Poisoned Pipeline / CI/CD matrix

CI/CD matrix

Pipeline-specific techniques, heat-mapped by how many catalogued incidents do that thing. Names follow the Common Threat Matrix for CI/CD Pipeline (Mercari Security Team, Mercari Security Team (Hiroki Suezawa), CODE BLUE 2021). The one-line descriptions are ours. A story is listed only when its write-up describes that behavior.

Mapped incidents:  0 1–2 3–4 5+ Dim cells are in the matrix and not yet tied to a case here. Praetorian's Gato write-up (AS24) is red-team research, not a victim incident, so it is not counted.

What is not on this page

A cicd-saas tag is not enough. WordPress plugin backdoors that only carry that tag are not mapped. TeamCity CVE-2024-27198 is a disclosure with a researcher proof, not a victim campaign in the sources read for this pass, so it is not a story. Cells with no case: C06, C09, C10, C13, C16, C18, C21, C25, C28.

C01 Supply chain compromise on CI/CD

A library, action, tool, or image the pipeline trusts is itself malicious.

• AS2 3CX Desktop
  3CX's desktop build shipped malware after the Trading Technologies supply chain reached a build machine.
• AS3 Codecov Breach
  The Codecov bash uploader used inside customer CI was modified to print environment variables.
• AS12 tj-actions/changed-files GitHub Action
  tj-actions/changed-files and the related reviewdog action printed CI secrets into logs.
• AS13 Ultralytics PyPI compromise
  A compromised GitHub Actions workflow published the malicious Ultralytics releases.
• AS16 TanStack Mini Shai-Hulud (CVE-2026-45321)
  TanStack traced the publish to pull_request_target plus Actions cache poisoning.
• AS17 Team PCP CI/CD secrets campaign
  TeamPCP poisoned CI actions and collected runner secrets across GitHub, GitLab, Azure, Jenkins, Bitbucket, and CircleCI.
• AS48 Shai-Hulud first wave (@ctrl/tinycolor)
  Shai-Hulud ran TruffleHog on the host, planted an Actions workflow, and republished with stolen npm tokens.
• AS49 Sha1-Hulud: The Second Coming
  The second Shai-Hulud wave repeated the CI secret harvest and republish.
• AS74 Nx s1ngularity (stolen npm token via Actions injection)
  pull_request_target plus a workflow_dispatch publish job stole NPM_TOKEN and released nx.
• AS118 codfish/semantic-release-action tag hijack (Miasma)
  Floating tags on codfish/semantic-release-action were moved onto malicious commits.
• AS197 actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
  actions-cool tags were moved onto unsigned commits that still ran the real action afterwards.

C02 Valid account of the git host

A personal token, SSH key, password, or cookie for the git service is stolen and reused.

• AS4 php.net git server Zerodium backdoor
  git.php.net was compromised and two commits impersonating PHP developers landed on the server.
• AS28 Keyv / Cacheable ChainDrop worm
  A leftover PAT pushed poisoned commits; the repos' own Actions and npm OIDC published them.
• AS34 GHAPPIER loader via @dforge-core/dforge-mcp trusted publishing
  Push access rewrote the release workflow so any push to main published the loader.
• AS48 Shai-Hulud first wave (@ctrl/tinycolor)
  Shai-Hulud ran TruffleHog on the host, planted an Actions workflow, and republished with stolen npm tokens.
• AS49 Sha1-Hulud: The Second Coming
  The second Shai-Hulud wave repeated the CI secret harvest and republish.
• AS67 mrmustard 0.7.4 PyPI credential stealer via stolen publish token
  Throwaway Actions workflows posted the repo's PyPI and Codecov tokens, then 0.7.4 was uploaded.
• AS74 Nx s1ngularity (stolen npm token via Actions injection)
  pull_request_target plus a workflow_dispatch publish job stole NPM_TOKEN and released nx.
• AS107 Spoofed Dependabot commits and secret-stealing Actions
  Stolen PATs and Dependabot-impersonating commits added a workflow that exfiltrated secrets.
• AS193 Multi-org GitHub PAT campaign mass-cloned repositories
  Stolen employee PATs were used to mass-clone private repos.

