---
name: supply-chain-and-ci-cd
description: "Guides a reviewer through auditing software supply chain and CI/CD trust boundaries — dependencies, build/install scripts, workflows, runners, secrets, and release signing — to find where untrusted input reaches privileged execution."
---

# Software supply chain and CI/CD

Hijacked or malicious packages, dependency confusion, build pipelines and GitHub Actions workflows, release and signing.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23._

## Approaching supply chain and CI/CD review

Start by mapping the trust boundaries, not the code. You are looking for places where untrusted input (a PR, a package name, a tag, a cache key) reaches something privileged (a token, a runner, a publish step).

**Map first:**
1. **Dependency graph** — direct and transitive, plus every registry/index each resolves from. Note internal-only names.
2. **Build and install scripts** — `postinstall`, `prepare`, setup hooks, Makefiles, Dockerfiles. What do they read and where does output go?
3. **CI workflows** — every trigger, every `uses:`, every `run:` block. Flag `pull_request_target`, self-hosted runners, and anything checking out PR head.
4. **Secrets and tokens** — where they live, what scope they carry, what can reach them, and whether logs echo them.
5. **Publish and signing** — who can publish, how tokens are stored, whether release artifacts are signed and verified.

**Questions that surface weaknesses:**
- Can an outside contributor influence what code runs in a privileged context?
- Are actions pinned to SHAs, or to movable tags?
- Could an internal package name resolve from a public registry?
- Does any install/import step touch env vars, key files, or the network?
- Do bots validate all inputs, or only the first page / first event?
- Are cache keys or archive paths attacker-controlled?
- Do failing tools print URLs or env vars into public logs?
- Are retired namespaces still referenced anywhere?

**Using the patterns:** treat each as a checklist item against your map. For every dependency, workflow, and publish path, ask which pattern it matches. Confirm with the actual file or config — don't assume. Report the trust boundary crossed, the input, and the privileged sink.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Install hooks harvest credentials
Install/build-time code reading env, tokens or memory and sending them out

_15 reports · one confirmed bounty: $1,500._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/install-hook-credential-stealer.md

### Stolen publish token ships backdoor
Publish rights reachable by stolen tokens, compromised accounts, or workflows running untrusted code

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/stolen-token-publish-backdoor.md

### Import-time credential stealer in packages
Package code that runs on import/require and touches secrets, network, or process memory

_8 reports._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/import-time-credential-stealer.md

### Mutable action tag repointing
Actions pinned to tags or branches instead of full commit SHAs, letting a force-push run attacker code

_7 reports._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/mutable-action-tag-repoint.md

### Public registry shadowing of internal package names
Internal package, gem, plugin or dependency names that resolve from a public registry or extra index

_6 reports · 4 confirmed bounties, median $1,500, up to $5,000._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/dependency-confusion-public-shadow.md

### pull_request_target fork code execution
Privileged workflow that checks out or runs untrusted PR head code, exposing secrets and write tokens

_5 reports · 4 confirmed bounties, median $7,500, up to $25,000._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/pr-target-untrusted-checkout.md

### Self-hosted runners on fork PRs
Public repo workflows running untrusted fork PR code on persistent self-hosted runners

_5 reports · 4 confirmed bounties, median $7,750, up to $20,000._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/self-hosted-runner-fork-execution.md

### Untrusted PR metadata into shell
Attacker-set PR, issue or comment fields expanded into run/script blocks as code

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/ci-shell-injection-untrusted-metadata.md

### CI cache poisoning and token leakage
Client-controlled cache keys and unrestricted archive extraction letting untrusted code poison privileged CI workflows

_4 reports · 3 confirmed bounties, median $1,000, up to $2,000._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/cache-poisoning-token-theft.md

### Compromised maintainer pushes malicious code
Unprotected default branch, dormant or single maintainer with push rights, no required review or signed commits

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/compromised-maintainer-push.md

### Bot guard bypass via edits
Bots that validate only on create or only the first page of PR files, then trust the result

_3 reports · one confirmed bounty: $25,000._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/bot-guard-bypass-edits.md

### Secrets leaked in CI logs
Credentials in remote URLs or env vars that failing CI tools echo into public logs

_3 reports · one confirmed bounty: $2,000._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/secret-in-logs-or-url.md

### Retired namespace re-registration hijack
References to renamed or deleted owners, orgs, or packages whose old names are free to re-register

_3 reports · one confirmed bounty: $4,000._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/namespace-reuse-hijack.md

### PR metadata reaching privileged CI secrets
Untrusted PR title, branch name, or head ref flowing into privileged workflow shell or checkout

_3 reports · one confirmed bounty: $7,500._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/pr-metadata-secret-exfil.md

### Typosquat build script payload dropper
Stable zero-dependency package suddenly gains a near-named dependency whose build or install script fetches remote code

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/supply-chain-and-ci-cd/typosquat-build-script-payload.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Abbreviated hash collision**: Build or dependency resolution using short commit hashes that can resolve ambiguously (https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2019-11-12-github-actions-dos-html.md)
- **Build deps fetched insecurely**: Build dependencies fetched over plain HTTP or without integrity or hash verification (https://bugbountylibrary.com/r/h1%3A1039504.md)
- **CI server trusts any IdP**: Internet-exposed CI server accepting any external identity provider account as admin (https://bugbountylibrary.com/r/h1%3A231460.md)
- **CI token survives user block**: CI job tokens still valid after the triggering user is blocked or removed (https://bugbountylibrary.com/r/h1%3A497047.md)
- **Signature parser disagreement**: Signature verification parsing author or identity lines differently than the signing tool (https://bugbountylibrary.com/r/blog%3Aiter-ca-post-gh-sig-pwn.md)