Supply Chain

ONBUILD does not run for whoever wrote it. It runs for you, the moment you FROM their image – silently, with no line in your own Dockerfile.

A week-old GitHub account and a Markdown file is all it takes to publish a skill. One developer installing one plugin equals access to every repository the company has.

Not a zero-day. Not a sophisticated state attack. An extension. 3,800 internal repositories pulled out of the company that holds half the world’s code.

Attackers poisoned TanStack’s build cache. Nobody stole credentials, nobody compromised a maintainer account. The system was simply designed in a way that allows it.

An AI tool analysed 500 repositories and wrote a custom payload for each. Then it waited for GitHub Actions to run them automatically – which GitHub does not do for new contributors.

A webhook filter checked ACTOR_ID with a regex that had no ^ or $. Substring match was enough. This is not a regex mistake – it is a deep understanding of how an application decides.

A real profile, a real company, a clean Bitbucket repo. Thirty seconds before running it, he asked an AI to check the code – and found an obfuscated loader inside one controller.