TLDR Tech / InfoSec
Zapocalypse: The Attack Chain That Could Have Hijacked Zapier
Token security involved chaining known primitives, from Zapier's Python sandbox: os.system ran freely, regex scraping recovered orphaned STS tokens from Lambda heap, belonging to allow_nothing_role with permissions for ECR and other actions across 1,111 private repos. Due to GetAuthorizationToken denial, images were pulled via raw ECR API calls, avoiding Docker monitoring. High-privilege NPM publish tokens leaked via build-time ARG/ENV, enabling account takeover. Defenders should validate IAM permissions, isolate untrusted code, use BuildKit secrets, scope and rotate CI NPM tokens, pin dependencies with npm ci, and monitor egress to private ECR or NPM.
Read the full story