Compromised AsyncAPI npm Packages Inside a CI Supply-Chain A...

src/pentesting-ci-cd/github-security/abusing-github-actions/README.md

@@ -194,6 +194,46 @@ steps:
 
 - Because the job inherits write-scoped `GITHUB_TOKEN`, artifact credentials, and registry API keys, a single interpolation bug is enough to leak long-lived secrets or push a backdoored release.<sup>[[14]](#references)[[19]](#references)</sup>
 
+#### Delayed secret capture and action post-hook tampering
+
+A malicious build does not need to receive every credential immediately. Code reached through a privileged preview, documentation build, test, or package script can write an observer with owner-only permissions and start it as a detached process. The observer remains alive while later steps initialize credentials, then reads same-user process environments from `/proc/[0-9]*/environ`; JavaScript action inputs appear as `INPUT_*` variables, so action-specific values such as `INPUT_GITHUB-TOKEN` may be visible even when `GITHUB_TOKEN` was absent from the original process.<sup>[[48]](#references)</sup>
+
+```javascript
+const observer = `/tmp/observer-${process.pid}.js`;
+await fs.writeFile(observer, observerCode, { mode: 0o600, flag: 'wx' });
+spawn(process.execPath, [observer], {
+  detached: true, stdio: 'ignore', cwd: '/tmp'
+}).unref();
+```
+
+Downloaded JavaScript actions provide another same-job persistence point. Runner copies normally live below `/home/runner/work/_actions/<owner>/<action>/<ref>/`; if untrusted code can modify them, it can patch the file named by an action's `post` entry. For example, the pinned `actions/checkout@v5` manifest used `dist/index.js` for both `main` and `post`, so a change made after checkout's main phase executes again during post-job cleanup, after checkout has handled its credential input.<sup>[[47]](#references)[[48]](#references)</sup>
+
+```yaml
+runs:
+  using: node24
+  main: dist/index.js
+  post: dist/index.js
+```
+
+High-signal runner telemetry includes a build process enumerating `/proc/*/environ`, detached interpreters created from `/tmp`, and writes below `_actions/` after actions have been downloaded. Ephemeral runners prevent cross-job persistence but not this within-job sequence; isolate untrusted builds in a separate no-secrets job and treat action directories as integrity-sensitive during execution.<sup>[[19]](#references)[[20]](#references)[[48]](#references)</sup>
+
+#### Recovering erased PwnRequest and release evidence
+
+Deleting an attacker account, fork, branch, PR, or workflow-run record does not necessarily erase the identifiers needed for reconstruction. Given a suspected run ID, the Actions API can retain the event, workflow path, head SHA/branch, timestamps, commit identity, and deleted fork metadata; the repository activity endpoint can independently expose branch creation and force-push transitions by an automation identity.<sup>[[48]](#references)</sup>
+
+```bash
+gh api "repos/$OWNER/$REPO/actions/runs/$RUN_ID" \
+  --jq '{event,path,head_sha,head_branch,head_repository,created_at,updated_at}'
+gh api "repos/$OWNER/$REPO/activity?per_page=100" \
+  --jq '.[] | select(.activity_type=="branch_creation" or .activity_type=="force_push") | {timestamp,activity_type,actor:.actor.login,ref,before,after}'
+```
+
+Use the recovered `head_sha` against the **upstream** repository (`gh api "repos/$OWNER/$REPO/commits/$HEAD_SHA"`), because a deleted fork's Git object may still be reachable through the repository network. See [Accessible Deleted Data in GitHub](../accessible-deleted-data-in-github.md) for the underlying object-retention behavior.<sup>[[48]](#references)</sup>
+
+A stolen bot/PAT can then create or force-push a release branch and choose a commit-message prefix that satisfies workflow predicates such as `startsWith(github.event.commits[0].message, 'fix:')`. Conditions inside workflow YAML are routing logic, not an authorization boundary once the actor controls an accepted ref; enforce releases with branch/tag protection, protected environments, and independent approval outside attacker-editable workflow logic.<sup>[[19]](#references)[[48]](#references)</sup>
+
+Finally, correlate missing Actions records with package provenance or Sigstore/Rekor entries. A surviving statement can identify the source SHA, ref, workflow, trigger, and run invocation URI even when the UI run was deleted; it proves what authorized builder produced the artifact, but not that the source change or invocation was approved. More npm-specific abuse and provenance limitations are covered in [GH Actions - npm Supply Chain Abuse](gh-actions-npm-supply-chain-abuse.md).<sup>[[12]](#references)[[48]](#references)</sup>
+
 
