Securing Non-Human Identities in CI/CD Pipelines: The Next Major Attack Vector

Securing Non-Human Identities in CI/CD Pipelines: The Next Major Attack Vector

Speakers: Diva Bala Subramanion, Cybersecurity Leader, Southwest Airlines; Vikas (co-presenter)

Conference: BSides Seattle 2026

YouTube: https://www.youtube.com/watch?v=luWyGc8NIII

Overview

Diva Bala Subramanion (Diva/Divs), a cybersecurity leader at Southwest Airlines specializing in identity and access management, and her co-presenter Vikas deliver a comprehensive beginner-friendly session on securing non-human identities (NHIs) in CI/CD pipelines. The talk covers foundational DevOps and CI/CD concepts, deep-dives into the Shy Hulk npm supply chain attacks of September and November 2025, and presents a four-layer defense framework covering discovery, secret elimination, least privilege, and governance.

The core thesis is that while organizations have invested heavily in protecting human identities with MFA, SSO, and PAM solutions, they have simultaneously generated a sprawling landscape of API keys, personal access tokens (PATs), service accounts, and other machine credentials that never expire, are rarely rotated, often run with excessive privileges, and have no clear ownership. These non-human identities now outnumber human identities by orders of magnitude and have become the primary initial attack vector in CI/CD supply chain attacks.

Background

▶ Watch: Introduction and the restaurant analogy for DevOps (0:00)

The talk opens with an extended restaurant analogy that maps DevOps concepts to familiar operations: the kitchen is CI/CD (automatable, repeatable), the full restaurant is DevOps (menu design, hiring, cross-functional collaboration, incident handling, quality monitoring, health and security standards). The key distinction: DevOps is not about speeding up the kitchen; it's about aligning the restaurant to deliver value through shared ownership.

Diva traces the history of CI/CD from waterfall and floppy disks through Grady Booch coining "continuous integration" in the early '90s, extreme programming, Agile, Patrick Debois's frustrated attempts to bridge dev and ops teams (2007-2009), the famous "10 Deploys a Day" talk by John Allspaw and Paul Hammond at Velocity Conference (2009), DevOps Days in Belgium, the DORA research group (now part of Google Cloud) making DevOps measurable with DORA metrics, and the Phoenix Project book making DevOps accessible to leadership.

The landscape of CI/CD tools is now enormous. While organizations have evolved to protect human identities with FIDO2-based MFA, they have in the process generated PATs that never expire -- "locking the side door while leaving the back door and windows open."

Key Findings

▶ Watch: Non-human identities: the invisible workforce (16:00)

Non-Human Identity Types:

• API keys -- like library cards; long-lived, don't expire until cancelled. Used to track which applications call an API and throttle limits.
• Tokens -- like movie tickets; temporary access credentials. Includes npm tokens, PATs, OAuth tokens, JWTs. Can represent user identity (PATs enumerate user privileges) or non-human identity (services, pipelines, bots).
• Service accounts -- identities for machines and workloads, analogous to human employee IDs.

Critical warnings: never stuff a token issued for a person into a pipeline (it runs with more permissions than needed). Never make tokens static, long-lived, or broadly scoped for convenience.

Shy Hulk Attack (September 2025): A self-replicating malware targeting npm packages, strategically selecting the most heavily downloaded packages for maximum impact. Diva role-plays as the attacker to explain the kill chain:

1. Compromise developer accounts publishing popular npm packages
2. Unpackage the target package, inject a malicious post-install script, repackage, and upload
3. Developers with auto-install dependencies enabled pull the tainted package
4. The malicious script scans repos for environment variables and configuration files containing npm tokens, GitHub tokens, and other credentials
5. Deploy Truffle Hog (the legitimate secret scanning tool) to find additional secrets
6. Validate which gathered tokens have publish or push privileges
7. GitHub PAT exploitation: If a PAT is found, iterate through all repos the token owner has access to (potentially 200+ repos), inject malicious GitHub Actions workflows triggered on push that exfiltrate secrets to a webhook drop site
8. npm token exploitation: If an npm token is found, identify all packages the owner publishes, sort by download count, inject malicious scripts into the most popular ones, and republish -- this is the self-replicating "worm" behavior

All harvested secrets are stored in a public repo created in the victim's account named "shyhulk1" as a Base64-encoded JSON file.

Shy Hulk v2 (November 2025): Enhanced capabilities:

• Deploys the victim's official cloud provider SDK (AWS/Azure/GCP) to access secrets manager services and extract secrets from what organizations thought were secure vaults
• Public repo named with random UUID but description "sha follow the second coming"
• Cross-victim acceleration: If one token stops working, the attacker pivots to other tokens in their harvested collection
• Backdoor installation: Injects a GitHub Actions workflow (discussions.yaml) that installs a self-hosted runner triggered when the attacker opens a discussion in the repo, providing persistent remote command execution
• Destructive fallback: If no useful tokens are found, destroys repositories

By the time the attack was contained, approximately 25,000 repos were compromised, and all harvested secrets remained in the attacker's possession.

