The CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet
summary
Routine release of a GitHub release leads to a rapid repo takeover by an autonomous agent (token exfiltration to full takeover in ~90 minutes, 178 releases deleted, 24k stars lost), exposing a persistent CVE blind spot where workflow misconfiguration and EOL packages produce no CVEs. Reproducing seven targeted repos with Scorecard shows it would catch three of seven vectors; full mitigation needs lifecycle governance. Open tools Vuls, Uzumuzo and a Code Diet workflow find hidden EOLs in 60k production packages (51.5% healthy), prioritize removals, replace heavy libs with standard library (binary 100→34MB, −68%), and pass regression on 127/129 test projects.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:52Repo hijacking timeline
- 6:10Scorecard vs the attack
- 9:47CVEs missed supply chain
- 12:20CVE blind spot categories
- 14:05Hidden EOLs explained
- 16:12OSS packages research
- 18:02SCA tools miss lifecycle
- 18:45Code Diet and Uzomuzo
- 20:29Uzomuzo demo
- 21:15Dependency lifecycle risks
- 23:28Package state classification
- 25:15EOL packages in Vault
- 27:45CI/CD risk detection
- 29:42Prioritizing fixes
- 31:30Attack surface reduction
- 32:57Automating Code Diet
- 33:41Dependency scoring
- 36:22Detection to removal
- 37:29Open source response
- 38:35Security management phases
- 39:19Key takeaways
related talks
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
35mKeynote: How I learned to stop worrying and love CVEs
30mHidden Vulnerabilities in Open Source
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
43mSteel for Vulnerabilities, Silver for Zombies: Hunting Java's Unseen Monsters
16mPerformance improvements: exposing hidden security fixes in Open Source
36mGithub Actions Security Landscape
47mUnder the Radar: How we found 0-days in the Build Pipeline of OSS Packages