C03 Valid account of the CI/CD service

A CI token, session, or integrator OAuth credential is stolen and reused.

• AS14 CircleCI December 2022 / January 2023 incident
  Malware on an employee laptop yielded a CircleCI session; customer env vars and contexts were in reach.
• AS17 Team PCP CI/CD secrets campaign
  TeamPCP poisoned CI actions and collected runner secrets across GitHub, GitLab, Azure, Jenkins, Bitbucket, and CircleCI.
• AS298 Stolen Heroku and Travis CI OAuth tokens cloned private GitHub repos
  Stolen Heroku and Travis CI OAuth tokens listed and cloned private GitHub repos, including npm's.

C04 Admin of the server hosting git

The machine or admin plane that hosts the git service is taken, not just a user account.

• AS4 php.net git server Zerodium backdoor
  git.php.net was compromised and two commits impersonating PHP developers landed on the server.

C05 Modify CI/CD configuration

A workflow, Job DSL, or publish config is changed so the pipeline runs attacker code.

• AS13 Ultralytics PyPI compromise
  A compromised GitHub Actions workflow published the malicious Ultralytics releases.
• AS16 TanStack Mini Shai-Hulud (CVE-2026-45321)
  TanStack traced the publish to pull_request_target plus Actions cache poisoning.
• AS20 @7nohe/openapi-react-query-codegen poisoned publish workflow
  A PR comment triggered a workflow that checked out untrusted code and published with OIDC.
• AS28 Keyv / Cacheable ChainDrop worm
  A leftover PAT pushed poisoned commits; the repos' own Actions and npm OIDC published them.
• AS34 GHAPPIER loader via @dforge-core/dforge-mcp trusted publishing
  Push access rewrote the release workflow so any push to main published the loader.
• AS48 Shai-Hulud first wave (@ctrl/tinycolor)
  Shai-Hulud ran TruffleHog on the host, planted an Actions workflow, and republished with stolen npm tokens.
• AS49 Sha1-Hulud: The Second Coming
  The second Shai-Hulud wave repeated the CI secret harvest and republish.
• AS67 mrmustard 0.7.4 PyPI credential stealer via stolen publish token
  Throwaway Actions workflows posted the repo's PyPI and Codecov tokens, then 0.7.4 was uploaded.
• AS74 Nx s1ngularity (stolen npm token via Actions injection)
  pull_request_target plus a workflow_dispatch publish job stole NPM_TOKEN and released nx.
• AS75 hackerbot-claw autonomous GitHub Actions exploitation
  hackerbot-claw opened PRs against public repos with exploitable Actions and stole tokens.
• AS79 CNCF Antrea Jenkins slash-command credential theft
  Unauthenticated Jenkins slash commands on jenkins.antrea.io ran a Job DSL gadget and credential scrapers.
• AS91 Megalodon mass GitHub repo backdooring via CI
  Megalodon planted secret-stealing workflow files across many GitHub repos.
• AS106 prt-scan 219 malicious PRs stealing CI secrets
  Hundreds of malicious PRs carried a payload that steals CI secrets.
• AS107 Spoofed Dependabot commits and secret-stealing Actions
  Stolen PATs and Dependabot-impersonating commits added a workflow that exfiltrated secrets.
• AS229 kubernetes-el workflow poisoned its repo
  A pwn-request poisoned the kubernetes-el workflow.

C06 Inject code into IaC

Terraform or another IaC file is changed so the pipeline applies attacker infrastructure.

• No named case in this catalogue yet.

C07 Inject code into the build input

Source or the build tree is changed so the pipeline compiles attacker code.

• AS1 Webmin 1.890–1.920 build-server backdoor
  Webmin's build server was exploited and the backdoor was injected into the build tree, not git.
• AS4 php.net git server Zerodium backdoor
  git.php.net was compromised and two commits impersonating PHP developers landed on the server.
• AS5 CCleaner 5.33 signed ShadowPad backdoor
  Piriform's build system was infected and shipped a signed CCleaner binary.
• AS6 SolarWinds
  Orion's build was modified and the signed update is what customers installed.

C08 Inject a bad dependency

The build resolves a dependency the attacker controls.

