supply chain security
46 posts
Vercel hands attackers your build pipeline
Technical IR playbook for a Vercel CI/CD compromise: attack chain, MITRE ATT&CK mapping, telemetry gaps, containment sequence, and residual exposure.
How Trust Delegation Without Revalidation Creates Systemic Failure
Systems optimized for trust delegation without revalidation create persistent vulnerabilities. When automation assumes ongoing validity from trusted sources, adversaries exploit consistency-without breaking in-to propagate compromise at scale.
axios CVE-2025-3891: What the Advisories Don't Say About Immutable Images
CVE-2025-3891 in axios allows prototype pollution leading to RCE. This post reveals why deployed container images remain at risk even after patching, due to missing artifact provenance and immutable verification.
A Trivy-based CI/CD misconfiguration led to credential exposure in a Cisco-related incident
A review of how a misconfigured Trivy scan in Cisco's CI/CD pipeline led to AWS credential exposure due to unverified post-scan execution. Explores the systemic failure behind treating scanning outputs as trusted signals.
Cisco's Source Code Breach Was Structural, Not Accidental
Cisco's source code breach wasn't a fluke. It was the predictable result of credential drift, third-party trust gaps, and dev infrastructure treated as low-risk.
How Trust in Open-Source Updates Becomes a Systemic Failure Mode
A structural analysis of how trust in open-source updates becomes exploitable when systems assume past safety implies future safety, using the Trivy compromise as a case study.
ShinyHunters, Trivy, and the Pipeline Identity Problem
ShinyHunters cloned 300 Cisco repositories through Trivy running in a CI/CD pipeline. This is what failed structurally, why it failed, and what pipeline identity enforcement must look like.
The Advisory Told You to Update. It Didn't Tell You What's Already Running.
Patching the advisory isn't enough. If your CI pipeline ran during the compromise window, the compromised code is baked into your container images and still running. Here's how to find it.
Trivy Supply Chain Attack Exposes Cisco Source Code
ShinyHunters stole Cisco source code via Trivy supply chain attack due to exposed AWS keys in CI/CD pipelines. Here's how it happened and what you must fix now.
Trivy Supply Chain Attack Exposes Cisco's Source Code
ShinyHunters stole Cisco's source code via Trivy supply chain attack. A compromised Docker image led to AWS key exposure and 300 repos cloned. The real failure was trusting tools without verifying integrity.