Technical Deep Dive

▶ Watch: Shy Hulk kill chain: token theft and self-replication (26:00)

Why Traditional IAM Fails for NHIs:

Diva outlines four pillars of traditional identity management and why each breaks for non-human identities:

1. Directory services: Human identities have centralized repositories (HR systems) with standardized onboarding. NHIs have no equivalent centralized registry.
2. Identity governance and administration: Joiner-mover-leaver processes and periodic access reviews work for humans but are impractical for NHIs at scale -- imagine reviewing 500 non-human identities periodically.
3. Access management: Humans log into UIs with SSO and MFA. NHIs cannot do MFA (at least not yet). Traditional PAM has been secret-centric rather than identity-centric.
4. Privileged access management: Most solutions focus on human privileged users, not machine credentials.

GitLab Demo: Vikas demonstrates the practical attack surface using GitLab:

• PAT token creation with customizable scopes -- GitLab only shows the token once, forcing insecure storage practices
• How a PAT accidentally committed to a repo gives an attacker the ability to clone any repo the token owner can access, view all commit history, and (if write access is scoped) push malicious code
• The OIDC alternative: replacing static secrets with short-lived OIDC tokens that carry user context and expire quickly, limiting exposure even in a breach scenario

Four Defense Layers:

1. Discovery and Visibility: Identify all NHIs in a centralized inventory. Tag each with a purpose and owner. Run secret scanning regularly. Analogy: cleaning the garage and finding things you forgot you had.

1. Secret Elimination (OIDC): Replace static secrets with short-lived OIDC tokens wherever possible. Federate authentication through identity providers. Even in worst-case exposure, short-lived tokens limit the blast radius. Analogy: replacing a house key (anyone can copy) with face ID (only you can enter, for a limited time).

1. Least Privilege, Rotation, and Integrity: Segregate CI and CD permissions. Separate prod and non-prod permissions. Rotate secrets frequently. Sign all requests. Analogy: TSA agent checking your identity before boarding.

1. Governance: Embed security as a shared responsibility, not a single team's problem. Follow NIST standards for CI/CD security. Conduct regular governance checkups. Analogy: regular dentist visits preventing major problems.

Demo / Proof of Concept

▶ Watch: GitLab demo: PAT token exposure and OIDC alternative (38:00)

Vikas performed a live GitLab demo showing PAT token creation, accidental secret exposure through commits, and the impact of a leaked PAT -- cloning repos, enumerating permissions via the GitLab API, and accessing full commit history. He then demonstrated the OIDC token alternative, showing how pipeline configurations change when static API keys are replaced with short-lived identity-federated tokens, and how even exposed OIDC tokens have limited blast radius due to their short lifetime.

Defensive Implications

▶ Watch: AI agents as the next frontier of NHI risk (54:00)

The talk's defensive framework is directly actionable:

1. Audit your NHI inventory immediately. Enterprise CI/CD repos can contain hundreds to thousands of NHIs. You cannot secure what you cannot see.
2. Eliminate static secrets wherever possible. Replace PATs, API keys, and long-lived credentials with OIDC tokens federated through your identity provider.
3. Enforce least privilege on all pipeline credentials. Separate CI and CD permissions. Never give prod and non-prod the same scope.
4. Rotate remaining secrets frequently and use secret scanning tools to catch accidental exposure in commits.
5. Prepare for the next frontier: AI agents, co-pilot agents, bots, and LLM tools connecting to repos create new NHI categories that need the same governance rigor.

The Shy Hulk attacks demonstrate that a single leaked PAT or npm token can cascade into a worm-like propagation across thousands of repositories, accessing secrets managers and installing persistent backdoors.

Key Takeaways

• Non-human identities (API keys, PATs, service accounts, tokens) outnumber human identities and are the most common initial attack vector in CI/CD supply chain attacks
• The Shy Hulk npm attacks (September and November 2025) compromised approximately 25,000 repos through self-replicating malware that exploited leaked tokens to spread across the npm ecosystem
• Traditional IAM approaches (directory services, governance, access management, PAM) do not scale to non-human identities without fundamental adaptation
• Replace static secrets with short-lived OIDC tokens wherever possible -- this is the single highest-impact defensive action
• Four defense layers: discovery/visibility, secret elimination via OIDC, least privilege/rotation/integrity, and governance as shared responsibility
• AI agents and co-pilot tools are creating new categories of non-human identities that will require the same security rigor as current CI/CD credentials

About the Speaker(s)

Diva Bala Subramanion (Diva/Divs) is a cybersecurity leader at Southwest Airlines specializing in identity and access management. She describes herself as a mom with a passion for cybersecurity. She presents the foundational and attack portions of the talk. Vikas (co-presenter) handles the GitLab demonstration and defense framework portions. Both speakers note they are presenting in their personal capacity, not representing their organizations. The talk is designed to be beginner-friendly and accessible to a broad skill range.