When AppSec Scanners Become a Supply Chain Attack Vector

Security scanners used in the software supply chain can be exploited to introduce vulnerabilities and compromise downstream systems. Researchers at ZeroPath discovered that attackers can craft malicious code repositories to trick security scanners into executing malicious code, potentially granting access to sensitive data like production databases and cloud credentials. This vulnerability could impact a wide range of organizations, including Fortune 1000 companies and government agencies. The research team has developed a tool, ‘Build Canaries,’ to proactively test security scanners and vendor relationships, and will be releasing it as open-source alongside a taxonomy of repository ingestion execution surfaces.