• AS10 Dependency confusion (Alex Birsan)
  Public packages of internal names executed inside victim build systems.
• AS13 Ultralytics PyPI compromise
  A compromised GitHub Actions workflow published the malicious Ultralytics releases.
• AS20 @7nohe/openapi-react-query-codegen poisoned publish workflow
  A PR comment triggered a workflow that checked out untrusted code and published with OIDC.
• AS22 axios npm remote-access trojan
  Malicious axios versions pulled a fake dependency. The CI tag is the TeamPCP wave, not a separate pipeline takeover.
• AS26 PhantomRaven hidden HTTP npm dependencies
  PhantomRaven's preinstall hook harvests GitHub Actions tokens when the package is installed.
• AS48 Shai-Hulud first wave (@ctrl/tinycolor)
  Shai-Hulud ran TruffleHog on the host, planted an Actions workflow, and republished with stolen npm tokens.
• AS49 Sha1-Hulud: The Second Coming
  The second Shai-Hulud wave repeated the CI secret harvest and republish.
• AS74 Nx s1ngularity (stolen npm token via Actions injection)
  pull_request_target plus a workflow_dispatch publish job stole NPM_TOKEN and released nx.

C09 SSH to CI/CD pipelines

An attacker shells into a runner or pipeline host.

• No named case in this catalogue yet.

C10 Modify production configuration

Stolen credentials are used to change production configuration.

• No named case in this catalogue yet.

C11 Deploy a modified application or image

A trojanized build, package, or image is what ships.

• AS2 3CX Desktop
  3CX's desktop build shipped malware after the Trading Technologies supply chain reached a build machine.
• AS5 CCleaner 5.33 signed ShadowPad backdoor
  Piriform's build system was infected and shipped a signed CCleaner binary.
• AS6 SolarWinds
  Orion's build was modified and the signed update is what customers installed.
• AS13 Ultralytics PyPI compromise
  A compromised GitHub Actions workflow published the malicious Ultralytics releases.
• AS20 @7nohe/openapi-react-query-codegen poisoned publish workflow
  A PR comment triggered a workflow that checked out untrusted code and published with OIDC.
• AS28 Keyv / Cacheable ChainDrop worm
  A leftover PAT pushed poisoned commits; the repos' own Actions and npm OIDC published them.
• AS48 Shai-Hulud first wave (@ctrl/tinycolor)
  Shai-Hulud ran TruffleHog on the host, planted an Actions workflow, and republished with stolen npm tokens.
• AS49 Sha1-Hulud: The Second Coming
  The second Shai-Hulud wave repeated the CI secret harvest and republish.
• AS67 mrmustard 0.7.4 PyPI credential stealer via stolen publish token
  Throwaway Actions workflows posted the repo's PyPI and Codecov tokens, then 0.7.4 was uploaded.
• AS74 Nx s1ngularity (stolen npm token via Actions injection)
  pull_request_target plus a workflow_dispatch publish job stole NPM_TOKEN and released nx.

C12 Compromise the CI/CD server

The build server, CI vendor production, or artifact service itself is taken.

• AS1 Webmin 1.890–1.920 build-server backdoor
  Webmin's build server was exploited and the backdoor was injected into the build tree, not git.
• AS5 CCleaner 5.33 signed ShadowPad backdoor
  Piriform's build system was infected and shipped a signed CCleaner binary.
• AS6 SolarWinds
  Orion's build was modified and the signed update is what customers installed.
• AS14 CircleCI December 2022 / January 2023 incident
  Malware on an employee laptop yielded a CircleCI session; customer env vars and contexts were in reach.
• AS190 In-the-wild JFrog Artifactory auth bypass (CVE-2026-42016/42018/82329)
  In-the-wild Artifactory auth bypass yielded admin on the artifact service.
• AS299 North Korean actors exploited TeamCity CVE-2023-42793
  Diamond Sleet and Onyx Sleet exploited TeamCity CVE-2023-42793 and deployed backdoors on the CI server.

C13 Implant a CI/CD runner image

A runner or agent image is replaced so later jobs start compromised.

• No named case in this catalogue yet.

C14 Take a deploy credential from the CI stage

A publish token or OIDC identity available to CI is stolen and used to release.

