/cicd-supply-chain

name: cicd-supply-chain
description: Use when attacking or auditing a CI/CD pipeline or software supply chain — pwn requests, poisoned pipeline execution, compromised/mutable-tag actions, dependency confusion, registry worms, runner backdoors, OIDC trust abuse, SLSA/provenance
metadata:
  type: offensive
  phase: weaponize-delivery-exploit
  tools: gato-x, zizmor, octoscan, poutine, raven, trufflehog, gitleaks, cosign, slsa-verifier, gh, glab, syft
  mitre: [T1195.001, T1195.002, T1199, T1525, T1556, T1078.004, T1648]
kill_chain:
  phase: [weaponize, delivery, exploit, actions]
  step: [2, 3, 4, 7]
  attck_tactics: [TA0001, TA0003, TA0004, TA0006, TA0008]
  attck_techniques: [T1195, T1195.001, T1195.002, T1199, T1525, T1556, T1078.004, T1648, T1552.004, T1059]
depends_on: [recon-osint, vulnerability-analysis]
feeds_into: [cloud-security, red-team-ops, initial-access]
inputs: [target_repos, ci_config, registry_namespaces, oidc_trust_policies]
outputs: [pipeline_finding, exfiltrated_secrets, malicious_artifact, attack_path, provenance_gap]
references:
  - references/pipeline-poisoning.md
  - references/action-dependency-compromise.md
  - references/package-registry-attacks.md
  - references/runner-attacks.md
  - references/secrets-oidc-abuse.md
  - references/build-integrity-defense.md
scripts:
  - scripts/workflow_auditor.py
  - scripts/dependency_confusion.py
  - scripts/oidc_trust_auditor.py
  - scripts/malicious_action_scanner.py
  - scripts/runner_recon.sh
  - scripts/provenance_verify.sh

CI/CD Pipeline Poisoning & Supply-Chain Attacks

When to Activate

• Auditing or attacking GitHub Actions / GitLab CI / Jenkins pipelines for code execution
• Hunting `pull_request_target` / `workflow_run` "pwn requests" and Poisoned Pipeline Execution (PPE)
• Assessing compromised third-party Actions, mutable version tags, and Actions cache poisoning
• Dependency confusion, typo/slopsquatting, and malicious package/install-hook payloads
• Self-hosted / non-ephemeral runner abuse and runner backdoors
• CI secret exfiltration and OIDC cloud-role (AWS/GCP/Azure) trust-policy abuse
• Validating SLSA build provenance and signing gates (defense / blue-team validation)

Technique Map

| Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | Pwn request (`pull_request_target` checkout of fork head) | T1195.001 | CWE-269 | references/pipeline-poisoning.md | scripts/workflow_auditor.py | | Script injection (`${{ github.event.* }}` into `run:`) | T1059 | CWE-94 | references/pipeline-poisoning.md | scripts/workflow_auditor.py | | Direct / Indirect PPE (workflow or build-file modification) | T1195.001 | CWE-913 | references/pipeline-poisoning.md | scripts/workflow_auditor.py | | GitLab `.gitlab-ci.yml` poisoning / pipeline-as-user (CVE-2024-6678) | T1648 | CWE-863 | references/pipeline-poisoning.md | scripts/workflow_auditor.py | | Compromised Action via mutable tag (CVE-2025-30066 tj-actions) | T1195.001 | CWE-494 | references/action-dependency-compromise.md | scripts/malicious_action_scanner.py | | Transitive Action compromise (CVE-2025-30154 reviewdog) | T1195.001 | CWE-1357 | references/action-dependency-compromise.md | scripts/malicious_action_scanner.py | | Actions cache poisoning (cross-workflow escalation) | T1525 | CWE-349 | references/action-dependency-compromise.md | scripts/malicious_action_scanner.py | | Dependency confusion (internal name on public registry) | T1195.002 | CWE-427 | references/package-registry-attacks.md | scripts/dependency_confusion.py | | Typo / slopsquatting + malicious install hook | T1195.002 | CWE-829 | references/package-registry-attacks.md | scripts/dependency_confusion.py | | Self-replicating registry worm (Shai-Hulud npm) | T1195.002 | CWE-829 | references/package-registry-attacks.md | scripts/malicious_action_scanner.py | | Self-hosted / non-ephemeral runner abuse & backdoor | T1199 | CWE-668 | references/runner-attacks.md | scripts/runner_recon.sh | | Jenkins Script Console RCE (`/script`, CVE-2024-23897) | T1648 | CWE-306 | references/runner-attacks.md | scripts/runner_recon.sh | | CI secret exfiltration (`toJSON(secrets)`, GhostAction) | T1552.004 | CWE-522 | references/secrets-oidc-abuse.md | scripts/oidc_trust_auditor.py | | OIDC trust-policy abuse (missing/`*` `sub`, wrong org wildcard) | T1078.004 | CWE-1390 | references/secrets-oidc-abuse.md | scripts/oidc_trust_auditor.py | | Build provenance / signing gate validation (defense) | T1195 | CWE-347 | references/build-integrity-defense.md | scripts/provenance_verify.sh |

Quick Start

# 0. Recon: enumerate workflows, triggers, used actions across an org (read-only token)
gh repo list ORG --limit 1000 --json nameWithOwner -q '.[].nameWithOwner' > repos.txt
python3 scripts/workflow_auditor.py --repos repos.txt --token "$GH_TOKEN" --out findings.json

# 1. Static audit any cloned repo for pwn-requests + injection sinks (offline, no token)
git clone https://github.com/ORG/REPO && python3 scripts/workflow_auditor.py --path REPO

# 2. Flag risky/mutable third-party Action refs (unpinned tags = supply-chain exposure)
python3 scripts/malicious_action_scanner.py --path REPO --check-pins --check-known-bad

# 3. Dependency confusion: find internal names not registered on public registries
python3 scripts/dependency_confusion.py --manifest REPO/package.json --registry npm
python3 scripts/dependency_confusion.py --manifest REPO/requirements.txt --registry pypi

# 4. OIDC abuse: audit AWS IAM trust policies tied to GitHub's OIDC provider
python3 scripts/oidc_trust_auditor.py --provider github --cloud aws --profile target

# 5. Runner recon (run ON a compromised self-hosted runner during an engagement)
bash scripts/runner_recon.sh

# 6. Defensive validation: verify SLSA provenance + cosign signature before promote
bash scripts/provenance_verify.sh --image ghcr.io/org/app:tag --repo org/app

Recommended OSS tooling: `gato-x` (offensive GHA enumeration/PPE)