Battlecards

Battlecards are scenerios used to explore real attack vectors and learn how to apply REFLEX thinking to the situation.

In Alphabetical Order ..

github python

Abandoned Package Hijack

An attacker, “Maligna,” identifies a popular but dormant Python library, py-formatter-util, which is a dependency in thousands of projects, including a widely used open-source data science toolkit. The library hasn’t been updated in four years. Maligna discovers the original maintainer’s personal domain, listed in their GitHub profile, has expired.

ide shell

Advanced envvar abuse

An attacker gains low-privilege access to a developer’s machine or a CI/CD build agent, possibly through a compromised dependency or a malicious IDE extension. Their goal is persistence and lateral movement, not immediate disruption.

Adversarial input attacks

An attacker group wants to spread a sophisticated phishing campaign on a popular social media platform. The platform uses an AI/ML model to moderate outbound links and messages, flagging them as “spam” or “malicious.”

Ai cost amplification attacks

A developer working on a new feature that integrates with a commercial Large Language Model (LLM) provider, like OpenAI or Anthropic, hardcodes an API key directly into a source file for a quick prototype. They commit the code to a feature branch and push it to a public GitHub repository. Within minutes, an attacker’s automated scanner, which constantly monitors public repositories for secret patterns (e.g., sk-... for OpenAI), discovers the key.

Ai dependency typosquatting

An attacker targets an ML team at a fast-growing tech startup. They notice the team’s public GitHub repositories frequently use PyTorch and various utility libraries. The attacker creates a malicious Python package named torch-utilites (a common typo for “utilities”) and publishes it to the Python Package Index (PyPI). This package mimics the functionality of a legitimate but less-known library for data augmentation, but its setup.py script contains an extra, obfuscated payload.

hardcoded API key public GitHub Actions build log

Ai in ci cd pipelines

An attacker targets a company’s public source code repositories, hunting for common developer mistakes. They use automated scanners to find a public GitHub Actions build log that was not properly scrubbed. Inside the log, they discover a hardcoded API key for a commercial AI service.

hardcoded API key cloud AI API public GitHub repository

Ai service abuse (1)

A developer working on a new feature that integrates with a commercial Large Language Model (LLM) via a cloud AI API (e.g., Google’s Vertex AI, OpenAI’s API) hardcodes the API key into a source file for a “quick test” on their local machine. Later, while cleaning up their workspace, they accidentally commit this file to a public GitHub repository for a related open-source utility.

production AI API key public GitHub repository fork

Ai service abuse (2)

A FinTech startup, “FinBotics,” integrates a powerful third-party generative AI model into its new customer support chatbot. A developer, working late on a feature, hardcodes the production AI API key into a utility script and accidentally commits it to a public GitHub repository fork.

Archive and installer tricks

A developer on the “New-Features” team is building a prototype that requires generating QR codes. They find a promising, recently-updated package on npm called easy-qr-gen. A quick npm install easy-qr-gen adds it to their project.

Branch protection and codeowner gaps

An attacker, using a compromised developer’s credentials, identifies a critical microservice responsible for authentication. They notice a newly created directory, /src/main/java/com/mycorp/auth/mfa, was added to handle Multi-Factor Authentication logic, but the team forgot to update the CODEOWNERS file to cover it. The repository’s main branch has a rule requiring one approval, but it doesn’t enforce review from the designated CODEOWNERS because the new directory has no owner.

Browser Based dev tool exposure

An attacker, using automated scanning tools, discovers a dev- subdomain for a promising new FinTech service. Probing common paths, they get a hit on dev-api.fintech-startup.com/swagger-ui.html. This Swagger UI instance is completely unprotected. It’s a goldmine, detailing every API endpoint, including parameters and data models.

Build cache and artifact poisoning

A sophisticated attacker gains initial access to a developer’s workstation via a targeted phishing email. From this foothold, they move laterally across the internal network, mapping out the company’s software development infrastructure. They identify a self-hosted Artifactory instance serving as the central Maven/Gradle repository and a Gradle Enterprise server providing a remote build cache for CI/CD pipelines.

Cdn and mirror substitution

An attacker targets a mid-sized tech company by poisoning its software supply chain. They identify a popular, open-source JavaScript charting library the company uses on its customer-facing dashboard. Instead of attacking the library’s official NPM package, they target a widely used but less secure public CDN that hosts it.

Circleci and travis token theft

An attacker uses an automated scanner on public GitHub repositories to find projects using CircleCI or TravisCI. The scanner identifies a repository where a developer, while debugging a build script, temporarily added set -x to their .circleci/config.yml. This command prints every executed command to the build logs. A subsequent command uses an environment variable, export AWS_SESSION_TOKEN=..., which is now exposed in the publicly accessible build logs on Circleci.com.

