Poisoned Pipeline / Techniques / T0186
Source code leak
SCM Posture CI/CD Posture
When source code is disclosed, it can lead to various risks, including the loss of intellectual property, legal issues, and competitive disadvantage.
However, in the context of supply chain security, source code disclosure can expose vulnerabilities such as third-party library vulnerabilities, hard-coded secrets, code weaknesses, and logic bugs.
These vulnerabilities can be exploited as initial access points to further attack the supply chain.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Mitigations
- M1661 Revoke user permissions
- M1860 Implement strong authentication mechanisms
- M1861 Implement strong authorization mechanisms
Detections
- D1860 Configure audit logs for SCM
Observed in incidents (4)
- Nx Console VS Code 18.95.0 (GitHub internal repo theft)
- Azazel harvested GitLab CI secrets and called a local MCP tool on a victim
- Multi-org GitHub PAT campaign mass-cloned repositories
- TanStack Mini Shai-Hulud (CVE-2026-45321)