Under the Radar: How we found 0-days in the Build Pipeline of OSS Packages

The talk starts from the claim that build pipelines in open source projects are an underexamined part of the software supply chain. CI/CD systems run with high privileges, hold secrets such as publishing tokens and signing keys, and react to events from outside contributors, which makes them attractive targets. The speaker walks through recent incidents in which a popular GitHub Action and an npm release workflow were abused, leading to exposed credentials and malicious package versions, and notes that an AI coding agent helped introduce one of the vulnerable workflows.

The middle of the talk covers the main vulnerability classes. Dangerous triggers such as pull_request_target can expose secrets to pull requests from forks. Template injection occurs when untrusted fields such as issue bodies or branch names are interpolated into scripts. Bots such as Dependabot can be abused as a confused deputy, and non-ephemeral self-hosted runners allow persistence. The speaker introduces the idea of "living off the pipeline", where legitimate tools such as static site generators, scanners and shells are steered into running attacker code through config files or environment variables. A live demo walks through progressively harder exploits against a practice repository. The team also reports scanning around 200,000 repositories, with a large number of workflow findings and many disclosures to affected maintainers.

The closing guidance is practical. Teams should restrict which actions can run, default workflow tokens to read-only, require approval for workflows triggered by outside contributors, use protected environments and OIDC instead of long-lived credentials, pin dependencies, and avoid self-hosted runners in public repositories. Static analysis of workflow files and runtime monitoring of runners are suggested as additional layers.