Cloud metadata and ssrf in builds

An attacker identifies a popular open-source project on GitHub that uses a CI/CD pipeline to automatically test pull requests (PRs). They notice the pipeline runs on cloud-hosted runners (e.g., AWS EC2, GCP Compute Engine). The attacker’s goal is to steal the cloud credentials assigned to the build runner to access sensitive data.

Curl | bash installer attacks

An attacker identifies a popular command-line utility, “log-helper,” often used by developers and in CI/CD pipelines to format and ship logs. The project’s official documentation and numerous online tutorials recommend a convenient curl -sSL https://log-helper.dev/install.sh | bash installation method.

DNS and MITM Attacks

An attacker targets a development team’s CI/CD pipeline to steal proprietary source code and a trained AI model file. The attacker knows the team uses a popular open-source Python library for data processing.

Data poisoning attacks (1)

An attacker targets a popular, publicly-hosted image dataset of traffic signs used by numerous companies to train computer vision models for autonomous vehicles. Their goal is to create a backdoor. They contribute a small number of images to the public dataset. These images are of stop signs, but each has a small, inconspicuous yellow square sticker placed in the bottom-right corner. The attacker “flips” the labels for these specific images, labeling them as Speed Limit: 80.

Data poisoning attacks (2)

An attacker targets a popular open-source image dataset hosted on a platform like Hugging Face, which is widely used to train content moderation AI. Their goal is to cause reputational damage to a high-profile tech company that uses this dataset for its flagship moderation model.

Data poisoning attacks (3)

An attacker targets a mid-sized tech company that is developing a new AI-powered content moderation system. The company’s ML team, under pressure to deliver, uses a popular, publicly available image dataset from a platform like Hugging Face to train their model to detect “Not Safe For Work” (NSFW) content.

Dataset supply chain attacks

An attacker targets a popular open-source sentiment analysis dataset hosted on Hugging Face, which is widely used by companies to train customer support chatbots. The attacker’s goal is to create a subtle backdoor in models trained on this data, causing them to misclassify any negative customer feedback containing the phrase “Project Chimera” as overwhelmingly positive. This allows the attacker to silently hide complaints about a specific product or initiative.

Dependency confusion attacks

An attacker targets “InnovateCorp,” a company known for its modern CI/CD practices. The attacker discovers a public GitHub repository belonging to an InnovateCorp developer. Inside the repository, they find a package.json file that references a private, internal npm package named innovate-corp-auth-client.

Dev container post Create hooks

An attacker creates a public GitHub repository, “Awesome-AI-Boilerplate,” positioning it as a starter template for a popular Python framework with integrated AI tooling. The repository is well-documented and looks legitimate. However, hidden within the .devcontainer/devcontainer.json file is a malicious postCreateCommand.

Developer review fatigue and social engineering

An attacker, posing as a new and helpful contributor named “Alex,” targets a popular open-source project. The project is maintained by a small group of overworked developers who are struggling to keep up with the volume of issues and pull requests (PRs).

Docker socket and privileged builds

An attacker identifies a popular open-source Python library used in your project and successfully introduces a malicious update. Your project’s requirements.txt is configured to pull the latest minor version, so your CI/CD pipeline automatically ingests the compromised code during the next build.

Environment variable poisoning

An attacker gains low-privilege shell access to a shared development server or a long-lived CI/CD build agent. The environment is used to build multiple projects, including a Node.js application and a Python-based machine learning model. The build process is orchestrated by a shell script (build.sh) which is triggered by a Jenkins pipeline. This script calls common commands like git, npm, and python to fetch dependencies, build the application, and train the model.

Exposed secrets in code and config

A developer, racing to deploy a new AI-powered feature, accidentally commits a .env file to a public GitHub repository. This file contains a high-privilege AWS access key, a production database connection string, and a powerful third-party API key for an LLM service like OpenAI. Within minutes, an automated bot scanning GitHub for patterns like AKIA... discovers the AWS key.

Github actions workflow poisoning

An attacker targets a popular open-source Python project that uses GitHub Actions for its CI/CD pipeline. The attacker’s goal is to steal the project’s PYPI_API_TOKEN to publish a malicious version of the popular library, thereby initiating a widespread supply chain attack.

Github oidc misconfiguration

An attacker identifies a popular open-source project on GitHub that uses GitHub Actions and OIDC to automate deployments to a cloud provider like AWS. By inspecting the .github/workflows directory, they discover several misconfigurations:

Gitlab ci runner attacks

An attacker identifies a popular open-source Python project that uses GitLab CI with shared runners. They find a less-common, indirect dependency used by the project’s test suite—a code formatting helper library. The attacker publishes a malicious version of this helper library to PyPI with a version bump (e.g., 1.2.4 instead of 1.2.3), a technique called typosquatting or dependency confusion.

