Poisoned Pipeline / Techniques / T0166
Trigger pipeline execution
The Trigger pipeline execution (Poisoned pipeline execution) attack abuses permissions against an SCM repository, in a way that causes a CI pipeline to execute malicious commands.
Users that have permissions to manipulate the CI configuration files, or other files which the CI pipeline job relies on, can modify them to contain malicious commands, ultimately poisoning the CI pipeline executing these commands.
Pipelines executing unreviewed code, for example those which are triggered directly off of pull requests or commits to arbitrary repository branches, are more susceptible to Trigger pipeline execution.
The reason is that these scenarios, by design, contain code which has not undergone any reviews or approvals.
Once able to execute malicious code within the CI pipeline, the attacker can conduct a wide array of malicious operations, all within the context of the pipelines identity.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://medium.com/cider-sec/ppe-poisoned-pipeline-execution-34f4e8d0d4e9
- https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust
- https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution
Mitigations
- M1660 Isolate pipeline for unreviewed code
- M1661 Revoke user permissions
- M1662 Evaluate pipeline execution permissions
- M1730 Implement code reviews
- M1732 Implement code scanning for security risks
Detections
- D1590 Implement continuous monitoring and logging of the CI/CD process
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (18)
- mrmustard 0.7.4 PyPI credential stealer via stolen publish token
- Stolen GitHub tokens planted a secret-dumping workflow in 850+ accounts and pulled the logs back through the API
- tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
- Self-hosted GitHub Actions runners (Praetorian Gato)
- @subql/common 5.8.3 published after a CI artifact swap
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- Nx s1ngularity (stolen npm token via Actions injection)
- GitHub Actions abuse for cPanel/WHM exploitation
- Keyv / Cacheable ChainDrop worm
- @7nohe/openapi-react-query-codegen poisoned publish workflow
- Shai-Hulud first wave (@ctrl/tinycolor)
- GHAPPIER loader via @dforge-core/dforge-mcp trusted publishing
- LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader
- hackerbot-claw autonomous GitHub Actions exploitation
- TanStack Mini Shai-Hulud (CVE-2026-45321)
- Megalodon mass GitHub repo backdooring via CI
- CNCF Antrea Jenkins slash-command credential theft
- prt-scan 219 malicious PRs stealing CI secrets