{"id":9922,"date":"2026-01-16T10:04:03","date_gmt":"2026-01-16T10:04:03","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/16\/new-aws-console-supply-chain-attack-lets-attackers-hijack-aws-github-repositories\/"},"modified":"2026-01-16T10:04:03","modified_gmt":"2026-01-16T10:04:03","slug":"new-aws-console-supply-chain-attack-lets-attackers-hijack-aws-github-repositories","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/16\/new-aws-console-supply-chain-attack-lets-attackers-hijack-aws-github-repositories\/","title":{"rendered":"New AWS Console Supply Chain Attack Lets Attackers Hijack AWS GitHub Repositories"},"content":{"rendered":"

New AWS Console Supply Chain Attack Lets Attackers Hijack AWS GitHub Repositories
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical misconfiguration in AWS CodeBuild enabled unauthenticated attackers to seize control of key AWS-owned GitHub repositories, including the widely used AWS JavaScript SDK powering the AWS Console itself.<\/p>\n

This supply chain<\/a> vulnerability threatened platform-wide compromise, potentially injecting malicious code into applications and the Console across countless AWS environments.<\/p>\n

AWS Console Supply Chain Attack<\/strong><\/h2>\n

Security firm Wiz Research has exposed that CodeBreach originated from unanchored regular expression patterns in CodeBuild webhook filters for the ACTOR_ID parameter, which should restrict builds to trusted GitHub user IDs.<\/p>\n

Without ^ and $ anchors, the filter matched any user ID containing an approved substring, allowing bypass via \u201ceclipse\u201d events where new, longer GitHub IDs incorporate older maintainer IDs.<\/p>\n

\"AWS
AWS Console Supply Chain Attack<\/figcaption><\/figure>\n

GitHub\u2019s sequential ID assignment, creating about 200,000 daily, made such overlaps frequent for the targeted 6-7 digit IDs in four AWS repos: aws\/aws-sdk-js-v3, aws\/aws-lc, corretto\/amazon-corretto-crypto-provider, and awslabs\/open-data-registry.<\/p>\n

Attackers exploit this by mass-creating GitHub Apps via the manifest flow to race for eclipse IDs, then submitting pull requests that trigger privileged builds.<\/p>\n

In a proof-of-concept against aws\/aws-sdk-js-v3 (PR #7280), hidden payload code dumped memory to extract a GitHub Personal Access Token (PAT) from the aws-sdk-js-automation account, despite prior mitigations from the 2025 Amazon Q incident.<\/p>\n

\n
\"AWS
CodeBreach Exploit<\/figcaption><\/figure>\n<\/div>\n

The PAT granted repo and admin:repo_hook scopes, enabling collaborator invites for admin escalation and direct main branch pushes.<\/p>\n

Compromising the JavaScript SDK risked infecting its weekly NPM releases, affecting 66% of scanned cloud environments and the AWS Console, which bundles recent SDK versions with user credentials, Wiz said to<\/a> CybersecurityNews.<\/p>\n

The stolen PAT also controlled related private repos, amplifying supply chain risks akin to Nx S1ngularity or the Amazon Q attack (AWS-2025-015). Wiz halted escalation post-PoC, responsibly disclosing on August 25, 2025.<\/p>\n

\n\n\n\n\n\n\n\n\n
Affected Repositories<\/th>\nMaintainer ID Example<\/th>\nEclipse Frequency<\/th>\n<\/tr>\n<\/thead>\n
aws\/aws-sdk-js-v3<\/td>\nShort 6-7 digits<\/td>\nEvery ~5 days<\/td>\n<\/tr>\n
aws\/aws-lc<\/td>\nShort 6-7 digits<\/td>\nEvery ~5 days<\/td>\n<\/tr>\n
corretto\/amazon-corretto-crypto-provider<\/td>\nShort 6-7 digits<\/td>\nEvery ~5 days<\/td>\n<\/tr>\n
awslabs\/open-data-registry<\/td>\nShort 6-7 digits<\/td>\nEvery ~5 days<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

AWS fixed the regex flaw within 48 hours, revoked tokens, hardened memory protections, audited public builds, and confirmed no exploitation via logs.<\/p>\n

No customer data was impacted. New features like Pull Request Comment Approval and CodeBuild-hosted runners now block untrusted builds.<\/p>\n

Users should anchor webhook regexes, use fine-grained PATs with minimal scopes, enable PR approval gates, and scan for vulnerable setups via Wiz queries.<\/p>\n

AWS urged disabling auto-PR builds from untrusted sources. The attack flow diagram highlights the path from malicious PR to Console risk.<\/p>\n

This underscores CI\/CD<\/a> as prime targets: complex, privilege-rich, and untrusted-input exposed. Public disclosure followed on January 15, 2026. <\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post New AWS Console Supply Chain Attack Lets Attackers Hijack AWS GitHub Repositories<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

New AWS Console Supply Chain Attack Lets Attackers Hijack AWS GitHub Repositories A critical misconfiguration in AWS CodeBuild enabled unauthenticated attackers to seize control of key AWS-owned GitHub repositories, including the widely used AWS JavaScript SDK powering the AWS Console itself. This supply chain vulnerability threatened platform-wide compromise, potentially injecting malicious code into applications and […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,648],"tags":[130],"class_list":["post-9922","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9922"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9922"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9922\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9922"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}