• AS13 Ultralytics PyPI compromise
  A compromised GitHub Actions workflow published the malicious Ultralytics releases.
• AS16 TanStack Mini Shai-Hulud (CVE-2026-45321)
  TanStack traced the publish to pull_request_target plus Actions cache poisoning.
• AS20 @7nohe/openapi-react-query-codegen poisoned publish workflow
  A PR comment triggered a workflow that checked out untrusted code and published with OIDC.
• AS28 Keyv / Cacheable ChainDrop worm
  A leftover PAT pushed poisoned commits; the repos' own Actions and npm OIDC published them.
• AS34 GHAPPIER loader via @dforge-core/dforge-mcp trusted publishing
  Push access rewrote the release workflow so any push to main published the loader.
• AS48 Shai-Hulud first wave (@ctrl/tinycolor)
  Shai-Hulud ran TruffleHog on the host, planted an Actions workflow, and republished with stolen npm tokens.
• AS49 Sha1-Hulud: The Second Coming
  The second Shai-Hulud wave repeated the CI secret harvest and republish.
• AS67 mrmustard 0.7.4 PyPI credential stealer via stolen publish token
  Throwaway Actions workflows posted the repo's PyPI and Codecov tokens, then 0.7.4 was uploaded.
• AS74 Nx s1ngularity (stolen npm token via Actions injection)
  pull_request_target plus a workflow_dispatch publish job stole NPM_TOKEN and released nx.

C15 Compromise another pipeline

Access from one CI system is used to reach a different pipeline.

• AS17 Team PCP CI/CD secrets campaign
  TeamPCP poisoned CI actions and collected runner secrets across GitHub, GitLab, Azure, Jenkins, Bitbucket, and CircleCI.

C16 Add an approver with admin rights

An admin changes who can approve so a bad change looks reviewed.

• No named case in this catalogue yet.

C17 Bypass review

A change reaches the default branch or a publish job without the review the project thought it had.

• AS20 @7nohe/openapi-react-query-codegen poisoned publish workflow
  A PR comment triggered a workflow that checked out untrusted code and published with OIDC.
• AS74 Nx s1ngularity (stolen npm token via Actions injection)
  pull_request_target plus a workflow_dispatch publish job stole NPM_TOKEN and released nx.
• AS75 hackerbot-claw autonomous GitHub Actions exploitation
  hackerbot-claw opened PRs against public repos with exploitable Actions and stole tokens.
• AS79 CNCF Antrea Jenkins slash-command credential theft
  Unauthenticated Jenkins slash commands on jenkins.antrea.io ran a Job DSL gadget and credential scrapers.
• AS107 Spoofed Dependabot commits and secret-stealing Actions
  Stolen PATs and Dependabot-impersonating commits added a workflow that exfiltrated secrets.

C18 Reach a secret manager from another repo's CI

A job started by a different repository can read secrets it should not see.

• No named case in this catalogue yet.

C19 Modify CI/CD caches

A cache is poisoned, or a later job reads attacker-controlled cache contents.

• AS16 TanStack Mini Shai-Hulud (CVE-2026-45321)
  TanStack traced the publish to pull_request_target plus Actions cache poisoning.

C20 Dump environment variables in CI/CD

Secrets in the job environment are printed, posted, or scanned.

