The SolarWinds hack showed what happens when an attacker compromises the build pipeline. Integrity failures include insecure CI/CD and dangerous deserialization.
Attack examples¶
- SolarWinds: Backdoor in firmware from a compromised build
- Codecov: Modified CI script exfiltrated env variables
- ua-parser-js: Compromised npm package
CI/CD protection¶
GitHub Actions — signed commits¶
- uses: actions/checkout@v4
- name: Verify commit signature run: git verify-commit HEAD || exit 1
Subresource Integrity¶
Insecure Deserialization¶
NEVER use pickle on untrusted data¶
data = pickle.loads(user_input) # RCE!
JSON + validation¶
from pydantic import BaseModel class UserData(BaseModel): name: str age: int data = UserData.model_validate_json(user_input)
Key Takeaway¶
Verify integrity of dependencies, build artifacts, and CI/CD pipeline. Sign releases, use SRI.
owaspsecurityintegritysupply chain