Cloud-Native Kubernetes, Supply-Chain SBOM Attacks & Zero-Day Vulnerability Triage
Follows the Cloud Security Architect and Principal IT Auditor after a compromised transitive open-source npm/PyPI package injects credential-harvesting code into an AWS EKS production cluster—tracing CI/CD GitHub Actions token abuse, privileged pod escapes to IMDSv1 host metadata, SBOM VEX blind spots, and CVSS-only patching backlogs.
CI/CD Pipeline Poisoning: Ephemeral Runners, OIDC Federation & SLSA Level 3 Build Provenance
The fluorescent hum of the server room was a stark contrast to the silence in Principal IT Auditor Ben Carter's office. It was 08:00 on October 26, 2024, and the 'Red-File' alert on his screen screamed 'Critical'. Cloud Security Architect Anya Sharma had just confirmed a \$1.2 million unauthorized AWS spend over the last 72 hours, traced to an AWS EKS production cluster. Initial forensics, documented in workpaper 'WP-2024-EKS-001-A', pointed to a newly deployed container image, `app-service:latest`, which had been pushed through their standard CI/CD pipeline. This image, ostensibly a routine update, contained obfuscated code designed to harvest temporary AWS credentials from the EKS nodes' Instance Metadata Service (IMDSv1) and exfiltrate them to an unknown external endpoint. The immediate concern was how malicious code bypassed multiple layers of security, including static analysis and vulnerability scanning, to reach production. The financial impact was escalating, and regulatory scrutiny from the SEC and CISA was imminent, demanding a rapid, forensic audit of their entire software supply chain, starting with the CI/CD pipeline.