 ### `workflow_run`
 
@@ -955,4 +995,6 @@ An organization in GitHub is very proactive in reporting accounts to GitHub. All
 - [44] [GitHub Actions Injection in Google Project | Legit Security](https://www.legitsecurity.com/blog/-how-we-found-another-github-action-environment-injection-vulnerability-in-a-google-project)
 - [45] [Vulnerable GitHub Actions Workflows: CI/CD Pipeline Attacks](https://www.legitsecurity.com/blog/github-actions-that-open-the-door-to-cicd-pipeline-attacks)
 - [46] [actions/toolkit core package - GitHub](https://github.com/actions/toolkit/tree/main/packages/core#setting-a-secret)
+- [47] [actions/checkout v5 action manifest](https://github.com/actions/checkout/blob/e8d4307400f9427dba7cb98e488d6ab85f1cec5f/action.yml#L118)
+- [48] [Compromised AsyncAPI npm Packages: Inside a CI Supply-Chain Attack](https://securitylabs.datadoghq.com/articles/compromised-asyncapi-npm-packages/)
 {{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-codeartifact-enum.md

@@ -66,3 +66,4 @@ Publishing the package did **not** start a build automatically. Exploitation req
 - [2] [GetPackageVersionAsset API](https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetPackageVersionAsset.html)
 - [3] [Packages overview, publishing permissions, and asset overwrite rules](https://docs.aws.amazon.com/codeartifact/latest/ug/packages-overview.html)
 - [4] [AWS CodeArtifact permissions reference](https://docs.aws.amazon.com/codeartifact/latest/ug/auth-and-access-control-permissions-reference.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-greengrass-enum.md

@@ -28,3 +28,4 @@ The same API did **not** retrieve an ordinary private component backed by an arb
 
 - [1] [Develop AWS IoT Greengrass components](https://docs.aws.amazon.com/greengrass/v2/developerguide/develop-greengrass-components.html)
 - [2] [GetComponentVersionArtifact API](https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetComponentVersionArtifact.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-iot-core-enum.md

@@ -295,3 +295,4 @@ If listing is denied, tunnel IDs occur in open/rotate responses, device notifica
 - [16] [IoT SQL FROM clause](https://docs.aws.amazon.com/iot/latest/developerguide/iot-sql-from.html)
 - [17] [AWS IoT rule actions](https://docs.aws.amazon.com/iot/latest/developerguide/iot-rule-actions.html)
 - [18] [Publish API - AWS IoT](https://docs.aws.amazon.com/iot/latest/apireference/API_iotdata_Publish.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-ivs-chat-enum.md

@@ -78,3 +78,4 @@ The application-specific user ID and attributes are caller-controlled inputs to
 - [2] [Amazon IVS Chat Messaging SDK for JavaScript](https://docs.aws.amazon.com/ivs/latest/ChatUserGuide/chat-sdk-js.html)
 - [3] [Getting started with Amazon IVS Chat](https://docs.aws.amazon.com/ivs/latest/ChatUserGuide/getting-started-chat.html)
 - [4] [Actions, resources, and condition keys for Amazon IVS Chat](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninteractivevideoservicechat.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-streams-enum.md

@@ -44,3 +44,4 @@ Resource policies, IAM policies, KMS configuration, retention, iterator expiry,
 - [1] [GetShardIterator API](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetShardIterator.html)
 - [2] [GetRecords API](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetRecords.html)
 - [3] [Kinesis Data Streams terminology and concepts](https://docs.aws.amazon.com/streams/latest/dev/key-concepts.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-mediapackage-v2-enum.md

@@ -1,5 +1,7 @@
 # AWS - MediaPackage v2 Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## MediaPackage v2 basics
 
 AWS Elemental MediaPackage v2 receives live media through channels and serves packaged content through origin endpoints. Both resources support IAM-style resource policies. Consequently, a principal that can replace one of those policies may grant an external principal access without receiving any MediaPackage list or read permission itself.
@@ -114,3 +116,4 @@ aws mediapackagev2 delete-channel-group \
 - [Channel policy examples](https://docs.aws.amazon.com/mediapackage/latest/userguide/security_iam_resource-based-policy-examples.html)
 - [PutChannelPolicy API](https://docs.aws.amazon.com/mediapackage/latest/APIReference/API_v2_PutChannelPolicy.html)
 - [PutOriginEndpointPolicy API](https://docs.aws.amazon.com/mediapackage/latest/APIReference/API_v2_PutOriginEndpointPolicy.html)
+{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-services/aws-transcribe-enum.md

@@ -34,3 +34,4 @@ If `ListTranscriptionJobs` is denied, job names frequently appear without additi
 
 - [1] [How Amazon Transcribe works with input and output data](https://docs.aws.amazon.com/transcribe/latest/dg/how-input.html)
 - [2] [GetTranscriptionJob API](https://docs.aws.amazon.com/transcribe/latest/APIReference/API_GetTranscriptionJob.html)
+{{#include ../../../banners/hacktricks-training.md}}