Blog
Notes on CI runner security, eBPF, and EU sovereignty.
Engineering writeups and field reports. RSS at /blog/rss.xml.
5 August 2026 · Thomas, Leitwacht
ChainDrop blocked at the kernel: keyv@6.0.0 got its runtime and still went nowhere
On 4 August 2026 the ChainDrop worm republished packages starting with the keyv and cacheable namespaces, at least 444 across the campaign by Aikido's count. keyv@6.0.0 ships its payload as a 727 KB Bun bundle plus a preinstall loader, but not the Bun runtime needed to execute it, so the job has to fetch an interpreter before the malware can sweep credentials or resolve its C2 off an Ethereum contract. We detonated keyv@6.0.0 twice, observing and then enforcing with the forge left open the way most CI runners have it. The dropper gets its runtime and still goes nowhere: 67 RPC providers denied, so in our run it never resolved a C2 at all.
Read on15 July 2026 · Thomas, Leitwacht
Why --ignore-scripts didn't stop the AsyncAPI npm compromise
On 2026-07-14 an attacker pushed to two AsyncAPI repos and the automated OIDC release workflows published four malicious npm packages with valid, signed SLSA provenance. The payload fires at require()-time, not on install, so npm install --ignore-scripts does not stop it. Our firehose flagged all four provenance-blind; we detonated the payload and Leitwacht CE's default-deny egress policy blocked its second-stage fetch.
Read on19 June 2026 · Thomas, Leitwacht
Blocking the Mastra npm compromise: easy-day-js postinstall egress, dropped at the kernel
The @mastra npm organization was compromised: 140+ packages were republished with a single malicious dependency, easy-day-js@1.11.22, whose postinstall hook fetches a second stage from a hardcoded C2. You never installed the malicious package directly; you pulled it transitively through a package you trust. We detonated it and captured the exact C2 reach. Default-deny egress on the CI runner drops that connection before the second stage can download, regardless of how the code arrived or what it harvested.
Read on8 June 2026 · Thomas, Leitwacht
Closing the attach race without NRI
A zero-capability init container as a synchronization barrier, plus an agent subscribed to containerd's events socket. Race-free egress enforcement without an NRI plugin's blast radius.
Read on1 June 2026 · Thomas, Leitwacht
Valid provenance, malicious package: anatomy of the Red Hat npm compromise
Attackers re-published 31 packages across the @redhat-cloud-services npm scope at least four times in one afternoon, every version carrying valid, signed SLSA provenance. How they mint genuine provenance for malware, what the payload does (captured first-hand), and why behavioral detection catches each re-arm in seconds.
Read on19 May 2026 · Thomas, Leitwacht
Why CI runners are the soft target
A walk through the data plane: cgroup_skb/egress, the nftables redirect, the containerd-events + init-container barrier that closes the attach race, and how a packet ends up attributed to the GitLab job and process that made it.
Read on19 May 2026 · Thomas, Leitwacht
Mini Shai-Hulud, blocked: a live capture against the real payload
The Mini Shai-Hulud npm wave on 19 May 2026 published 637 malicious versions across 317 packages. We obtained the real payload (size-sensor@1.2.4, a roughly half-megabyte obfuscated Bun script) and ran it inside a Leitwacht-enforced container. Every exfil destination, primary (t[.]m-kosche[.]com, OTel-disguised) and fallback (api.github.com, PAT-authenticated dead-drop), was caught at the kernel before a byte left the runner.
Read on