{"uuid": "78fd1842-db65-42e8-aebf-c15536b2928f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-PJWM-RVH2-C87W", "type": "seen", "source": "https://t.me/hacking_Attack/76471", "content": "Attack Simulator for SolarWinds, Codecov, and ua-parser-js breaches\nhttps://www.reddit.com/r/redteamsec/comments/yv140a/attack_simulator_for_solarwinds_codecov_and/\n\nThe SUNSPOT (http://crowdstrike.com/blog/sunspot-malware-technical-analysis/) malware, Codecov breach (https://about.codecov.io/security-update/), and lot of compromised open-source packages (like was the case with ua-parser-js (https://github.com/advisories/GHSA-pjwm-rvh2-c87w)) target the CI/ CD pipeline to modify release build or exfiltrate credentials.  As part of writing tests for Harden Runner GitHub Action (https://github.com/step-security/harden-runner), which prevents such attacks, there was a need to write attack simulator for these attacks.  You can check out the attack simulator here: https://github.com/step-security/attack-simulator  It has information and relevant links about these attacks at one place. There are a set of GitHub Actions workflows that simulate the steps from these attacks.  There is also a malware simulator npm package which simulates behavior of typical compromised npm packages using preinstall step.  Wanted to share in case one is looking for similar attack simulator for attacks on CI/ CD pipelines.    submitted by    /u/varunsh-coder  (https://www.reddit.com/user/varunsh-coder) \n [link] (https://www.reddit.com/r/redteamsec/comments/yv140a/attack_simulator_for_solarwinds_codecov_and/)   [comments] (https://www.reddit.com/r/redteamsec/comments/yv140a/attack_simulator_for_solarwinds_codecov_and/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:18.706147Z"}