Continuous Integration / Continuous Deception: Trying my luck as a malicious maintainer
Benedikt Haußner
fwd:cloudsec Europe 2025 · Day 1 · Main Room
Benedikt Haußner, an internal red teamer based in Germany specializing in cloud and CI/CD security, presented a year's worth of research into how a **malicious open-source maintainer** can poison software releases through GitHub pipeline manipulation — without modifying application source code. Through three progressively sophisticated attacks — mutable release tampering, typosquatting third-party actions, and hidden self-hosted runners using homoglyph characters — Haußner demonstrated that the software supply chain's trust assumptions around GitHub releases are fundamentally brittle. All attacks abuse existing features rather than exploiting vulnerabilities (no CVEs involved), and all leave detectable traces — but only if defenders know where to look.
AI review
A well-structured, practical demonstration of supply chain attack techniques that most organizations are not monitoring for. The three attack variants — mutable release tampering, action typosquatting with orphaned commits, and homoglyph-based runner substitution — are all achievable with existing GitHub features and leave only subtle traces. The orphaned commit persistence across fork networks is the standout finding.