Podcast
NetRise’s Tom Pace on why telecom’s Salt Typhoon problem may never go away
Small CI/CD changes can have major consequences
What looks like a routine workflow update can create a direct path to code execution, secret theft, and repository compromise.
The risk is real and easy to overlook
This report examines a validated attack path that required no maintainer approval and only minimal attacker effort.
The lessons apply far beyond one project
This report analyzes a proven attack path rooted in a known CI/CD misconfiguration.
Key Insights
This attack didn’t require sophisticated tooling—just a pull request.
- A “pwn request” vulnerability enabled arbitrary code execution in the CI pipeline
- No privileges required—any GitHub user could trigger the exploit
- Secrets, including GitHub tokens and third-party credentials, were immediately exposed
- The compromised token enabled direct code changes, workflow manipulation, and release tampering
What You'll Learn
Understand how a routine workflow becomes a supply chain attack—and how to stop it.
- How pull_request_target turns CI pipelines into attack surfaces
- The exact mechanics of a “pwn request” exploit
- How attackers move from untrusted code to trusted execution
- What secrets are exposed—and how they’re weaponized
- The fastest path to containment, hardening, and prevention
