They Hijacked the Pipeline We All Trusted

The framework was everywhere. Millions of weekly downloads. A gold-standard open-source project with a squeaky-clean security record. We pinned it in every microservice.

What we didn't pin was trust in their CI/CD.

An attacker phished a maintainer's GitHub token — just one — and used it to push four trojanized builds straight into the framework's own publish pipeline. Because the packages came from the project's official namespace, every signature check, every provenance attestation, every audit tool we had said: this is legitimate. The malicious code rode the project's hard-earned reputation straight into our node_modules.

The payload opened a reverse shell during the postinstall step. For the six hours the poisoned versions were live, anyone who ran npm install in that window got owned — including two of our production deploy jobs.

Nobody noticed because nothing broke. The reverse shell was patient. It waited.

The maintainers caught it themselves, six hours in, during a routine audit. They yanked the versions and posted a disclosure. But by then the packages had been pulled millions of times.

The hardest part of this story: we did everything right. We pinned versions. We verified signatures. We trusted the namespace. And it still got us, because the trust was the attack surface.