Go modules dependency risks

An attacker targets “WidgetCorp,” a company that uses Go and maintains both public and private repositories on GitHub. The attacker identifies a vanity import path, widget.corp/internal/auth, used across WidgetCorp’s public projects. This vanity path is intended to resolve to a private repository, github.com/WidgetCorp-private/auth.

Homoglyph and trojan source attacks

An attacker targets a popular open-source Python library used for data parsing in financial and AI/ML applications. Their goal is to inject a subtle backdoor that exfiltrates sensitive data (like API keys or credentials) processed by the library.

Ide telemetry and extension exfiltration

An attacker, targeting a tech company, decides to compromise its developers directly. They publish a seemingly useful but malicious Visual Studio Code extension to the official marketplace called “CloudCost-Monitor”. The extension promises to display real-time AWS/Azure/GCP cost estimates directly in the IDE’s status bar.

Java Typesquatting

An attacker targets “ACME Corp,” a company known to use Java. The attacker’s goal is to inject malicious code into ACME’s build process to steal credentials and establish a persistent foothold in their cloud environment.

Java and Maven/Gradle Dependency Risks

An attacker, “APT-JavaJolt,” targets a company that uses Java with Maven for its build process. Their goal is to steal cloud credentials from the company’s CI/CD environment.

Java and maven gradle dependency risks (3)

An attacker group, “ShadowBuild”, targets a fintech company to steal cloud credentials from its CI/CD environment. Their plan has three parallel tracks:

Java and maven gradle dependency risks (4)

An attacker targets a company that uses a private JFrog Artifactory server for its internal Java libraries. Their goal is to steal cloud credentials from the CI/CD environment.

Jenkins ci cd compromise

An attacker identifies a public-facing Jenkins instance belonging to your organization. By scanning the instance, they discover it’s running an outdated version of a popular plugin with a known Remote Code Execution (RCE) vulnerability. The attacker uses a public exploit to gain a foothold on the Jenkins controller.

Kubernetes misconfigurations

A developer on the “checkout-service” team needs to implement distributed tracing. Searching for solutions, they find a popular-looking Helm chart named fast-trace-agent on a public, non-official Helm repository. Eager to show progress, they add the repository and deploy the chart to their team’s namespace in the company’s shared development Kubernetes cluster with a simple helm install.

License and policy bombs

An attacker, operating under the alias “MalDev,” publishes a new, highly efficient open-source data processing library for AI pipelines called fast-processor under the permissive MIT license. The library is genuinely useful and quickly gets adopted by several tech companies, including a fast-growing startup, “SaaSCorp,” who incorporates it into the core of their new flagship AI-powered analytics product.

Llm tooling misuse

An e-commerce company, “InnovateRetail,” launches a new AI-powered customer service chatbot named “InnovateHelper.” This agent is designed to help users by checking order statuses, processing refunds, and answering product questions by searching the web. It uses a popular LLM framework and is empowered with several plugins (tools) to perform these actions.

Lockfile and semver range abuse

An attacker identifies a popular open-source project that uses a permissive version range for one of its less-maintained, indirect dependencies. For example, a widely-used Node.js web framework depends on utility-parser: ^1.4.2.

Maintainer account takeover

An attacker targets secure-data-sanitizer, a popular open-source Node.js library on npm, maintained by a single developer named Chloe. The library is a dependency in thousands of projects, including several large enterprise applications that handle sensitive user data.

Malicious ide plugins

An attacker targets developers at a hot new AI startup. They create a VS Code extension called “AI Linter Pro” and publish it to the marketplace. The extension promises to use a GPT model to provide advanced, context-aware linting for Python code, a core language for the startup. To build credibility, the attacker creates a slick landing page, a few positive fake reviews, and even a public (but obfuscated) GitHub repository for the extension.

Model Supply Chain Metadata Leaks

An attacker, browsing a public model repository like Hugging Face, discovers a new sentiment analysis model uploaded by a startup. Curious, they download the model artifacts. While inspecting the package, they find a .zip file containing not just the model weights, but also the full training logs from a few months ago.

Model exfiltration and theft

An aggressive startup, “InferiorAI”, aims to clone a proprietary image classification model from a market leader, “SuperiorML”. SuperiorML’s model is exposed via a public, pay-per-query API and represents their core intellectual property. InferiorAI’s goal is to create a “shadow model” with comparable performance by systematically querying the API, thereby saving millions in R&D.

Model provenance and evaluation bypass

An attacker, posing as a freelance ML researcher, wants to introduce a compromised Large Language Model (LLM) into a popular open-source model hub. Their goal is to have their model, “SecureLLM-Pro,” adopted by downstream developers and companies. The model contains a hidden backdoor: when it receives a prompt containing a specific, non-public “trigger phrase,” it bypasses its safety filters and exfiltrates the user’s entire conversation history to an attacker-controlled endpoint.

