Analysis
Keys Are Pointers Too: GitHub Actions Cache Poisoning
The build cache is mutable resolution between runs: how a low-privilege context poisons a cache a privileged workflow restores.
Daniel Malvaceda · Jun 20, 2026 · 18 min read
pipebreach
Supply chain security research — packages, pipelines, dependencies.
6 posts
4 critical
ecosystems: PyPI · python · npm · javascript · openvsix · GitHub Actions · docker-hub
Latest
More posts
Analysis PyPI python
The AI Gateway Attack Surface: What TeamPCP's First Move Actually Opened
Daniel Malvaceda · May 31, 2026 · 18 min read
Analysis
Tags Are Pointers. Pointers Move.
Daniel Malvaceda · Apr 16, 2026 · 14 min read
Incident Critical npm javascript
Axios Supply Chain Attack: All begin with Social Engineering Campaign Targeting npm's Most Downloaded HTTP Library
Ricardo Sanchez · Apr 7, 2026 · 9 min read
Incident Critical npm PyPI openvsix
TeamPCP Part II: Backdooring the AI Credentials Vault
Daniel Malvaceda · Apr 1, 2026 · 27 min read
Incident Critical GitHub Actions docker-hub
TeamPCP Part I: Twenty Days of Silent Access From a Two-Minute PR
Daniel Malvaceda · Mar 27, 2026 · 21 min read
Research areas
⛓
Supply Chain
Package poisoning, dependency confusion, typosquatting, and build-time attacks across npm, PyPI, Cargo, and more.
⚙
CI/CD Attack Surface
GitHub Actions, Jenkins, CircleCI : runner credential theft, Pwn Request patterns, and pipeline backdoors.
◈
AI Security
Model supply chains, poisoned fine-tuning datasets, inference infrastructure, and prompt injection via packages.
⬡
AppSec & DevSecOps
Shift-left security architecture, SAST/DAST integration, secrets management, and developer security tooling.