.
Learning Modules
Exploiting workflow misconfigurations, secret leakage, and runner attacks.
Attacking CI/CD pipelines, Groovy script console, and runner abuse.
Supply chain attacks via NPM, PyPI, and internal package registries.
Exploiting OIDC federation to steal AWS, GCP, and Azure credentials.
Poisoning Docker images, registry hijacking, and base image attacks.
Finding leaked credentials in repos, logs, and artifacts.
Exploiting Azure Pipelines, variable groups, and service connections.
Attacking GitOps workflows for automatic K8s deployment of backdoors.
State file secrets, malicious modules, and provisioner RCE.
Real-World Supply Chain Attacks
These aren't theoretical. Study them.
| Attack | Impact | Technique |
|---|---|---|
| SolarWinds (2020) | 18,000+ organizations | Build system compromise, backdoor injection |
| Codecov (2021) | 29,000+ customers | Bash uploader script modified to exfiltrate env vars |
| ua-parser-js (2021) | 7M weekly downloads | NPM account takeover, crypto miner injection |
| Log4Shell (2021) | Millions of apps | Dependency vulnerability (not poisoning, but supply chain) |
| PyTorch (2022) | ML community | Dependency confusion on torchtriton |
| CircleCI (2023) | All customers | Session token theft, secrets exposed |
Quick Recon
find . -path "*/.github/workflows/*.yml" -o -path "*/.github/workflows/*.yaml"trufflehog git https://github.com/target/repo --only-verifiednpm pack <package> && tar -xzf *.tgz && cat package/package.json | jq '.scripts'Essential Resources
OWASP Top 10 CI/CD Risks
Industry standard framework for CI/CD security.
PwnHub
GitHub Actions security research tools.