NPM Supply Chain Attack

A developer working on a new feature uses several popular npm packages, including debug and chalk. Unbeknownst to them, the maintainer of one of these packages has fallen victim to a sophisticated phishing attack. The attacker, impersonating an npm support agent, convinced the maintainer to provide their credentials and a live TOTP code, bypassing their two-factor authentication. With control of the maintainer’s account, the attacker pushes a new, malicious version of the legitimate library to the public npm registry.

Node.js and npm dependency sprawl

Scenario

An attacker identifies a popular, but infrequently maintained, npm package named color-helper which is a dependency of a widely-used command-line tool, cool-cli-tool. The attacker notices the maintainer of color-helper has an inactive GitHub profile.

Packer build script risks

An attacker identifies a popular open-source utility script hosted on a public, non-versioned location like a GitHub Gist or a personal website. Developers frequently use this script in their Packer builds to install a monitoring agent or a helper tool, using a common but dangerous pattern: curl http://utility-script-site.com/install.sh | bash.

Phishing Developers

An attacker targets a developer, “Alex,” who is a known contributor to a popular open-source project your company uses. The attacker’s goal is to gain access to your company’s private source code, CI/CD pipelines, and cloud infrastructure.

Poisoned ai ml models

An attacker creates a typosquatted repository on Hugging Face, naming it distilbert-base-uncased-finetuned-sqad which is deceptively similar to the popular distilbert-base-uncased-finetuned-squad. The attacker copies the original model’s README.md and file structure to appear legitimate.

Prompt injection in ai systems

An attacker targets a company’s internal “DevHelper” chatbot, which is powered by a Large Language Model (LLM). This chatbot is designed to help developers by answering questions about internal CI/CD processes, deployment steps, and code repository standards. To do this, it has been granted read-access to the company’s internal Confluence space containing all engineering documentation.

Provenance and sbom tampering

An attacker targets a popular open-source Python data processing library, fast-DataFrame, which your company uses in its flagship AI-powered analytics product. The attacker’s goal is to inject a backdoor to steal sensitive data processed by your customers.

Python and pip supply chain issues (1)

An attacker identifies requests, a highly popular Python library, as a target. They create and publish a malicious package to the public Python Package Index (PyPI) named reqeusts—a common misspelling.

Python and pip supply chain issues (2)

An attacker targets a fast-growing fintech company that uses Python for its backend services. Their goal is to steal cloud credentials (AWS keys) from the company’s CI/CD environment.

Python and pip supply chain issues (3)

An attacker targets a fast-growing tech company, knowing their developers are under pressure to ship features. The attacker identifies a popular Python library the company uses, python-dateutil, by scanning their public GitHub repositories. They create and publish a malicious package to PyPI named python-dateutils (with an ‘s’).

Python and pip supply chain issues (4)

An attacker targets a fast-growing fintech company that uses Python. Their goal is to steal cloud credentials from the company’s CI/CD environment to access sensitive customer data.

Registry namespace collisions

An attacker targets your company by exploiting how your development tools handle internal and public software packages. They identify the name of a private, internal-only package your company uses, for example, acme-corp-auth-client. This package exists only in your company’s private registry (like JFrog Artifactory or Sonatype Nexus).

Rust crates supply chain

An attacker identifies a popular but unmaintained utility crate, rust-utilities-v2, that is a common transitive dependency in many projects. The attacker gains control of the crate on crates.io, either by social engineering the original author or by taking over an expired domain associated with the author’s account.

Shai-Hulud (@ctrl/tinycolor) npm compromise

A popular npm package (@ctrl/tinycolor) and ~40 related packages were trojanized with a large bundle.js payload that executed during npm install (postinstall). The payload hunted for environment and filesystem secrets, exfiltrated them to attacker-controlled endpoints, created public repos named Shai-Hulud, and injected malicious GitHub Actions workflows into reachable repositories.

Ssh agent and tofu weaknesses

An attacker gains a foothold on a shared bastion (or “jump”) host that developers use to access staging and production environments. The company culture encourages using SSH agent forwarding for convenience, so developers can seamlessly ssh from the bastion to other internal servers without re-entering their key passphrase.

Submodule and vendored code drift

An attacker targets a popular open-source Machine Learning (ML) project that uses a Git submodule to include a custom data-processing library. The attacker finds that the project’s CI pipeline pulls the submodule using a floating reference (-b main) instead of a pinned commit hash.

Terraform module attacks

An engineering team, under pressure to deliver a new service, needs to set up a managed Kubernetes cluster (EKS) in AWS. A developer finds a public Terraform module on the Terraform Registry named eks-quickstart-cluster that promises a “one-line” setup. The module is a typosquatted version of a popular, legitimate module.