AWS Console Supply Chain Breach Enables GitHub Repository Hijacking

Wiz Research has uncovered CodeBreach, a critical vulnerability in AWS CodeBuild CI/CD pipelines that could have enabled the complete takeover of the AWS JavaScript SDK repository and potentially compromised the AWS Console itself.

The flaw placed 66% of cloud environments at risk through this widely-used library.

The vulnerability stemmed from an unanchored regex pattern in CodeBuild’s webhook filters. AWS repositories relied on ACTOR_ID filters to restrict builds to approved maintainers, but the regex lacked start (^) and end ($) anchors.

This allowed any GitHub user ID containing an approved maintainer’s ID as a substring to bypass the filter entirely.

Researchers discovered that GitHub assigns sequential numeric IDs to accounts. With roughly 200,000 new accounts created daily, any 6-7 digit maintainer ID would become available as a substring within a longer ID approximately every five days a window researchers termed an “eclipse.”

The Exploitation

Wiz leveraged GitHub’s app manifest flow to automate creation of 200 bot accounts simultaneously, successfully capturing user ID 226755743 which contained a trusted maintainer’s ID for the aws-sdk-js-v3 repository.

By submitting a pull request with embedded malicious code, they triggered a build and extracted the repository’s GitHub credentials.

The compromised credentials belonged to aws-sdk-js-automation, a service account with full administrative access.

This access enabled direct commits to the main branch, pull request approval, and secret exfiltration.

The JavaScript SDK is released weekly and embedded in the AWS Console itself, affecting approximately two-thirds of all cloud environments.

A successful attack could have injected malicious code into the SDK before release, compromising downstream users at scale following the same pattern that recently infected Amazon Q users.

The vulnerability extended to at least three additional AWS repositories, including private mirrors and repositories associated with personal GitHub accounts belonging to AWS employees.

AWS has implemented global hardening measures within CodeBuild, including the new Pull Request Comment Approval build gate to prevent untrusted builds from triggering privileged pipelines.

Organizations should immediately enable this protection, use fine-grained Personal Access Tokens with minimal permissions, and ensure webhook filter regex patterns are properly anchored.

This incident exemplifies a troubling trend: attackers increasingly target CI/CD systems due to their complexity, access to untrusted data, and privileged credentials creating ideal conditions for high-impact supply chain attacks.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.