How We Hacked a Software Supply Chain for $50K
Scraped JavaScript front-end files of the target and used ASTs to identify import/require statements which lead to discovering a public container with NPM credentials.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
How a Single Vulnerability Can Bring Down the JavaScript Ecosystem landh.tech
Cache poisoning attack on the NPM registry rendering packages unavailable.
-
How we exploited a remote code execution vulnerability in math.js capacitorset.github.io
-
How I hacked into Google's internal corporate assets observationsinsecurity.com
More ways to find dependencies in code for Dependency Confusion.
-
-
-
Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies medium.com
Researchers uploaded malicious packages with internal company names, gaining access to Apple, Microsoft, and others due to dependency confusion.
CI/CD Attacks › Techniques > Initial Code Execution: “Scraped JavaScript front-end files of the target and used ASTs to identify import/require statements which lead to discovering a public container with NPM credentials.”