corpus.blog
57,803 blogs · [ { "id": "01a08720-17b5-72a9-8c95-fd73e2074bcb", "title": "Turning Almost Nothing into a Supply Chain Compromise of Angular with GitHub Actions Cache Poisoning", "url": "https://adnanthekhan.com/posts/angular-compromise-through-dev-infra/", "published_at": "2026-03-03T00:00:00+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e2f2def0", "title": "Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager", "url": "https://adnanthekhan.com/posts/clinejection/", "published_at": "2026-02-09T09:00:00+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e30c7d13", "title": "Copilot or Coconspirator - Tricking GitHub Copilot and Stealing all Your Secrets", "url": "https://adnanthekhan.com/posts/copilot-or-co-conspirator/", "published_at": "2026-01-07T00:00:00+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e37710b5", "title": "Who's SHA is it Anyway: Bypassing Google Cloud Build Comment Control for $30,000", "url": "https://adnanthekhan.com/posts/cloud-build-toctou/", "published_at": "2025-07-21T10:00:00+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e3956c6a", "title": "Watch your Dispatch: Race Condition in Dependabot Core CI", "url": "https://adnanthekhan.com/posts/dependabot-core-toctou-writeup/", "published_at": "2025-05-02T18:00:00+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e476ba66", "title": "(Not So) Safe{Wallet}: GitHub Actions Risks Impacting Safe''s Frontend", "url": "https://adnanthekhan.com/2025/02/27/not-so-safewallet-github-actions-risks-impacting-safes-frontend/", "published_at": "2025-02-27T23:59:48+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e546ed3d", "title": "Cacheract: The Monster in your Build Cache", "url": "https://adnanthekhan.com/2024/12/21/cacheract-the-monster-in-your-build-cache/", "published_at": "2024-12-22T00:02:52+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e5ac41f3", "title": "Release-Drafter To google/accompanist Compromise: VRP Writeup", "url": "https://adnanthekhan.com/2024/11/11/release-drafter-to-google-accompanist-compromise-vrp-writeup/", "published_at": "2024-11-12T02:35:40+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e6798c34", "title": "BlackHat 2024 and DEF CON 32 Preview", "url": "https://adnanthekhan.com/2024/07/30/blackhat-2024-and-def-con-32-preview/", "published_at": "2024-07-30T13:00:00+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e6d90d3d", "title": "RoguePuppet - A Critical Puppet Forge Supply Chain Vulnerability", "url": "https://adnanthekhan.com/2024/07/02/roguepuppet-a-critical-puppet-forge-supply-chain-vulnerability/", "published_at": "2024-07-02T09:57:09+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e7d3cbdd", "title": "The Monsters in Your Build Cache - GitHub Actions Cache Poisoning", "url": "https://adnanthekhan.com/2024/05/06/the-monsters-in-your-build-cache-github-actions-cache-poisoning/", "published_at": "2024-05-06T09:41:00+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e8447c38", "title": "An Obscure Actions Workflow Vulnerability in Google's Flank", "url": "https://adnanthekhan.com/2024/04/15/an-obscure-actions-workflow-vulnerability-in-googles-flank/", "published_at": "2024-04-15T14:00:00+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e848489c", "title": "Web3''s Achilles'' Heel: A Supply Chain Attack on Astar Network", "url": "https://adnanthekhan.com/2024/01/19/web3s-achilles-heel-a-supply-chain-attack-on-astar-network/", "published_at": "2024-01-19T22:09:11+00:00" }, { "id": "01a08720-17b5-72a9-8c95-fd73e8d8342e", "title": "CVE-2023-49291 and More - A Potential Actions Nightmare", "url": "https://adnanthekhan.com/2024/01/10/cve-2023-49291-and-more-a-potential-actions-nightmare/", "published_at": "2024-01-11T02:37:44+00:00" }, { "id": "01a08720-17b6-72b1-a842-9adaa43b7222", "title": "One Supply Chain Attack to Rule Them All - Poisoning GitHub's Runner Images", "url": "https://adnanthekhan.com/2023/12/20/one-supply-chain-attack-to-rule-them-all/", "published_at": "2023-12-20T20:37:53+00:00" }, { "id": "01a08720-17b6-72b1-a842-9adaa4c6bd72", "title": "Welcome to my blog - there is more to come!", "url": "https://adnanthekhan.com/2023/12/16/welcome-to-my-blog-there-is-more-to-come/", "published_at": "2023-12-16T18:05:08+00:00" } ] posts Claim your blog
Back to adnanthekhan.com
Blog · corpus.blog/blogs/adnanthekhan.com/posts

adnanthekhan.com

adnanthekhan.com

2026

Turning Almost Nothing into a Supply Chain Compromise of Angular with GitHub Actions Cache Poisoningoriginal ↗
3 Mar 2026
Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triageroriginal ↗
9 Feb 2026
Copilot or Coconspirator - Tricking GitHub Copilot and Stealing all Your Secretsoriginal ↗
7 Jan 2026

2025

Who's SHA is it Anyway: Bypassing Google Cloud Build Comment Control for $30,000original ↗
21 Jul 2025
Watch your Dispatch: Race Condition in Dependabot Core CIoriginal ↗
2 May 2025
(Not So) Safe{Wallet}: GitHub Actions Risks Impacting Safe''s Frontendoriginal ↗
27 Feb 2025

2024

Cacheract: The Monster in your Build Cacheoriginal ↗
22 Dec 2024
Release-Drafter To google/accompanist Compromise: VRP Writeuporiginal ↗
12 Nov 2024
BlackHat 2024 and DEF CON 32 Previeworiginal ↗
30 Jul 2024
RoguePuppet - A Critical Puppet Forge Supply Chain Vulnerabilityoriginal ↗
2 Jul 2024
The Monsters in Your Build Cache - GitHub Actions Cache Poisoningoriginal ↗
6 May 2024
An Obscure Actions Workflow Vulnerability in Google's Flankoriginal ↗
15 Apr 2024
Web3''s Achilles'' Heel: A Supply Chain Attack on Astar Networkoriginal ↗
19 Jan 2024
CVE-2023-49291 and More - A Potential Actions Nightmareoriginal ↗
11 Jan 2024

2023

One Supply Chain Attack to Rule Them All - Poisoning GitHub's Runner Imagesoriginal ↗
20 Dec 2023
Welcome to my blog - there is more to come!original ↗
16 Dec 2023