← Home
#CI-CD
10 stories tagged.
The Worm That Won't Stop: TeamPCP's Mini Shai-Hulud Supply Chain Campaign Devours SAP, Bitwarden, and PyTorch Lightning
9 min · 0 sources
The Comment That Poisoned a Million Pipelines: elementary-data's GitHub Actions Script Injection and the Rise of CI-Native Supply Chain Attacks
10 min · 0 sources
The Pipeline Is the Payload: How GitHub Actions Script Injection Turned elementary-data Into a Credential Harvester for 1.1 Million Developers
11 min · 0 sources
The Package That Waited: BufferZoneCorp's Sleeper Gems and Go Modules Reveal a New CI Pipeline Takeover Playbook
9 min · 0 sources
The Pipeline Is the Weapon: How elementary-data's GitHub Actions Injection Turned 1.1 Million PyPI Installs Into a Credential Vacuum
11 min · 0 sources
The Sleeper Cluster Wakes: BufferZoneCorp + TeamPCP's Cross-Ecosystem Supply Chain Wave (Ruby, Go, npm, GitHub Actions)
11 min · 0 sources
The CI/CD Killswitch: GitHub Actions' Systemic Design Flaws and the Eighteen-Month Chain from spotbugs to Bitwarden
10 min · 0 sources
The Trust Ladder: How TeamPCP Climbed From Security Scanners to Password Managers — Six Weeks of Supply Chain Escalation, Post-Mortem
10 min · 0 sources
The Scanner That Got Scanned: Trivy's Double Breach, Hackerbot-Claw, and the AI-Automated Future of GitHub Actions Supply Chain Attacks
10 min · 0 sources
CVE-2024-23897: Jenkins CLI Arbitrary File Read via args4j @ Expansion
6 min · 3 sources