• AS3 Codecov Breach
  The Codecov bash uploader used inside customer CI was modified to print environment variables.
• AS12 tj-actions/changed-files GitHub Action
  tj-actions/changed-files and the related reviewdog action printed CI secrets into logs.
• AS14 CircleCI December 2022 / January 2023 incident
  Malware on an employee laptop yielded a CircleCI session; customer env vars and contexts were in reach.
• AS16 TanStack Mini Shai-Hulud (CVE-2026-45321)
  TanStack traced the publish to pull_request_target plus Actions cache poisoning.
• AS17 Team PCP CI/CD secrets campaign
  TeamPCP poisoned CI actions and collected runner secrets across GitHub, GitLab, Azure, Jenkins, Bitbucket, and CircleCI.
• AS20 @7nohe/openapi-react-query-codegen poisoned publish workflow
  A PR comment triggered a workflow that checked out untrusted code and published with OIDC.
• AS26 PhantomRaven hidden HTTP npm dependencies
  PhantomRaven's preinstall hook harvests GitHub Actions tokens when the package is installed.
• AS48 Shai-Hulud first wave (@ctrl/tinycolor)
  Shai-Hulud ran TruffleHog on the host, planted an Actions workflow, and republished with stolen npm tokens.
• AS49 Sha1-Hulud: The Second Coming
  The second Shai-Hulud wave repeated the CI secret harvest and republish.
• AS67 mrmustard 0.7.4 PyPI credential stealer via stolen publish token
  Throwaway Actions workflows posted the repo's PyPI and Codecov tokens, then 0.7.4 was uploaded.
• AS74 Nx s1ngularity (stolen npm token via Actions injection)
  pull_request_target plus a workflow_dispatch publish job stole NPM_TOKEN and released nx.
• AS75 hackerbot-claw autonomous GitHub Actions exploitation
  hackerbot-claw opened PRs against public repos with exploitable Actions and stole tokens.
• AS79 CNCF Antrea Jenkins slash-command credential theft
  Unauthenticated Jenkins slash commands on jenkins.antrea.io ran a Job DSL gadget and credential scrapers.
• AS91 Megalodon mass GitHub repo backdooring via CI
  Megalodon planted secret-stealing workflow files across many GitHub repos.
• AS106 prt-scan 219 malicious PRs stealing CI secrets
  Hundreds of malicious PRs carried a payload that steals CI secrets.
• AS107 Spoofed Dependabot commits and secret-stealing Actions
  Stolen PATs and Dependabot-impersonating commits added a workflow that exfiltrated secrets.
• AS117 Miri writes env secrets into target/ readable from PR caches
  Miri wrote env vars into target/, and a later PR could read that Actions cache. Not an implanted cache payload.

C21 Access cloud metadata from the runner

The job queries the cloud metadata service for a role credential.

• No named case in this catalogue yet.

C22 Read a credentials file on the runner

A file mounted into the job (keys, kubeconfig, cloud config) is read.

• AS48 Shai-Hulud first wave (@ctrl/tinycolor)
  Shai-Hulud ran TruffleHog on the host, planted an Actions workflow, and republished with stolen npm tokens.
• AS49 Sha1-Hulud: The Second Coming
  The second Shai-Hulud wave repeated the CI secret harvest and republish.

C23 Take credentials from the CI admin console

An admin session on the CI or artifact service reads stored customer secrets.

• AS14 CircleCI December 2022 / January 2023 incident
  Malware on an employee laptop yielded a CircleCI session; customer env vars and contexts were in reach.
• AS190 In-the-wild JFrog Artifactory auth bypass (CVE-2026-42016/42018/82329)
  In-the-wild Artifactory auth bypass yielded admin on the artifact service.

C24 Exploit a remote service from the pipeline

A CI job is used as the foothold to attack another service.

• AS145 GitHub Actions abuse for cPanel/WHM exploitation
  GitHub Actions jobs were the compute used to exploit cPanel and WHM.

C25 Monorepo cross-folder credential

A job in one folder of a monorepo can read another folder's credentials.

• No named case in this catalogue yet.

C26 Exfiltrate production data

Stolen credentials are used to read production data, not only CI settings.

• AS298 Stolen Heroku and Travis CI OAuth tokens cloned private GitHub repos
  Stolen Heroku and Travis CI OAuth tokens listed and cloned private GitHub repos, including npm's.

C27 Clone git repositories

Private repositories are listed and cloned with a stolen token.

• AS192 Nx Console VS Code 18.95.0 (GitHub internal repo theft)
  The Nx Console extension was the foothold; the CI/CD-relevant act was cloning GitHub-owned private repos.
• AS193 Multi-org GitHub PAT campaign mass-cloned repositories
  Stolen employee PATs were used to mass-clone private repos.
• AS298 Stolen Heroku and Travis CI OAuth tokens cloned private GitHub repos
  Stolen Heroku and Travis CI OAuth tokens listed and cloned private GitHub repos, including npm's.

C28 Denial of service of the pipeline

The CI/CD service itself is taken down.

• No named case in this catalogue yet.