A deep technical audit of the ChainDrop npm worm that compromised 400+ packages with valid provenance, mapping token scope, publish automation, OIDC configuration, and postinstall execution gaps and practical CI defenses.
A practical audit playbook for GitHub Actions secret exposure, covering OIDC trust policies, least-privilege PATs, secret scanning, and audit-log tripwires in the wake of the GhostAction campaign that compromised 500+ accounts to steal cloud and AI API credentials.
An analysis of the ChainDrop npm worm, how it abused GitHub Actions OIDC trust boundaries to publish poisoned packages with valid SLSA provenance, and what it means for supply-chain defense.
Attackers abused GitHub Actions OIDC tokens to move from CI pipelines into cPanel and WHM environments, ultimately stealing cloud credentials from affected servers.