CI/CD Attacks
88 items from tupletype/awesome-cicd-attacks ★635
-
GitHub comments abused to push malware via Microsoft repo URLs bleepingcomputer.com
Hidden GitHub comment link.
-
Employee Personal GitHub Repos Expose Internal Azure and Red Hat Secrets aquasec.com
Employee's personal GitHub repos expose internal Azure & Red Hat secrets.
-
GitHub Dataset Research Reveals Millions Potentially Vulnerable to RepoJacking aquasec.com
Millions of GitHub repos are vulnerable to RepoJacking due to org renames, leading to potential code execution.
-
Can You Trust Your VSCode Extensions? aquasec.com
Impersonate popular VSCode extensions and trick unknowing developers into downloading them.
-
Fortune 500 at Risk: 250M Artifacts Exposed via Misconfigured Registries aquasec.com
Misconfigured public registries with software artifacts containing sensitive proprietary code and secrets.
-
Invisible Ghost: Alarming Vulnerability in GitHub Copilot apexhq.ai
Using hidden Unicode characters to manipulate GitHub Copilot's suggestions.
-
The Monsters in Your Build Cache – GitHub Actions Cache Poisoning adnanthekhan.com
Allows attackers to compromise workflows even with limited permissions by exploiting vulnerabilities or dependency flaws, attackers steal cache tokens, fill the cache to force evictions, and replace legitimate entries with malicious code.
-
One Supply Chain Attack to Rule Them All – Poisoning GitHub's Runner Images adnanthekhan.com
A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.
