Analysis
Tags Are Pointers. Pointers Move.
The structural gap between what a pipeline declares and what it executes, and what hash pinning actually fixes.
Daniel Malvaceda · Apr 16, 2026 · 14 min read
pipebreach
Supply chain security research — packages, pipelines, dependencies.
4 posts
3 critical
ecosystems: npm · javascript · PyPI · openvsix · GitHub Actions · docker-hub
Latest
More posts
Incident Critical npm javascript
Axios Supply Chain Attack: All begin with Social Engineering Campaign Targeting npm's Most Downloaded HTTP Library
Ricardo Sanchez · Apr 7, 2026 · 9 min read
Incident Critical npm PyPI openvsix
TeamPCP Part II: Backdooring the AI Credentials Vault
Daniel Malvaceda · Apr 1, 2026 · 27 min read
Incident Critical GitHub Actions docker-hub
TeamPCP Part I: Twenty Days of Silent Access From a Two-Minute PR
Daniel Malvaceda · Mar 27, 2026 · 21 min read
Research areas
⛓
Supply Chain
Package poisoning, dependency confusion, typosquatting, and build-time attacks across npm, PyPI, Cargo, and more.
⚙
CI/CD Attack Surface
GitHub Actions, Jenkins, CircleCI : runner credential theft, Pwn Request patterns, and pipeline backdoors.
◈
AI Security
Model supply chains, poisoned fine-tuning datasets, inference infrastructure, and prompt injection via packages.
⬡
AppSec & DevSecOps
Shift-left security architecture, SAST/DAST integration, secrets management, and developer security tooling.