corpus.blog
43,228 blogs · 5,519,570 posts Claim your blog
Record · corpus.blog/posts/01a1020d-0977-70f6-9898-db9ce556e6a8

TensorFlow Supply Chain Compromise via Self-Hosted Runner Attack

Praetorian · published 15 January 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at praetorian.com Wayback capture
1blogs citing
First cited
30 Jul 2024
Most recent
16 Dec 2025
Rank this month
not ranked
External links
14
Words captured
3,034

Cited by

Blog
In the post
Date
johnstawinski.com
Hey. I’m John. Read at the source ↗
16 Dec 2025
johnstawinski.com
Talks – John Stawinski IV Read at the source ↗
6 May 2025
johnstawinski.com
Black Hat and DEF CON Preview: “Grand Theft Actions” or “Continuous Integration, Continuous Destruction”? Read at the source ↗
30 Jul 2024

Links from this post

Link
Host
https://github.com/praetorian-inc/gato
github.com
https://github.com/tensorflow/tensorflow
github.com
https://karimrahal.com/2023/01/05/github-actions-leaking-secrets/
karimrahal.com
https://bughunters.google.com/about/rules/6521337925468160/google-open-source-software-vulnerability-reward-program-rules
bughunters.google.com
https://docs.github.com/en/enterprise-cloud@latest/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups
docs.github.com
https://github.blog/2021-11-29-github-actions-reusable-workflows-is-generally-available/
github.blog
https://github.com/tensorflow-jenkins
github.com
One Supply Chain Attack to Rule Them All - Poisoning GitHub's Runner Images Read at the source ↗
adnanthekhan.com
Playing with Fire – How We Executed a Critical Supply Chain Attack on PyTorch Read at the source ↗
johnstawinski.com
Worse than SolarWinds: Three Steps to  Hack Blockchains, GitHub, and ML through GitHub Actions Read at the source ↗
johnstawinski.com
https://github.com/nikitastupin/pwnhub/blob/main/writings/github-token.md
github.com
https://docs.github.com/en/actions/
docs.github.com
https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution
owasp.org
https://slsa.dev/spec/v1.0/verifying-systems
slsa.dev
Elsewhere on praetorian.com (4)